feat: sync workflows from a configured github repo (#1721)

* feat: sync workflows from a configured github repo

Per-workspace setting pointing at a GitHub repo directory of portable
workflow export files. A background poller fetches it on an interval and
creates, updates, or deletes the matching workflows; a force-sync endpoint
bypasses the content-hash check. Synced workflows carry source/source_path
provenance and coexist with manual ones; changes that cannot be applied
safely (steps or workflows that still hold tasks, ambiguous step names,
unparseable files) surface as warnings in the new settings section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): fill workflow sync form from a pasted github link

A new Repository link field parses plain repo URLs, SSH remotes, and
tree/blob links (which also carry branch and directory) into the
structured owner/repo/branch/path fields.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): simplify workflow sync form to link, branch, and interval

The repository link is now the only repo input: owner, repo, and
directory resolve from the pasted URL (echoed as a summary under the
field), and a stored config renders back into a canonical tree link via
buildGitHubRepoUrl. Branch and poll interval stay individually editable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): collapse workflow sync into a button, dialog, and status card

The Workflows settings page now shows only a GitHub Sync button by
default; the link/branch/interval form lives in a dialog that closes on
successful save or removal. Once configured, a compact status card
(mirroring the GitHub connection-status card) shows the synced repo,
branch, directory, last result, warnings, and a Sync now action.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): move github sync button into the workflows page header

The GitHub Sync trigger now stacks under the Workspace settings button
on the top right, and the extra separator around the sync area is gone —
unconfigured workspaces show no sync chrome at all, configured ones show
just the status card above the workflow list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): move github sync button next to the workflow actions

GitHub Sync now sits in the Workflows section toolbar alongside
Export All, Import, and Add Workflow; the status card renders inside the
section above the workflow list. The toolbar moved to its own component
to keep the page under the file-size limit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): separate sync status card from the workflow list

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(web): align sync status card with the workflow list gutter

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: repair local edits to synced workflows on periodic sync

Periodic syncs previously skipped applying when the repo content hash
was unchanged, so local UI edits to a synced workflow were only reverted
by a manual Sync now. Every sync now reconciles against the repo; the
applier compares each step against its definition and only writes (and
broadcasts) actual differences, so a no-drift sync stays silent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: make github-synced workflows read-only

Workflows with source=github reject UI mutations: workflow rename,
description, agent-profile, and delete return 409 from the task-domain
handlers; step create/update/delete/reorder and template application are
guarded in the workflow controller. The sync applier writes through the
service/repo layer and stays exempt. The frontend disables the card's
inputs, save/delete, and the step pipeline editor for synced workflows,
with a tooltip pointing at the synced repository. Drift repair on sync
remains as the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: optional workflow sync polling and repo-derived branch picker

A per-workspace auto-sync toggle (poll_enabled, default on) controls
the background polling loop; when off the workspace only syncs via Sync
now. The dialog's branch field becomes a select fed by the repository's
actual branches (same loader the task-create dialog uses), falling back
to free text until branches load. Existing dev databases gain the new
column via an idempotent ALTER.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: release synced workflows when the sync config is removed

Deleting a workspace's workflow sync configuration converts its
GitHub-sourced workflows back to manual ownership (source=manual), so
they become editable instead of being stranded read-only. Release runs
before the config row is deleted so a failure keeps the config for
retry. The settings page reloads after removal (and after syncs that
changed workflows) so cards unlock without a manual refresh.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): drop branch selector and compact the auto-sync row

The pasted link already carries the branch (main by default), so the
dialog no longer needs a branch field — the resolved summary echoes it.
The auto-sync toggle is now one compact row with the interval inline and
a single short helper line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: address PR review feedback

Backend: fail-open read-only guard on workflow lookup errors (fixes MCP
step handler CI failures); poller Stop holds its mutex through drain;
per-workspace lock serializes syncs against config delete/replace;
rollback workflow creation when provenance stamping fails; idiomatic
duplicate-column migration via db.IsDuplicateColumnError; branch-name
validation and a 30-day interval cap; generic 500s with logged detail;
WS read-only rejections use CONFLICT with the real reason; e2e reset
aborts when sync-config cleanup fails; test hygiene (t.Cleanup,
SetMaxOpenConns).

