-
Notifications
You must be signed in to change notification settings - Fork 82
Lock live workflows read-only on main#4872
Merged
Merged
Conversation
Adds Workflows.editable_state?/2 and ANDs it into the workflow channel's can_edit_workflow, so a :live workflow on a non-sandbox project is read-only (the editor's existing read-only path then applies). Drafts and the cloned workflow inside a sandbox stay editable. Part of #4857
@github-project-automation
github-project-automation
Bot
moved this to New Issues
in Core
Jun 16, 2026
Security Review ✅
- S0 (project scoping): N/A —
editable_state?/2operates on pre-loadedworkflowandprojectstructs fromsocket.assigns(workflow_channel.ex:239); no new queries or param-derived project lookups. - S1 (authorization): PASS — change tightens edit gating by ANDing
editable_state?into the existingPermissions.can?(:edit_workflow, ...)check (workflow_channel.ex:910–913), so live workflows on a non-sandbox project become read-only without loosening any existing role check. - S2 (audit trail): N/A — change is a permission gate only; no new
Repo.insert/update/deleteon workflows or other config resources.
Codecov Report
✅ All modified and coverable lines are covered by tests.
sandbox-devx@4f5f8b4). Learn more about missing BASE report.
Additional details and impacted files
@@ Coverage Diff @@ ## sandbox-devx #4872 +/- ## ============================================== Coverage ? 90.5% ============================================== Files ? 445 Lines ? 22726 Branches ? 0 ============================================== Hits ? 20566 Misses ? 2160 Partials ? 0
☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.
🚀 New features to boost your workflow:
- ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
- 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
@github-project-automation
github-project-automation
Bot
moved this from New Issues
to Done
in Core
Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Makes a
:liveworkflow read-only on its own (non-sandbox) project. AddsLightning.Workflows.editable_state?/2and ANDs it into the workflow channel'scan_edit_workflowpermission, so the collaborative editor's existing read-only path (disabled Save, trigger toggle, and Monaco) applies automatically. Drafts are always editable, and the cloned workflow inside a sandbox stays editable.Part of #4857. Targets the
sandbox-devxintegration branch, notmain. Independent of the transitions PR (#4869); only needs thestatefield.Validation steps
:liveworkflow on a normal (non-sandbox) project in the collaborative editor and confirm it is read-only.:draftworkflow and confirm it is editable.Additional notes for the reviewer
AI Usage
Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):
You can read more details in our
Responsible AI Policy
Pre-submission checklist
/reviewwith Claude Code)
(extends the existing
:edit_workflowpermission with a lifecycle check)