fix: authenticate the fork-branch poll and correct the renewal guidance

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75

backend/ee-repo-ref.txt

@@ -1 +1 @@
-03c219d10ac06d2bd5db50b7f5a1ab921b886a51
+b705a9be1c4294851f534bab7a7cdfa75303d715

backend/windmill-store/src/resources.rs

@@ -3272,8 +3272,7 @@ async fn get_git_commit_hash(
     // under the repository it was issued for: a resource repointed at another
     // host asks for that repository's credential and finds none.
     git_resource.url =
-        windmill_common::git_sync_oss::with_stored_credential(&db, &w_id, git_resource.url)
-            .await?;
+        windmill_common::git_sync_oss::with_stored_credential(&db, &w_id, git_resource.url).await?;
 
     let identities: Vec<String> = query
         .git_ssh_identity
@@ -4062,6 +4061,11 @@ pub async fn get_git_repo_fork_heads_for_autopull(
         ));
     }
     git_resource.url = resolve_azure_devops_url(&dba, w_id, &git_resource.url, true).await?;
+    // Same reason as the head probe above: a repository whose credential Windmill
+    // holds carries none in its URL, and listing the fork branches is the half of
+    // polling that would otherwise go out unauthenticated.
+    git_resource.url =
+        windmill_common::git_sync_oss::with_stored_credential(db, w_id, git_resource.url).await?;
     validate_git_url(&git_resource.url).await?;
     validate_git_ref(base_branch)?;
 

frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte

@@ -219,16 +219,17 @@
 			}
 		}
 		if (days > 30) return undefined
-		// Two different things stop a renewal, and they need opposite advice: a
-		// token that may not rotate itself, or a token Windmill cannot store the
-		// replacement for. Scopes say which.
+		// Two different things stop a renewal, and they need opposite advice: a token
+		// that may not rotate itself, or one Windmill does not hold. Scopes say
+		// which, because a token Windmill holds and that may rotate itself is
+		// renewed, and so never reaches here.
 		const canSelfRotate = (credential.scopes ?? []).some((s) => s === 'api' || s === 'self_rotate')
 		return {
 			type: days <= 7 ? ('error' as const) : days <= 14 ? ('warning' as const) : ('info' as const),
 			title: `Repository token ${when}`,
 			body:
 				(canSelfRotate
-					? 'Windmill cannot renew it because it cannot write the new token back to where this URL is stored. Move the URL into a Windmill variable, or replace the token before it expires.'
+					? 'Windmill only renews a token it holds, and this one is written into the repository URL. Connect the repository with the GitLab button to hand the token over, or replace it before it expires.'
 					: 'Give the token the api or self_rotate scope and Windmill will renew it on its own. Otherwise, replace it before it expires to keep sync running.') +
 				// The remedy lives with the credential, which the resource owns; saying
 				// where stops the warning being a dead end.