From 920771b5987ea59786ac03f6e3bf5773bbeec509 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 2 Oct 2026 19:07:50 +0200
Subject: [PATCH] keep tagged binary prebuilds off the dependency job tag
 (#11489)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 backend/tests/dependency_job_tag.rs | 60 +++++++++++++++++++++++++++++
 backend/windmill-queue/src/jobs.rs  | 23 ++++++++---
 2 files changed, 78 insertions(+), 5 deletions(-)

diff --git a/backend/tests/dependency_job_tag.rs b/backend/tests/dependency_job_tag.rs
index f7e89ef83e..e1b5dc4628 100644
--- a/backend/tests/dependency_job_tag.rs
+++ b/backend/tests/dependency_job_tag.rs
@@ -61,5 +61,65 @@ async fn relocks_go_to_the_configured_dependency_job_tag(db: Pool<Postgres>) ->
             ),
         ]
     );
+
+    // A binary prebuild given `auto_build_binary_tag` keeps it; an untagged one follows its
+    // dependency job.
+    assert_eq!(
+        push_binary_prebuild(&db, Some("build-pool")).await?,
+        "build-pool"
+    );
+    assert_eq!(
+        push_binary_prebuild(&db, None).await?,
+        "deps-test-workspace"
+    );
     Ok(())
 }
+
+async fn push_binary_prebuild(db: &Pool<Postgres>, tag: Option<&str>) -> anyhow::Result<String> {
+    let mut args = std::collections::HashMap::new();
+    args.insert(
+        "build_binary_only".to_string(),
+        windmill_common::worker::to_raw_value(&true),
+    );
+    let (build_id, tx) = windmill_queue::push(
+        db,
+        windmill_queue::PushIsolationLevel::IsolatedRoot(db.clone()),
+        "test-workspace",
+        windmill_common::jobs::JobPayload::BuildBinary {
+            path: "f/tags/plain".to_string(),
+            hash: windmill_common::scripts::ScriptHash(7_100_002),
+            language: windmill_common::scripts::ScriptLang::Go,
+        },
+        windmill_queue::PushArgs::from(&args),
+        "test-user",
+        "test@windmill.dev",
+        "u/test-user".to_string(),
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        None,
+        false,
+        false,
+        None,
+        true,
+        tag.map(str::to_string),
+        None,
+        None,
+        None,
+        None,
+        false,
+        None,
+        None,
+        None,
+    )
+    .await?;
+    tx.commit().await?;
+    Ok(sqlx::query_scalar("SELECT tag FROM v2_job WHERE id = $1")
+        .bind(build_id)
+        .fetch_one(db)
+        .await?)
+}
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 19be82d66f..a06c98b902 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -4622,6 +4622,8 @@ pub async fn pull(
                         let tag = match configured_dependency_job_tag(
                             &job.kind,
                             job.script_lang.as_ref(),
+                            // the job sits on a shell worker's tag, so its own tag is lost
+                            false,
                             &job.workspace_id,
                             db,
                         )
@@ -5289,15 +5291,20 @@ pub async fn resolve_push_tag(
 
 /// The tag a dependency job is routed to when the instance's `dependency_job_tag` setting is
 /// set, whatever tag the script, flow or app itself runs on. `None` for any other job kind, for
-/// bunnative (its bundle must be built on a worker with the bun tag), or when the setting is
-/// unset.
+/// bunnative (its bundle must be built on a worker with the bun tag), for a binary prebuild
+/// pushed with an explicit `auto_build_binary_tag`, or when the setting is unset. An untagged
+/// prebuild follows its dependency job onto the configured tag.
 pub async fn configured_dependency_job_tag(
     job_kind: &JobKind,
     language: Option<&ScriptLang>,
+    tagged_binary_prebuild: bool,
     workspace_id: &str,
     db: &DB,
 ) -> Option<String> {
-    if !job_kind.is_dependency() || language == Some(&ScriptLang::Bunnative) {
+    if !job_kind.is_dependency()
+        || tagged_binary_prebuild
+        || language == Some(&ScriptLang::Bunnative)
+    {
         return None;
     }
     let tag = DEPENDENCY_JOB_TAG.load_full();
@@ -7182,8 +7189,14 @@ async fn push_inner<'c, 'd>(
             runnable_path.clone().expect("dedicated script has a path")
         );
         windmill_common::worker::dedicated_worker_tag(workspace_id, &full_path)
-    } else if let Some(tag) =
-        configured_dependency_job_tag(&job_kind, language.as_ref(), workspace_id, db).await
+    } else if let Some(tag) = configured_dependency_job_tag(
+        &job_kind,
+        language.as_ref(),
+        build_binary_only && tag.is_some(),
+        workspace_id,
+        db,
+    )
+    .await
     {
         tag
     } else {