{"record":{"id":"2f1019c1d6a0fe04","repo":"windmill-labs/windmill","slug":"warning-message","errorCode":null,"errorMessage":"Warning: ${message}","messagePattern":"Warning: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/src/core/permissioned_as.ts","lineNumber":192,"sourceCode":"  }\n\n  if (wouldChangeItems.length === 0) return;\n\n  const itemList = wouldChangeItems\n    .map((item) => `  - ${item.path} (current owner: ${item.currentOwner})`)\n    .join(\"\\n\");\n\n  const message =\n    `You are not an admin or member of 'wm_deployers'. The following ${wouldChangeItems.length} item(s) ` +\n    `will have their permissioned_as/email changed to your user (${userEmail}):\\n${itemList}`;\n\n  if (acceptOverride) {\n    log.warn(colors.yellow(`Warning: ${message}`));\n    return;\n  }\n\n  if (isInteractive) {\n    log.warn(colors.yellow(message));\n    const proceed = await Confirm.prompt({\n      message:\n        \"Do you want to proceed? (use --accept-overriding-permissioned-as-with-self to skip this prompt)\",\n      default: false,\n    });\n    if (!proceed) {\n      log.info(\"Push cancelled.\");\n      process.exit(0);\n    }\n  } else {\n    log.error(\n      colors.red(\n        `${message}\\n\\nUse --accept-overriding-permissioned-as-with-self to proceed anyway.`\n      )\n    );\n    process.exit(1);\n  }\n}","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/core/permissioned_as.ts#L174-L210","documentation":"The Windmill CLI's `preCheckPermissionedAs` guard (called from `push`) detects items in the push whose `permissioned_as`/email owner would change to the current user, when the user is not an admin or member of `wm_deployers`. When the `--accept-overriding-permissioned-as-with-self` flag is set, the CLI logs the full list of affected items as a yellow `Warning: <message>` and continues the push. Without the flag it either prompts interactively or hard-fails with exit code 1.","triggerScenarios":"`wmill push` executed by a non-admin, non-`wm_deployers` user where one or more synced scripts/flows/schedules/apps would have their owner email rewritten to the pushing user, AND the `--accept-overriding-permissioned-as-with-self` flag is passed. The message enumerates each path and its current owner.","commonSituations":"A team member pulls a colleague's script (owned by the colleague or a departed employee) and pushes modifications; ownership silently transfers to them, breaking other users' access. The flag is often added in CI to keep pipelines moving.","solutions":["If ownership transfer is intended, keep the flag and review the listed paths to confirm each is expected.","If not intended, remove the flag and edit the local files to set `permissioned_as` (or the schedule/app owner email) back to the original owner before pushing.","Push only the specific paths you own (e.g. targeted push of those files) instead of a full sync.","Ask an admin to add you to the `wm_deployers` group if you legitimately need to manage these items."],"exampleFix":"# before (blanks owner in YAML → becomes you on push)\n# no permissioned_as line in script.meta.yaml\n\n# after\npermissioned_as: /orig-owner@example.com","handlingStrategy":"validation","validationCode":"// inspect what a push would re-own before running it\nconst userEmail = \"me@example.com\";\nfor (const f of scriptMetaFiles) {\n  const owner = f.match(/^permissioned_as:\\s*\"?([^\\s\"#]+)\"?/m)?.[1];\n  if (!owner || owner === userEmail) console.warn(`${f} would be permissioned_as you after push`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never add `--accept-overriding-permissioned-as-with-self` in shared CI without reviewing the listed items.","Always keep an explicit `permissioned_as` (or owner email for schedules) in synced files instead of omitting it.","Run a dry review of changed files before pushing to shared workspaces.","Use a dedicated service account in `wm_deployers` for team-wide pushes so ownership is stable."],"tags":["cli","permissions","ownership","windmill"],"backgroundTag":"permissioned-as-ownership-transfer","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}