From aebf758412383dd65e0bf6c72de8f2668561cd88 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 14 Apr 2026 16:38:37 -0400 Subject: [PATCH] fix: allow dedicated flow substeps to inherit parent tag (#8832) Flow substeps that inherit the parent flow's tag were re-validated against CUSTOM_TAGS, which rejected dedicated flow tags (`{workspace_id}:flow/{path}`) since they are never user-registered. The parent flow's tag was already validated at push time, so skip the redundant check when the substep simply inherits it. Co-authored-by: Claude Opus 4.6 (1M context) --- backend/windmill-worker/src/worker_flow.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs index 8505cd71d4..c7ca889b53 100644 --- a/backend/windmill-worker/src/worker_flow.rs +++ b/backend/windmill-worker/src/worker_flow.rs @@ -3703,8 +3703,14 @@ async fn push_next_flow_job( ) }; - // Check tag availability for flow substeps to prevent abuse - if let Some(tag_str) = tag.as_deref().filter(|t| !t.is_empty()) { + // Check tag availability for flow substeps to prevent abuse. + // Skip when the substep inherits the parent flow's tag: that tag was already + // validated at flow push time, and for dedicated flows it is the auto-generated + // `{workspace_id}:flow/{path}` tag which is never in CUSTOM_TAGS. + if let Some(tag_str) = tag + .as_deref() + .filter(|t| !t.is_empty() && *t != flow_job.tag.as_str()) + { check_tag_available_for_workspace_internal( &db, &flow_job.workspace_id,