Fix wmill sync authentication by using CLI flags

Replace environment variable authentication (WM_TOKEN, WM_WORKSPACE,
WM_BASE_URL) with explicit command-line flags (--token, --workspace,
--base-url) as required by wmill CLI.

According to wmill documentation, when using --base-url, the --token
and --workspace flags are required and no local workspace configuration
will be used. This is the correct approach for a stateless containerized
service where credentials are passed per-request.

This fixes the exit code 255 error that occurred when wmill tried to
run sync without proper workspace configuration.

Dockerfile

@@ -2,15 +2,16 @@ FROM python:3.11-slim
 
 WORKDIR /app
 
-# Install system dependencies
+# Install system dependencies including Node.js
 RUN apt-get update && apt-get install -y \
     git \
     curl \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# Install wmill CLI
-RUN curl -L https://github.com/windmill-labs/windmill/releases/latest/download/wmill-linux-amd64 -o /usr/local/bin/wmill \
-    && chmod +x /usr/local/bin/wmill
+# Install wmill CLI via npm
+RUN npm install -g windmill-cli
 
 # Copy requirements and install Python dependencies
 COPY requirements.txt .

app/sync.py

@@ -59,17 +59,18 @@ def run_wmill_sync(config: Dict[str, Any]) -> bool:
 
     logger.info(f"Syncing Windmill workspace '{workspace}' from {WINDMILL_BASE_URL}")
 
-    env = os.environ.copy()
-    env['WM_BASE_URL'] = WINDMILL_BASE_URL
-    env['WM_TOKEN'] = windmill_token
-    env['WM_WORKSPACE'] = workspace
-
     try:
-        # Run wmill sync in the workspace directory
+        # Run wmill sync in the workspace directory with explicit flags
+        # Note: When using --base-url, --token and --workspace are required
         result = subprocess.run(
-            ['wmill', 'sync', 'pull', '--yes'],
+            [
+                'wmill', 'sync', 'pull',
+                '--base-url', WINDMILL_BASE_URL,
+                '--token', windmill_token,
+                '--workspace', workspace,
+                '--yes'
+            ],
             cwd=WORKSPACE_DIR,
-            env=env,
             capture_output=True,
             text=True,
             check=True