hugocasa
e57973cbd9
Existing installations don't have polling; their git-to-Windmill direction runs on GitHub Actions today, so the approval text describes the update as replacing those workflows and notes every feature is opt-in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PP5gBSPfo1YtkL1sWVAjJm
2.1 KiB
Windmill GitHub App: why the new permissions
Windmill is moving the git sync work it used to ask you to run as a GitHub Action into the app itself, so two-way sync works out of the box. That needs a few more permissions. They are all scoped to the repositories you install the app on, and they do not grant any new access to your code beyond what the app already has.
| Permission (Read and write) | What it enables |
|---|---|
| Repository webhooks | Create a webhook so pushes deploy to your Windmill workspace instantly, replacing the push-to-Windmill GitHub Action. |
| Pull requests | Open the promotion / fork pull requests for you, replacing the gh pr create GitHub Action. |
| Checks | Post a "Windmill diff" check on a pull request showing what it would change in the workspace. |
Windmill creates a per-repository webhook on each connected repo and sets its
events (push, plus pull_request for checks) itself, so you do not need to
change the app-level "Subscribe to events" list. The events are only available
because the permissions above are granted.
Approving is safe and reversible, and each feature is opt-in from the workspace's git sync settings. Existing sync and any GitHub Actions workflows keep working unchanged while the update is pending; if automatic pull is enabled on a repository before the webhook permission is granted, Windmill checks the tracked branch about every minute until it can register the webhook.
Self-managed apps (GitHub Enterprise Server)
The features work identically through a self-managed app: every API call uses the
app's own endpoint (https://<ghes-host>/api/v3). The difference is that there is
no update to approve, since you own the app: grant the three permissions above in
your app's settings (Settings → Developer settings → GitHub Apps → Permissions &
events) and accept the permission update on the installation. Webhooks are still
created per repository by Windmill, so the app-level "Subscribe to events" list
needs no changes, and your Windmill base URL only needs to be reachable from the
GHES host, not from the public internet.