Ruben Fiszel 343ce6e143 fix: derive a raw app's policy on deploy, and default an omitted execution_mode (#10733) ...

* fix: default an omitted app policy execution_mode to publisher

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: drop stale comments claiming execution_mode is required

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: derive a raw app's policy on deploy instead of trusting the caller's

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: pin the ee ref to the companion branch

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: vendor the raw-app policy derivation into the bundle job

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: note the vendored raw-app policy bundle

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: derive the policy on a value-only raw-source update too

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: reject raw-app runnables whose shape yields an unusable grant

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: cache the new policy query and tighten raw-app runnable validation

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: let the policy bundle drift guard survive a CRLF checkout

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 23431f5cf1d627051ded89111bbf2e301e9db456

This commit updates the EE repository reference after PR #729 was merged in windmill-ee-private.

Previous ee-repo-ref: 0bdf8818fa115ad6b0d14f3117a18e8a580cce4d

New ee-repo-ref: 23431f5cf1d627051ded89111bbf2e301e9db456

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

2026-08-18 01:52:10 +02:00

..

fixtures/yaml-snapshots

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

app_dev_path_schema_fetch.test.ts

fix: populate wmill.d.ts schemas in wmill app dev (#8882)

2026-04-20 17:22:31 +00:00

app_dev_wmill_dts_unit.test.ts

fix(cli): preserve case in raw-app runnable filenames (#8940)

2026-04-27 04:02:39 +00:00

app_inline_script_delete.test.ts

fix: handle inline script deletion in sync push + flow new nonDottedPaths (#8553)

2026-03-27 11:54:45 +00:00

app_inline_script_ordering_unit.test.ts

fix(cli): stable auto-numbered inline-script names in app pull (#9071)

2026-05-07 13:26:32 +00:00

app_policy_bundle_unit.test.ts

fix: derive a raw app's policy on deploy, and default an omitted execution_mode (#10733)

2026-08-18 01:52:10 +02:00

audit_token_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

cargo_backend_example.standalone.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

cargo_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

case_insensitive_collisions_unit.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

conf_branch_override_unit.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

containerized_backend.ts

feat(cli): detect missing folders on sync push and add 'wmill folder add-missing' (#8011)

2026-02-24 08:38:17 +00:00

datatable_migrations_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

datatable_pg_wire_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

datatable_settings_sync.test.ts

feat: add datatable config support to CLI settings sync and backend export (#8024)

2026-03-14 04:44:11 +00:00

datatable_virtual_catalog_unit.test.ts

feat: CLI datatable serve / psql (#9267)

2026-05-20 16:56:50 +00:00

dbt_module_tracker_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

dbt_optional_descriptor_unit.test.ts

a project does not collide with its own descriptor (#10444)

2026-08-01 14:48:00 +02:00

dependency_tree_unit.test.ts

feat: support temp_script_refs in wmill dev for local relative imports (#9554)

2026-06-16 10:21:37 +02:00

deploy_on_behalf_of_unit.test.ts

fix: make on_behalf_of control permissions for scripts and flows (#10438)

2026-08-01 20:37:21 +02:00

dev_recorder_bundle_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_recorder_routes_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

dev_server.test.ts

feat(cli): wmill dev with per-flow proxy and responsive Dev UI (#8529)

2026-04-27 20:14:21 +00:00

duckdb_macros_unit.test.ts

fix(cli): macro-library parity in --local pipeline graph + read-only run --dry-run (#9942)

2026-07-06 01:36:42 +02:00

elements_to_map_branch_specific_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

esbuild_loader_unit.test.ts

fix(cli): fall back to esbuild-wasm on native host/binary mismatch (#9629)

2026-06-17 02:33:18 +02:00

fileset_sync_unit.test.ts

fix(cli): sync push crashed on edited fileset children; reject non-canonical fileset dirs (#10572)

2026-08-11 13:16:45 +00:00

flow_notes_ordering_unit.test.ts

fix: preserve flow notes/groups and field ordering in generate-metadata (#8641) (#8642)

2026-03-31 13:48:22 +00:00

folder_default_permissioned_as.test.ts

fix: omit default_permissioned_as from tarball export when empty

2026-04-22 19:31:37 +00:00

folder_missing_meta.test.ts

fix(cli): correct misleading delete-fork command description (#9870)

2026-07-01 23:49:25 +02:00

folder_schedule_push.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

fork_branch_id_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

fork_branch_profile_resolution_unit.test.ts

feat(cli): clarify fork-branch workspace auto-targeting in output (#9988)

2026-07-07 17:08:09 +00:00

fork_merge.test.ts

feat: add CLI workspace merge command and enhance fork with datatable/color support (#8756)

2026-04-08 05:29:48 +00:00

generate_metadata_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

git_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

gitsync_converter_unit.test.ts

feat: sync data table migrations to git, gated by a new object type (#10436)