Frontend: malformed percent escapes parse as invalid instead of
throwing; save disabled during initial load and for invalid intervals;
Remove disabled while saving; stale async config responses discarded;
delete-dialog confirms re-check read-only; focusable Synced badge;
explicit button types; failed polls labeled 'last attempt'; unique
warning list keys; test cleanup via afterEach.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: guard workflow sync test fake against concurrent poller access

The poller invokes the fake applier from its own goroutine while the
synctest test asserts on call counts; -race caught the unguarded reads.
Also documents that the per-workspace lock is deliberately held across
the GitHub fetch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs/public/workflow-sync.md

@@ -0,0 +1,115 @@
+# Workflow Sync — Manage Workflows from a GitHub Repo
+
+Kandev can keep a workspace's workflows in sync with definition files stored
+in a GitHub repository. Point a workspace at a repo directory, commit workflow
+export files there, and Kandev polls the repo and creates, updates, or removes
+the matching workflows automatically. Synced workflows coexist with workflows
+you create by hand — manual workflows are never touched by a sync.
+
+This is useful for:
+
+- **Sharing workflows across a team:** everyone's Kandev pulls the same
+  definitions from one reviewed repo.
+- **Versioning workflows:** changes go through pull requests and history
+  instead of ad-hoc UI edits.
+- **Provisioning new workspaces:** configure the repo once and the standard
+  workflows appear on the next sync.
+
+---
+
+## Setup
+
+1. Open **Settings → Workspaces → \<workspace\> → Workflows** and click the
+   **GitHub Sync** button at the top.
+2. In the dialog, paste a GitHub link into **Repository link** — a plain repo
+   URL, an SSH remote, or a `…/tree/<branch>/<directory>` link that also
+   carries the branch and directory. The resolved target (owner/repo and
+   directory) is shown under the field; the directory defaults to
+   `.kandev/workflows` when the link doesn't include one.
+3. The branch comes from the pasted link (`main` when the link doesn't carry
+   one). Toggle **Auto-sync**: when on, Kandev polls the repo on the given
+   interval (default 300 seconds, minimum 60); when off, nothing syncs until
+   you press **Sync now**.
+4. Save. A status card appears on the page showing what is syncing, the last
+   sync result, and any warnings; use its **Sync now** button to run a sync
+   immediately instead of waiting for the poller. Reopen the dialog via
+   **GitHub Sync** to change or remove the configuration.
+
+Authentication reuses Kandev's existing GitHub access (the `gh` CLI login, a
+`GITHUB_TOKEN`/`GH_TOKEN` environment variable, or a PAT stored in the secret
+manager). Private repos work as long as that identity can read them.
+
+## File format
+
+The directory should contain `.yml`, `.yaml`, or `.json` files in the portable
+`kandev_workflow` export format — exactly what **Export** produces on the
+Workflows settings page. See
+[workflow-import-export.md](workflow-import-export.md) for the full field
+reference. Files with other extensions are ignored; subdirectories are not
+scanned.
+
+A minimal file:
+
+```yaml
+version: 1
+type: kandev_workflow
+workflows:
+  - name: Dev Flow
+    steps:
+      - name: Todo
+        position: 0
+        is_start_step: true
+      - name: In Progress
+        position: 1
+      - name: Done
+        position: 2
+```
+
+The easiest authoring path: build the workflow in the Kandev UI, export it,
+and commit the exported YAML to the repo.
+
+## Sync semantics
+
+- **Matching:** a synced workflow is identified by its source file path plus
+  its `name` inside that file. Renaming a workflow in the repo counts as
+  removing one workflow and adding another.
+- **Create:** definitions with no matching workflow are created and marked as
+  synced (they show a **Synced** badge in the workflow list).
+- **Update:** matched workflows are updated in place. Steps are matched **by
+  name**, so tasks sitting in a step keep their position when the step's
+  color, prompt, events, or order change.
+- **Read-only:** the repo is the source of truth. Synced workflows cannot be
+  renamed, edited, or deleted from the UI (the API rejects such changes) —
+  edit their definitions in the repo instead. Any drift that slips in anyway
+  is repaired on the next sync. Reordering workflows on the board and
+  exporting them remain available.
+- **Delete:** a previously-synced workflow whose definition disappeared from
+  the repo is deleted — but only if it holds no tasks.
+- **Manual workflows** (created in the UI) are never modified or deleted by a
+  sync, even if they share a name with a synced definition.
+
+### When a workflow can't be updated
+
+Some changes can't be applied safely, and Kandev records a **warning** instead
+of forcing them. The warning appears in the status banner of the Sync from
+GitHub section until you resolve it and sync again. Cases:
+
+- A step was removed from the definition but still has tasks in it.
+- A removed workflow still has tasks.
+- Step names inside a definition (or the existing workflow) are not unique,
+  so steps can't be matched reliably.
+- A file is not valid workflow-export YAML/JSON. The file is skipped and its
+  previously-synced workflows are left untouched.
+
+A failed sync (repo unreachable, directory missing, GitHub not authenticated)
+is also surfaced in the same banner with the error message.
+
+## Notes
+
+- Sync configuration is **per workspace**; different workspaces can track
+  different repos, branches, or directories.
+- Every sync — periodic or manual — reconciles the workspace against the repo,
+  but only writes what actually differs, so a no-drift sync changes (and
+  broadcasts) nothing.
+- Removing the sync configuration releases the previously-synced workflows:
+  they stay in place but become regular, editable workflows again.