Ruben Fiszel 0cd0eb3070 fix(git-sync): drop wrapper approach, prepare option-B thin script (in-script commit + latest CLI) ...

The hub/28234 wrapper approach (gpg.program=/tmp/gpg/gpg-wrapper.sh with
--passphrase-file) shipped to a customer and still failed with the same
`gpg failed to sign the data`. Root cause is the architecture: pushing
`git commit` into the CLI's spawned process introduces a multi-hop env
propagation chain (Deno → Node spawnSync → git → wrapper → gpg) plus a
dependency on gpg-agent's `allow-loopback-pinentry` being enabled. None
of those failure modes exist in hub/28217's "commit in the same script
process as GPG setup" pattern, which shipped for months without issue.

This commit:
  - Reverts LATEST_GIT_SYNC_SCRIPT_PATH back to hub/28230 (= 28217's
    in-script commit logic, current known-good).
  - Stages hub-scripts/sync-script-to-git-repo-windmill.ts: byte-identical
    to hub/28230 except for `windmill-cli@1.703.3` → `@1.705.0`. Once
    published this is the next default; the CLI's `sync git-deploy`
    subcommand stays available for tests and other callers but the
    deployment callback stops using it.

Follow-up: publish hub-scripts/sync-script-to-git-repo-windmill.ts to
hub.windmill.dev, then bump LATEST_GIT_SYNC_SCRIPT_PATH to its new id.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-22 07:29:04 +00:00

..

sync-script-to-git-repo-windmill.ts

fix(git-sync): drop wrapper approach, prepare option-B thin script (in-script commit + latest CLI)

2026-05-22 07:29:04 +00:00