hugocasa
ab181519c3
Phase 5 — fork auto-sync configured at the parent (replaces the *-to-forks GitHub Actions): - Add fork_open_prs + fork_pull_sync to GitRepositorySettings (openapi + UI). - UI: two "Forks of this workspace" toggles in the repo card, gated on app-backed and not-a-fork; serialize the flags on save. - On fork creation, strip the inherited auto_pull block (and fork_* flags) from the copied git_sync repo: a fork must not carry the parent's webhook id (it would delete the parent's hook on disable) or self-poll on top of the parent's fan-out. Push-direction config + installation are still inherited unchanged. Phase 6 — live deploy status check on the commit (Cloudflare-style): an in-progress "Windmill" check on the head commit that flips to "Deployed N changes"; completion handled by the generalized git-sync check hook. Bump EE ref for the phase 5-6 EE implementation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm
1.2 KiB
Windmill GitHub App: why the new permissions
Windmill is moving the git sync work it used to ask you to run as a GitHub Action into the app itself, so two-way sync works out of the box. That needs a few more permissions. They are all scoped to the repositories you install the app on, and they do not grant any new access to your code beyond what the app already has.
| Permission (Read and write) | What it enables |
|---|---|
| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, instead of polling on a timer. |
| Pull requests | Open the promotion / fork pull requests for you, replacing the gh pr create GitHub Action. |
| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |
Windmill creates a per-repository webhook on each connected repo and sets its
events (push, plus pull_request for checks) itself, so you do not need to
change the app-level "Subscribe to events" list. The events are only available
because the permissions above are granted.
Approving is safe and reversible. Existing sync keeps working unchanged while the update is pending, and Windmill falls back to polling for any repository where a permission has not been granted yet.