mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-19 08:01:25 +00:00
hugocasa
ab181519c3
Phase 5 — fork auto-sync configured at the parent (replaces the *-to-forks GitHub Actions): - Add fork_open_prs + fork_pull_sync to GitRepositorySettings (openapi + UI). - UI: two "Forks of this workspace" toggles in the repo card, gated on app-backed and not-a-fork; serialize the flags on save. - On fork creation, strip the inherited auto_pull block (and fork_* flags) from the copied git_sync repo: a fork must not carry the parent's webhook id (it would delete the parent's hook on disable) or self-poll on top of the parent's fan-out. Push-direction config + installation are still inherited unchanged. Phase 6 — live deploy status check on the commit (Cloudflare-style): an in-progress "Windmill" check on the head commit that flips to "Deployed N changes"; completion handled by the generalized git-sync check hook. Bump EE ref for the phase 5-6 EE implementation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm
22 lines
1.2 KiB
Markdown
22 lines
1.2 KiB
Markdown
# Windmill GitHub App: why the new permissions
|
|
|
|
Windmill is moving the git sync work it used to ask you to run as a GitHub Action
|
|
into the app itself, so two-way sync works out of the box. That needs a few more
|
|
permissions. They are all scoped to the repositories you install the app on, and
|
|
they do not grant any new access to your code beyond what the app already has.
|
|
|
|
| Permission (Read and write) | What it enables |
|
|
| --- | --- |
|
|
| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, instead of polling on a timer. |
|
|
| Pull requests | Open the promotion / fork pull requests for you, replacing the `gh pr create` GitHub Action. |
|
|
| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |
|
|
|
|
Windmill creates a per-repository webhook on each connected repo and sets its
|
|
events (`push`, plus `pull_request` for checks) itself, so you do not need to
|
|
change the app-level "Subscribe to events" list. The events are only available
|
|
because the permissions above are granted.
|
|
|
|
Approving is safe and reversible. Existing sync keeps working unchanged while the
|
|
update is pending, and Windmill falls back to polling for any repository where a
|
|
permission has not been granted yet.
|