windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-20 00:02:19 +00:00

Files

T

Ruben Fiszel e356bb1f5d fix(cli): make encryption key push non-interactive-safe + add --skip-reencrypt-on-key-change (#9402 )

When encryption_key.yaml changes and is pushed via `wmill sync push`,
pushWorkspaceKey prompted interactively to confirm re-encrypting the
remote secrets with the new key. That prompt ignored `--yes` and had no
TTY guard, so a CI/non-interactive push that included the key would
block (or behave undefinedly) on the prompt.

Thread a key-push options object (non-interactive flag + explicit
re-encryption choice) through pushObj into pushWorkspaceKey:

- Non-interactive (`--yes` or no TTY) and no explicit choice: skip the
  prompt and default to re-encrypting all remote secrets with the new
  key (matches the interactive default), preserving their plaintext
  values.
- New `--skip-reencrypt-on-key-change` flag (and the
  WMILL_NO_REENCRYPT_ON_KEY_CHANGE=true env var for CI) opt out of
  re-encryption — only safe when the remote ciphertexts are already
  encrypted with the new key (e.g. workspace/instance migration).
- Interactive behavior (TTY, no `--yes`) is unchanged.

Regenerates system_prompts for the new option and adds unit tests for
the no-op, re-encrypt-by-default, flag-skip, and env-skip paths.

Fixes WIN-2005

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-02 07:11:29 +00:00

auth.ts

fix: surface scope errors as 403 and show real message in CLI (#8953 )

2026-05-01 20:55:49 +00:00

branch-profiles.ts

feat: auto-strip UTF-8 BOM when reading local files in CLI (#8911 )

2026-04-22 15:50:47 +00:00

client.ts

refactor(cli): migrate CLI from Deno to Bun/Node.js (#8041 )

2026-02-21 21:19:04 +00:00

conf.ts

fix(cli): make encryption key push non-interactive-safe + add --skip-reencrypt-on-key-change (#9402 )