From cba4db950bfd7dc947e53b466430b094f52b433d Mon Sep 17 00:00:00 2001
From: Diego Imbert <diego@windmill.dev>
Date: Fri, 13 Mar 2026 21:32:51 +0100
Subject: [PATCH] feat: add non_diffable flag to resource table

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 ...60313000000_resource_non_diffable.down.sql |  1 +
 ...0260313000000_resource_non_diffable.up.sql |  3 +++
 backend/windmill-store/src/resources.rs       | 20 +++++++++++++++----
 cli/src/commands/resource/resource.ts         |  1 +
 4 files changed, 21 insertions(+), 4 deletions(-)
 create mode 100644 backend/migrations/20260313000000_resource_non_diffable.down.sql
 create mode 100644 backend/migrations/20260313000000_resource_non_diffable.up.sql

diff --git a/backend/migrations/20260313000000_resource_non_diffable.down.sql b/backend/migrations/20260313000000_resource_non_diffable.down.sql
new file mode 100644
index 0000000000..e023c32a2d
--- /dev/null
+++ b/backend/migrations/20260313000000_resource_non_diffable.down.sql
@@ -0,0 +1 @@
+ALTER TABLE resource DROP COLUMN IF EXISTS non_diffable;
diff --git a/backend/migrations/20260313000000_resource_non_diffable.up.sql b/backend/migrations/20260313000000_resource_non_diffable.up.sql
new file mode 100644
index 0000000000..ce42bb3359
--- /dev/null
+++ b/backend/migrations/20260313000000_resource_non_diffable.up.sql
@@ -0,0 +1,3 @@
+-- Add non_diffable flag to resource table.
+-- When true, the resource is excluded from workspace diff comparisons (e.g. auto-created resources during fork).
+ALTER TABLE resource ADD COLUMN IF NOT EXISTS non_diffable BOOLEAN NOT NULL DEFAULT false;
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 8d5ba23b67..ab056a171f 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -127,6 +127,8 @@ pub struct Resource {
     pub extra_perms: serde_json::Value,
     pub created_by: Option<String>,
     pub edited_at: Option<chrono::DateTime<chrono::Utc>>,
+    #[serde(default)]
+    pub non_diffable: bool,
 }
 
 #[derive(FromRow, Serialize, Deserialize)]
@@ -145,6 +147,8 @@ pub struct ListableResource {
     pub is_expired: Option<bool>,
     pub refresh_error: Option<String>,
     pub account: Option<i32>,
+    #[serde(default)]
+    pub non_diffable: bool,
 }
 
 #[derive(Deserialize)]
@@ -153,12 +157,15 @@ pub struct CreateResource {
     pub value: Option<Box<RawValue>>,
     pub description: Option<String>,
     pub resource_type: String,
+    #[serde(default)]
+    pub non_diffable: Option<bool>,
 }
 #[derive(Deserialize)]
 struct EditResource {
     path: Option<String>,
     description: Option<String>,
     value: Option<Box<RawValue>>,
+    non_diffable: Option<bool>,
 }
 
 #[derive(Deserialize)]
@@ -254,6 +261,7 @@ async fn list_resources(
             "account.refresh_error",
             "resource.created_by",
             "resource.edited_at",
+            "resource.non_diffable",
         ])
         .left()
         .join("variable")
@@ -812,15 +820,16 @@ async fn create_resource(
     }
     sqlx::query!(
         "INSERT INTO resource
-            (workspace_id, path, value, description, resource_type, created_by, edited_at)
-            VALUES ($1, $2, $3, $4, $5, $6, now()) ON CONFLICT (workspace_id, path)
-            DO UPDATE SET value = EXCLUDED.value, description = EXCLUDED.description, resource_type = EXCLUDED.resource_type, edited_at = now()",
+            (workspace_id, path, value, description, resource_type, created_by, edited_at, non_diffable)
+            VALUES ($1, $2, $3, $4, $5, $6, now(), $7) ON CONFLICT (workspace_id, path)
+            DO UPDATE SET value = EXCLUDED.value, description = EXCLUDED.description, resource_type = EXCLUDED.resource_type, edited_at = now(), non_diffable = EXCLUDED.non_diffable",
         w_id,
         resource.path,
         raw_json as sqlx::types::Json<&RawValue>,
         resource.description,
         resource.resource_type,
-        authed.username
+        authed.username,
+        resource.non_diffable.unwrap_or(false)
     )
     .execute(&mut *tx)
     .await?;
@@ -1068,6 +1077,9 @@ async fn update_resource(
     if let Some(ndesc) = ns.description {
         sqlb.set_str("description", ndesc);
     }
+    if let Some(nd) = ns.non_diffable {
+        sqlb.set_str("non_diffable", if nd { "true" } else { "false" });
+    }
 
     sqlb.set_str("edited_at", "now()");
 
diff --git a/cli/src/commands/resource/resource.ts b/cli/src/commands/resource/resource.ts
index e28a479f13..332c8f3311 100644
--- a/cli/src/commands/resource/resource.ts
+++ b/cli/src/commands/resource/resource.ts
@@ -26,6 +26,7 @@ export interface ResourceFile {
   description?: string;
   resource_type: string;
   is_oauth?: boolean; // deprecated
+  non_diffable?: boolean;
 }
 
 async function readFilesetDirectory(dirPath: string): Promise<Record<string, string>> {