From b5cfab11d5edbca2b900f8ba44d8288dc72cc56f Mon Sep 17 00:00:00 2001 From: hugocasa Date: Mon, 7 Sep 2026 14:32:19 +0200 Subject: [PATCH] fix: authenticate the fork-branch poll and correct the renewal guidance Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75 --- backend/ee-repo-ref.txt | 2 +- backend/windmill-store/src/resources.rs | 8 ++++++-- .../lib/components/git_sync/GitSyncRepositoryCard.svelte | 9 +++++---- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index bd7fab74a5..56ef0b00b6 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -03c219d10ac06d2bd5db50b7f5a1ab921b886a51 \ No newline at end of file +b705a9be1c4294851f534bab7a7cdfa75303d715 \ No newline at end of file diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs index 228b1bea37..d2721693c2 100644 --- a/backend/windmill-store/src/resources.rs +++ b/backend/windmill-store/src/resources.rs @@ -3272,8 +3272,7 @@ async fn get_git_commit_hash( // under the repository it was issued for: a resource repointed at another // host asks for that repository's credential and finds none. git_resource.url = - windmill_common::git_sync_oss::with_stored_credential(&db, &w_id, git_resource.url) - .await?; + windmill_common::git_sync_oss::with_stored_credential(&db, &w_id, git_resource.url).await?; let identities: Vec = query .git_ssh_identity @@ -4062,6 +4061,11 @@ pub async fn get_git_repo_fork_heads_for_autopull( )); } git_resource.url = resolve_azure_devops_url(&dba, w_id, &git_resource.url, true).await?; + // Same reason as the head probe above: a repository whose credential Windmill + // holds carries none in its URL, and listing the fork branches is the half of + // polling that would otherwise go out unauthenticated. + git_resource.url = + windmill_common::git_sync_oss::with_stored_credential(db, w_id, git_resource.url).await?; validate_git_url(&git_resource.url).await?; validate_git_ref(base_branch)?; diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte index ccfffe19a4..9817017d6e 100644 --- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte +++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte @@ -219,16 +219,17 @@ } } if (days > 30) return undefined - // Two different things stop a renewal, and they need opposite advice: a - // token that may not rotate itself, or a token Windmill cannot store the - // replacement for. Scopes say which. + // Two different things stop a renewal, and they need opposite advice: a token + // that may not rotate itself, or one Windmill does not hold. Scopes say + // which, because a token Windmill holds and that may rotate itself is + // renewed, and so never reaches here. const canSelfRotate = (credential.scopes ?? []).some((s) => s === 'api' || s === 'self_rotate') return { type: days <= 7 ? ('error' as const) : days <= 14 ? ('warning' as const) : ('info' as const), title: `Repository token ${when}`, body: (canSelfRotate - ? 'Windmill cannot renew it because it cannot write the new token back to where this URL is stored. Move the URL into a Windmill variable, or replace the token before it expires.' + ? 'Windmill only renews a token it holds, and this one is written into the repository URL. Connect the repository with the GitLab button to hand the token over, or replace it before it expires.' : 'Give the token the api or self_rotate scope and Windmill will renew it on its own. Otherwise, replace it before it expires to keep sync running.') + // The remedy lives with the credential, which the resource owns; saying // where stops the warning being a dead end.