Ruben Fiszel 740df390e7 Merge origin/main into ruben/operator-builder-rights ...

Conflicts:
- `backend/ee-repo-ref.txt`: pinned to the EE branch merged onto the ref main now
  carries (90aa05c).
- `backend/windmill-api/src/apps.rs`: took main's `derived_triggerables` parameter
  and kept both test modules.

Main turned `Policy.execution_mode` into an accessor over an optional stated mode,
and made `update_app_internal` resolve an unstated one to the *deployed* app's.
That reopens the hole the Viewer refusal closes: a builder redeploying over an
admin's viewer-mode app would send a policy stating no mode, pass the check on the
`publisher` default, and then inherit `Viewer` on write. The check now reads the
stated mode and pins an omitted one to `publisher`.

`derived_triggerables` itself is not reachable by a builder: only
`update_app_raw_source` passes it, and that endpoint stays closed to operators.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-18 07:53:41 +00:00

..

src

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

tests

Merge origin/main into ruben/operator-builder-rights

2026-08-18 07:53:41 +00:00

Cargo.toml

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00