2026-07-31 23:33:47 +02:00

gitsync_promotion.test.ts

feat(git-sync): enable per-item promotion mode on dev workspaces (#10205)

2026-07-21 17:07:52 +00:00

gitsync_settings_features.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

group_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

guidance_writer_unit.test.ts

feat(cli): improve agent prompts/skills and workspace fork workflow (#9531)

2026-06-12 00:16:16 +02:00

headers_env_var.test.ts

fix(cli-tests): stabilize flow lock-gen race + Windows path (#9080)

2026-05-08 07:43:21 +02:00

http_guards_unit.test.ts

fix(cli): detect upstream auth-gateway HTML responses and add poll heartbeat (#9065)

2026-05-06 23:48:32 +00:00

include_flags_bypass_filtering.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

init_bind_flow.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

init_no_git_sync.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

init_template_unit.test.ts

fix(cli): pipeline + workspace UX batch (init/bind stub, run errors, macro libs, lock-job report, upgrade errors) (#9929)

2026-07-05 16:24:04 +02:00

inline_scripts_failure_preprocessor_unit.test.ts

fix(cli): consistent flow inline lock filenames for compound extensions (#9555)

2026-06-12 17:20:54 +02:00

instance_configs_unit.test.ts

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

job_commands.test.ts

feat: improve CLI flow log streaming and job inspection (#8644)

2026-03-31 18:22:18 +00:00

labels_export.test.ts

feat: add optional labels to scripts, flows, apps, schedules, triggers (#8609)

2026-04-03 17:39:32 +00:00

lint_command_unit.test.ts

fix(cli): lint against the checkout's schema, not the published validator (#10418)

2026-07-30 23:33:35 +02:00

lint_locks_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

list_get_new_commands.test.ts

feat: add Azure Event Grid triggers (#8888)

2026-04-23 16:30:18 +00:00

local_encryption_unit.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

lock_cache_unit.test.ts

fix(cli): include lock-relevant script content in lock cache key (#9528)

2026-06-11 07:43:45 +00:00

lockfile_format_pinning_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

mixed_case_paths.test.ts

fix(cli): reconcile case-only path drift during sync on case-insensitive filesystems (WIN-2020) (#9485)

2026-06-09 08:09:04 +00:00

multi_instance_workspace.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

new_commands_helpers.ts

test(cli): drain async dependency jobs after sync push to fix flake (#10293)

2026-07-24 10:23:18 +02:00

override_settings_behavior.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

parser_packages_unit.test.ts

fix(cli): publish all windmill-parser-wasm-* deps so local pipeline graph keeps write edges (#9926)

2026-07-05 12:14:22 +02:00

pending_script_lock_unit.test.ts

fix(cli): preserve committed script.lock on transient NULL lock during git-sync deploy (#9593)

2026-06-15 19:21:38 +02:00

pipeline_bounded_cascade_unit.test.ts

fix(parsers): keep s3 asset path suffix verbatim to preserve storage distinction (#10241)

2026-07-21 16:25:06 +00:00

pipeline_enrich_unit.test.ts

feat(pipeline): local development for data pipelines (CLI --local + pipeline dev preview) (#9840)

2026-07-01 11:41:36 +02:00

pipeline_local_graph_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

pipeline_partition_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

pipeline_upload_unit.test.ts

fix: pipeline dogfooding fixes — SCD2 data-test scope, --partition, s3object upload binding (#9875)

2026-07-02 12:04:54 +02:00

preview_path_unit.test.ts

fix(cli): attach the right job path to preview runs (#10606)

2026-08-10 19:37:46 +02:00

preview.test.ts

fix(cli): attach the right job path to preview runs (#10606)

2026-08-10 19:37:46 +02:00

protection_rules_converter_unit.test.ts

feat: add wmill protection-rules pull/push CLI commands (#9240)

2026-05-19 17:40:34 +00:00

pull_on_behalf_of_marker.test.ts

fix(cli): stop emitting has_on_behalf_of/has_permissioned_as: false on pull (#10188)

2026-07-19 09:30:49 +02:00

push_workspace_key_unit.test.ts

fix(cli): make encryption key push non-interactive-safe + add --skip-reencrypt-on-key-change (#9402)

2026-06-02 07:11:29 +00:00

push_workspace_settings_name_unit.test.ts

feat: make the fork lineage the only deploy relationship (#10410)

2026-07-30 14:20:27 +00:00

raw_app_missing_css_unit.test.ts

fix: raw apps with no stylesheet were permanently un-deployable (#10364)

2026-07-27 22:32:57 +02:00

raw_app_recordings_skip_unit.test.ts

feat: add session recording to wmill app dev (#10457)

