mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-19 08:01:25 +00:00
hugocasa
e57973cbd9
Existing installations don't have polling; their git-to-Windmill direction runs on GitHub Actions today, so the approval text describes the update as replacing those workflows and notes every feature is opt-in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm
35 lines
2.1 KiB
Markdown
35 lines
2.1 KiB
Markdown
# Windmill GitHub App: why the new permissions
|
|
|
|
Windmill is moving the git sync work it used to ask you to run as a GitHub Action
|
|
into the app itself, so two-way sync works out of the box. That needs a few more
|
|
permissions. They are all scoped to the repositories you install the app on, and
|
|
they do not grant any new access to your code beyond what the app already has.
|
|
|
|
| Permission (Read and write) | What it enables |
|
|
| --- | --- |
|
|
| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, replacing the push-to-Windmill GitHub Action. |
|
|
| Pull requests | Open the promotion / fork pull requests for you, replacing the `gh pr create` GitHub Action. |
|
|
| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |
|
|
|
|
Windmill creates a per-repository webhook on each connected repo and sets its
|
|
events (`push`, plus `pull_request` for checks) itself, so you do not need to
|
|
change the app-level "Subscribe to events" list. The events are only available
|
|
because the permissions above are granted.
|
|
|
|
Approving is safe and reversible, and each feature is opt-in from the workspace's
|
|
git sync settings. Existing sync and any GitHub Actions workflows keep working
|
|
unchanged while the update is pending; if automatic pull is enabled on a
|
|
repository before the webhook permission is granted, Windmill checks the tracked
|
|
branch about every minute until it can register the webhook.
|
|
|
|
## Self-managed apps (GitHub Enterprise Server)
|
|
|
|
The features work identically through a self-managed app: every API call uses the
|
|
app's own endpoint (`https://<ghes-host>/api/v3`). The difference is that there is
|
|
no update to approve, since you own the app: grant the three permissions above in
|
|
your app's settings (Settings → Developer settings → GitHub Apps → Permissions &
|
|
events) and accept the permission update on the installation. Webhooks are still
|
|
created per repository by Windmill, so the app-level "Subscribe to events" list
|
|
needs no changes, and your Windmill base URL only needs to be reachable from the
|
|
GHES host, not from the public internet.
|