fix: run unstamped git auto-pulls as a superadmin when no admin (#11973)

* [ee] fix: run unstamped git auto-pulls as a superadmin when the workspace has no admin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* bump ee ref: log the fallback identity

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 6858e4cbd515b52713afea8dc32b23072af2248c

This commit updates the EE repository reference after PR #918 was merged in windmill-ee-private.

Previous ee-repo-ref: 03d89d10bdd9fba9d1184dc75f8582a5ad3741a8

New ee-repo-ref: 6858e4cbd515b52713afea8dc32b23072af2248c

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/.sqlx/query-9aaee16823c7d3fc0954274ba71bc2eae7d950f759d146339c30df039cf10fd8.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT p.email FROM password p LEFT JOIN usr m ON m.workspace_id = $1 AND m.email = p.email WHERE p.super_admin AND NOT p.disabled AND (m.email IS NOT NULL AND NOT m.disabled OR m.email IS NULL AND NOT EXISTS (SELECT 1 FROM usr c WHERE c.workspace_id = $1 AND c.username = COALESCE(p.username, p.email))) ORDER BY m.email IS NULL, p.email LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "9aaee16823c7d3fc0954274ba71bc2eae7d950f759d146339c30df039cf10fd8"
+}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-a2a23aebcf91985778fb632a415a6990d022f7c8
+6858e4cbd515b52713afea8dc32b23072af2248c

backend/tests/git_sync_autopull_identity.rs

@@ -192,3 +192,25 @@ async fn unstamped_fork_pull_runs_as_the_parents_first_admin(
     assert_eq!(pull_identities(&db, FORK).await?, vec![identity("aaron")]);
     Ok(())
 }
+
+/// A workspace with no admin and no stamp runs its pulls as an instance superadmin, skipping
+/// sam, whose instance username a member holds, and the deactivated seeded superadmin.
+#[sqlx::test(fixtures("git_sync_autopull_identity"))]
+async fn unstamped_pull_without_admins_runs_as_a_superadmin(
+    db: Pool<Postgres>,
+) -> anyhow::Result<()> {
+    sqlx::query("UPDATE usr SET is_admin = false WHERE workspace_id = $1")
+        .bind(PARENT)
+        .execute(&db)
+        .await?;
+    sqlx::query("UPDATE password SET disabled = true WHERE email = 'admin@windmill.dev'")
+        .execute(&db)
+        .await?;
+    let mut repo = repo_enabled_by("alice@windmill.dev");
+    repo.auto_pull.as_mut().unwrap().enabled_by = None;
+
+    let job = reconcile_and_enqueue_pull(&db, PARENT, &repo, "main", "abc123", None).await?;
+    assert!(job.is_some(), "{}", recorded_pull_error(&db, PARENT).await?);
+    assert_eq!(pull_identities(&db, PARENT).await?, vec![identity("sue")]);
+    Ok(())
+}