2026-08-02 22:54:37 +02:00

raw_app_svelte_compiler_resolution_unit.test.ts

fix(cli): load the app's ESM svelte compiler, not its CJS one (#10622)

2026-08-10 21:50:03 +02:00

raw_app_svelte_module_unit.test.ts

fix(cli): compile runes in .svelte.ts / .svelte.js modules (#10400)

2026-07-29 11:13:16 +02:00

raw_app_sync.test.ts

fix(cli): stop a deleted raw-app .lock from dropping the whole app push (#10473)

2026-08-03 18:23:34 +02:00

raw_app_workspace_deps_unit.test.ts

fix: apply default workspace dependencies to raw app runnables (#10427)

2026-07-31 11:42:43 +02:00

relative_imports_skip.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

relative_imports_wasm.test.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

replace_path_scripts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

repro_diffname.test.ts

test: fix repro_diffname CLI flake by draining the app dependency job (#10659)

2026-08-12 13:10:26 +02:00

resource_folders_unit.test.ts

feat: run dbt projects as a first-class Windmill runtime (#10326)

2026-08-01 11:58:05 +00:00

resource_types_unit.test.ts

fix: compile resource types with no properties instead of throwing (#10730)

2026-08-17 22:14:07 +02:00

schedule_history_commands.test.ts

feat(cli): add job, group, audit, token commands and schedule enable/disable (#8581)

2026-03-28 09:18:55 +00:00

script_envs_sync.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

script_modules_unit.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

script_push_metadata_unit.test.ts

fix: align script push metadata warning with generated locks (#8690)

2026-04-03 11:41:31 +00:00

settings_unit.test.ts

feat: make the fork lineage the only deploy relationship (#10410)

2026-07-30 14:20:27 +00:00

setup.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

shared_ui_diff_unit.test.ts

fix(cli): surface shared UI changes in sync push dry-run preview (#10278)

2026-07-23 11:26:33 +02:00

slack_settings_sync.test.ts

feat(cli): non-interactive Slack connect/disconnect + sync round-trip fixes (#8935)

2026-04-24 17:14:08 +00:00

specific_items_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

standalone_commands.test.ts

test(cli): de-flake script run tests with retry + failure diagnostics (#9801)

2026-06-25 19:57:26 +02:00

sync_config_resolution.test.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

sync_pull_push.test.ts

test(cli): drain async dependency jobs after sync push to fix flake (#10293)

2026-07-24 10:23:18 +02:00

sync_push_auto_metadata_repro.test.ts

fix(cli): resolve cross-folder relative imports during lockgen on fresh DB (#9048)

2026-05-05 21:06:53 +00:00

sync_push_script_metadata_only.test.ts

fix(cli): resolve module script metadata on windows path separators (#10358)

2026-07-27 16:00:08 +02:00

tar_creation_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_backend.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

test_config_helpers.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041)

2026-02-21 21:19:04 +00:00

test_fixtures.ts

feat(cli): better stale scripts detection #3 (#8480)

2026-03-23 18:20:19 +00:00

unified_generate_metadata.test.ts

remove dead legacyBehaviour param from metadata functions (#8695)

2026-04-03 12:01:34 +00:00

utils_unit.test.ts

fix(cli): delete file resources at the right path on sync push (#10639)

2026-08-11 13:17:31 +00:00

variable_ciphertext_shape_unit.test.ts

fix: prevent variable push from corrupting is_secret variables (#9705)

2026-06-23 12:45:36 +02:00

variable_resource_push.test.ts

fix: prevent variable push from corrupting is_secret variables (#9705)

2026-06-23 12:45:36 +02:00

wmill_lock_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

workspace_conflicts_unit.test.ts

chore(cli): separate unit tests from integration tests and fix test cleanup (#8562)

2026-03-27 16:13:33 +00:00

workspace_deps_filter.test.ts

fix: skip generate-metadata confirmation prompt in non-interactive CI (#8678)

2026-04-02 19:28:39 +00:00

workspace_key_filename_integration.test.ts

fix(cli): use wmill.yaml key consistently for workspace-specific items (#8900)

2026-04-23 16:31:41 +00:00

workspaces_config.test.ts

feat: unify CLI config to workspaces, deprecate gitBranches/environments (#8767)

2026-04-09 19:46:34 +00:00

ws_specific_flag_only_unit.test.ts

feat: add workspace-specific flag for resources and variables (#8836)

2026-05-07 13:35:54 +00:00

yaml_format_snapshot_unit.test.ts

feat(cli): wmill-lock.yaml auto-fill + --rehash-only + path-prefix dedup (#8978)

2026-05-01 15:11:56 +00:00

yaml_inline_tag.test.ts

fix(cli): preserve inline script files during flow generate-locks (#8561)

2026-03-27 19:27:56 +00:00