windmill-cli 1.713.1 → 1.713.2

package/esm/main.js

@@ -25465,16 +25465,23 @@ function deriveGitSyncDeployIncludes(items, useIndividualBranch) {
       extraIncludes.push(...gitSyncIncludePattern(path_type, parent_path).split(","));
     }
   }
-  const has = (pred) => !useIndividualBranch && items.some((i) => pred(i.path_type));
-  return {
-    extraIncludes,
-    includeSchedules: has((t) => t === "schedule"),
-    includeGroups: has((t) => t === "group"),
-    includeUsers: has((t) => t === "user"),
-    includeTriggers: has((t) => t.includes("trigger")),
-    includeSettings: has((t) => t === "settings"),
-    includeKey: has((t) => t === "key")
-  };
+  const forcedIncludes = {};
+  if (!useIndividualBranch) {
+    const has = (pred) => items.some((i) => pred(i.path_type));
+    if (has((t) => t === "schedule"))
+      forcedIncludes.includeSchedules = true;
+    if (has((t) => t === "group"))
+      forcedIncludes.includeGroups = true;
+    if (has((t) => t === "user"))
+      forcedIncludes.includeUsers = true;
+    if (has((t) => t.includes("trigger")))
+      forcedIncludes.includeTriggers = true;
+    if (has((t) => t === "settings"))
+      forcedIncludes.includeSettings = true;
+    if (has((t) => t === "key"))
+      forcedIncludes.includeKey = true;
+  }
+  return { extraIncludes, forcedIncludes };
 }
 function git(args, opts) {
   const r = spawnSync("git", args, { encoding: "utf8", stdio: "pipe" });
@@ -44720,7 +44727,7 @@ var require_zipEntries = __commonJS((exports, module) => {
       if (this.centralDirRecords !== this.files.length) {
         if (this.centralDirRecords !== 0 && this.files.length === 0) {
           throw new Error("Corrupted zip or bug: expected " + this.centralDirRecords + " records in central dir, got " + this.files.length);
-        }
+        } else {}
       }
     },
     readEndOfCentral: function() {
@@ -55650,7 +55657,7 @@ var require_loader = __commonJS((exports, module) => {
     var error2 = generateError(state, message);
     if (state.onWarning) {
       state.onWarning.call(null, error2);
-    }
+    } else {}
   }
   var directiveHandlers = {
     YAML: function handleYamlDirective(state, name, args) {
@@ -56188,7 +56195,7 @@ var require_loader = __commonJS((exports, module) => {
       } else if (detectedIndent) {
         sc.value += common3.repeat(`
 `, emptyLines + 1);
-      }
+      } else {}
       detectedIndent = true;
       emptyLines = 0;
       captureStart = state.position;
@@ -67645,12 +67652,7 @@ async function gitDeploy(opts) {
       ...opts.extraIncludes ?? [],
       ...includes.extraIncludes
     ],
-    includeSchedules: opts.includeSchedules || includes.includeSchedules,
-    includeGroups: opts.includeGroups || includes.includeGroups,
-    includeUsers: opts.includeUsers || includes.includeUsers,
-    includeTriggers: opts.includeTriggers || includes.includeTriggers,
-    includeSettings: opts.includeSettings || includes.includeSettings,
-    includeKey: opts.includeKey || includes.includeKey,
+    ...includes.forcedIncludes,
     promotion
   });
 }
@@ -68185,7 +68187,10 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               if (isWsSpecific) {
                 originalWorkspaceSpecificPath = getWorkspaceSpecificPath(change.path, specificItems, wsNameForFiles);
               }
-              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext, isWsSpecific ? true : undefined);
+              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext, isWsSpecific ? true : undefined, {
+                noninteractive: (opts.yes ?? false) || !process.stdin.isTTY,
+                skipReencrypt: opts.skipReencryptOnKeyChange
+              });
               if (stateTarget) {
                 await writeFile7(stateTarget, change.after, "utf-8");
               }
@@ -68215,7 +68220,10 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   localFilePath = workspaceSpecificPath;
                 }
               }
-              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext, isAddedWsSpecific ? true : undefined);
+              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext, isAddedWsSpecific ? true : undefined, {
+                noninteractive: (opts.yes ?? false) || !process.stdin.isTTY,
+                skipReencrypt: opts.skipReencryptOnKeyChange
+              });
               if (stateTarget) {
                 await writeFile7(stateTarget, change.content, "utf-8");
               }
@@ -68633,7 +68641,7 @@ var init_sync = __esm(async () => {
     aliasDuplicateObjects: false,
     singleQuote: true
   };
-  command8 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").option("--accept-overriding-permissioned-as-with-self", "Accept that items with a different permissioned_as will be updated with your own user").action(push4).command("git-deploy").hidden().description("Internal git-sync deployment-callback step (used by the git-sync hub script). Runs inside an existing clone: switches to the wm_deploy/fork branch when applicable, pulls workspace content, then commits and pushes.").option("--repository <repo:string>", "Repository resource path (e.g. u/user/repo)").option("--git-deploy-items <json:string>", "JSON array of {path_type,path,parent_path,commit_msg} being deployed").option("--use-individual-branch", "Push each deployed object to its own wm_deploy/<workspace>/<...> branch").option("--group-by-folder", "With --use-individual-branch, group deployed objects per folder branch").option("--only-create-branch", "Only create/push the deploy branch, skip pulling and committing files").option("--parent-workspace-id <id:string>", "Parent workspace id, used to root a fork-of-a-fork branch").option("--skip-secrets", "Skip syncing only secrets variables").option("--git-committer-email <email:string>", "Committer email for the deploy commit (GPG-signed repos pass the GPG key email; defaults to WM_EMAIL)").option("--git-committer-name <name:string>", "Committer name for the deploy commit (defaults to WM_USERNAME)").action(gitDeploy);
+  command8 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-reencrypt-on-key-change", "When the pushed encryption key differs from the remote, do NOT re-encrypt existing remote secrets. Only safe if they are already encrypted with the new key (e.g. workspace/instance migration). Default is to re-encrypt.").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").option("--accept-overriding-permissioned-as-with-self", "Accept that items with a different permissioned_as will be updated with your own user").action(push4).command("git-deploy").hidden().description("Internal git-sync deployment-callback step (used by the git-sync hub script). Runs inside an existing clone: switches to the wm_deploy/fork branch when applicable, pulls workspace content, then commits and pushes.").option("--repository <repo:string>", "Repository resource path (e.g. u/user/repo)").option("--git-deploy-items <json:string>", "JSON array of {path_type,path,parent_path,commit_msg} being deployed").option("--use-individual-branch", "Push each deployed object to its own wm_deploy/<workspace>/<...> branch").option("--group-by-folder", "With --use-individual-branch, group deployed objects per folder branch").option("--only-create-branch", "Only create/push the deploy branch, skip pulling and committing files").option("--parent-workspace-id <id:string>", "Parent workspace id, used to root a fork-of-a-fork branch").option("--skip-secrets", "Skip syncing only secrets variables").option("--git-committer-email <email:string>", "Committer email for the deploy commit (GPG-signed repos pass the GPG key email; defaults to WM_EMAIL)").option("--git-committer-name <name:string>", "Committer name for the deploy commit (defaults to WM_USERNAME)").action(gitDeploy);
   sync_default = command8;
 });
 
