mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-08 08:04:25 +00:00
hugocasaandClaude Fable 5.1
03a8a0edf2
The maintenance pass sorted repositories with no recorded check first on the premise that they cost nothing, but a token-in-URL remote on a host that is not GitLab is probed every pass and never records a check, so it held the head of the list ahead of the tokens that expire. Such repositories now sort last. The card decided its delivery defaults before the origin lookup landed, so a freshly picked GitLab repository never got webhook delivery; the two lookups are awaited together. The resource editor offers to replace a token only where it is held, not in a fork that borrows it, and the replace flow refuses a URL it cannot parse instead of keying the token to it. Attaching a stored credential to a commit-hash probe now requires admin, matching the installation credential beside it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C1xHmkxuxYb1GYvth1BS75
57 lines
3.3 KiB
SQL
57 lines
3.3 KiB
SQL
-- A parent whose git-sync repository has a recorded credential, and the workspace
|
|
-- shapes the credential lookup and the qualification predicate have to tell apart.
|
|
--
|
|
-- The credential itself is shared down the fork chain; the recorded *status* is
|
|
-- not, because it describes one repository and a fork can repoint its copy of the
|
|
-- resource. Forks get a status by fork creation copying it, which no fixture here
|
|
-- simulates, so a fork without one is a workspace nothing has checked yet.
|
|
|
|
INSERT INTO workspace (id, name, owner, parent_workspace_id) VALUES
|
|
('parent-ws', 'parent-ws', 'test-user', NULL),
|
|
('fork-ws', 'fork-ws', 'test-user', 'parent-ws'),
|
|
-- A fork of a fork: the shape a fork of a dev workspace takes, and the one a
|
|
-- parent-only lookup misses.
|
|
('deep-fork-ws', 'deep-fork-ws', 'test-user', 'fork-ws'),
|
|
('errored-fork-ws', 'errored-fork-ws', 'test-user', 'parent-ws'),
|
|
('orphan-ws', 'orphan-ws', 'test-user', NULL);
|
|
|
|
-- A stored credential is encrypted with its own workspace's key.
|
|
INSERT INTO workspace_key (workspace_id, kind, key) VALUES
|
|
('parent-ws', 'cloud', 'parent-key'),
|
|
('fork-ws', 'cloud', 'fork-key'),
|
|
('deep-fork-ws', 'cloud', 'deep-fork-key'),
|
|
('errored-fork-ws', 'cloud', 'errored-fork-key'),
|
|
('orphan-ws', 'cloud', 'orphan-key');
|
|
|
|
-- The parent holds the credential.
|
|
INSERT INTO workspace_settings (workspace_id, git_sync) VALUES
|
|
('parent-ws', '{"repositories":[{"git_repo_resource_path":"$res:u/admin/repo",
|
|
"credential":{"provider":"gitlab","rotatable":true,"checked_at":1788500000}}]}'),
|
|
|
|
-- A fork inherits the repository but not the credential: this is what
|
|
-- clone_workspace_data leaves behind.
|
|
('fork-ws', '{"repositories":[{"git_repo_resource_path":"$res:u/admin/repo"}]}'),
|
|
|
|
-- Two levels down, so neither the credential nor its status is one hop away.
|
|
('deep-fork-ws', '{"repositories":[{"git_repo_resource_path":"$res:u/admin/repo"}]}'),
|
|
|
|
-- A fork whose own credential has since failed. Its own standing must win over
|
|
-- the parent's healthy record rather than being papered over.
|
|
('errored-fork-ws', '{"repositories":[{"git_repo_resource_path":"$res:u/admin/repo",
|
|
"credential":{"provider":"gitlab","rotatable":false,"checked_at":1788500000,
|
|
"error":"GitLab no longer accepts this token"}}]}'),
|
|
|
|
-- No credential and no parent to borrow one from.
|
|
('orphan-ws', '{"repositories":[{"git_repo_resource_path":"$res:u/admin/repo"}]}');
|
|
|
|
-- The resource each repository entry names, all pointing at the same repository.
|
|
-- The errored fork carries its token in the URL, the way a repository configured
|
|
-- by hand does: nothing stores a credential for it, so only its recorded check
|
|
-- knows which host it talks to.
|
|
INSERT INTO resource (workspace_id, path, value, resource_type) VALUES
|
|
('parent-ws', 'u/admin/repo', '{"url":"https://gitlab.com/grp/proj.git"}', 'git_repository'),
|
|
('fork-ws', 'u/admin/repo', '{"url":"https://gitlab.com/grp/proj.git"}', 'git_repository'),
|
|
('deep-fork-ws', 'u/admin/repo', '{"url":"https://gitlab.com/grp/proj.git"}', 'git_repository'),
|
|
('errored-fork-ws', 'u/admin/repo', '{"url":"https://oauth2:glpat-inline@gitlab.com/grp/proj.git"}', 'git_repository'),
|
|
('orphan-ws', 'u/admin/repo', '{"url":"https://gitlab.com/grp/proj.git"}', 'git_repository');
|