windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-18 16:02:10 +00:00

Files

T

Ruben Fiszel 141ed7bae0 never let check-write-access fail the review chain (#10505 )

check-write-access is additive by design: every caller ORs its `authorized`
output with `github.event.comment.author_association`, so a failure should
degrade to the author_association path, not block anything.

It does not. `claude`, `codex` and `pi` all `needs: [parse, check-access, plan]`,
so a failed check-access skips `plan` and with it all three reviewers. Any
disruption to the app credentials — an unset `INTERNAL_APP_ID`, a rotated
`INTERNAL_APP_KEY`, the app uninstalled from the org — turns a redundant
authorization probe into a total /review outage.

Guard the token minting and fall back to the default token, which still resolves
public members and repo collaborators; private members fall through to
author_association exactly as they did before this workflow existed.

Found while porting these workflows to windmill-helm-charts
(windmill-labs/windmill-helm-charts#656), where the app credentials are not
guaranteed to be present.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-04 11:38:51 +00:00

codex

ci: run Codex/Pi review on fork PRs when a maintainer triggers it (#10069 )

2026-07-14 12:16:49 +02:00

ISSUE_TEMPLATE

Improve issue template: Bug Report (#582 )

2022-09-18 09:52:50 +02:00

ci: run Codex/Pi review on fork PRs when a maintainer triggers it (#10069 )

2026-07-14 12:16:49 +02:00

scripts

repair the two CI jobs that fail on a release tag (#10451 )

2026-08-01 23:00:18 +02:00