@@ -74081,7 +74089,7 @@ async function pushWorkspaceSettings(workspace, _path, settings, localSettings)
     }
   }
 }
-async function pushWorkspaceKey(workspace, _path, key, localKey) {
+async function pushWorkspaceKey(workspace, _path, key, localKey, opts) {
   try {
     key = await getWorkspaceEncryptionKey({
       workspace
@@ -74090,19 +74098,29 @@ async function pushWorkspaceKey(workspace, _path, key, localKey) {
     throw new Error(`Failed to get workspace encryption key: ${err}`);
   }
   if (localKey && key !== localKey) {
-    const confirm = await Confirm.prompt({
-      message: `The local workspace encryption key does not match the remote. Do you want to reencrypt all your secrets on the remote with the new key?
+    let reencrypt;
+    const explicitSkip = opts?.skipReencrypt || (process18.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() === "true";
+    if (explicitSkip) {
+      reencrypt = false;
+      info("Workspace encryption key changed; leaving remote ciphertexts untouched (skip re-encryption requested).");
+    } else if (opts?.noninteractive) {
+      reencrypt = true;
+      info("Workspace encryption key changed; re-encrypting all remote secrets with the new key (non-interactive).");
+    } else {
+      reencrypt = await Confirm.prompt({
+        message: `The local workspace encryption key does not match the remote. Do you want to reencrypt all your secrets on the remote with the new key?
 Say 'no' if your local secrets are already encrypted with the new key (e.g. workspace/instance migration)
 Otherwise, say 'yes' and pull the secrets after the reencryption.
 `,
-      default: true
-    });
+        default: true
+      });
+    }
     debug(`Updating workspace encryption key...`);
     await setWorkspaceEncryptionKey({
       workspace,
       requestBody: {
         new_key: localKey,
-        skip_reencrypt: !confirm
+        skip_reencrypt: !reencrypt
       }
     });
   } else {
@@ -75851,7 +75869,7 @@ function redactString(s) {
     return s;
   return s.slice(0, 5) + "*".repeat(s.length - 5);
 }
-async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext, wsSpecific) {
+async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext, wsSpecific, keyPushOpts) {
   const typeEnding = getTypeStrFromPath(p);
   if (typeEnding === "app") {
     const appName = extractResourceName(p, "app");
@@ -75915,7 +75933,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "settings") {
     await pushWorkspaceSettings(workspace, p, befObj, newObj);
   } else if (typeEnding === "encryption_key") {
-    await pushWorkspaceKey(workspace, p, befObj, newObj);
+    await pushWorkspaceKey(workspace, p, befObj, newObj, keyPushOpts);
   } else {
     throw new Error(`The item ${p} has an unrecognized type ending ${typeEnding}`);
   }
@@ -84620,6 +84638,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--include-groups\` - Include syncing groups
   - \`--include-settings\` - Include syncing workspace settings
   - \`--include-key\` - Include workspace encryption key
+  - \`--skip-reencrypt-on-key-change\` - When the pushed encryption key differs from the remote, do NOT re-encrypt existing remote secrets. Only safe if they are already encrypted with the new key (e.g. workspace/instance migration). Default is to re-encrypt.
   - \`--skip-branch-validation\` - Skip git branch validation and prompts
   - \`--json-output\` - Output results in JSON format
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.713.1",
+  "version": "1.713.2",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",