From 68530e8a7e35c27b7cac23fc44a27ee6d3bbf451 Mon Sep 17 00:00:00 2001
From: andres-portainer <91705312+andres-portainer@users.noreply.github.com>
Date: Wed, 24 Jun 2026 17:07:51 -0300
Subject: [PATCH] fix(workflows): fix workflow access BE-13150 (#3032)

---
 api/gitops/workflows/fetch.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/api/gitops/workflows/fetch.go b/api/gitops/workflows/fetch.go
index af5345a431..8f74e9938d 100644
--- a/api/gitops/workflows/fetch.go
+++ b/api/gitops/workflows/fetch.go
@@ -63,6 +63,7 @@ func FetchWorkflows(
 	for _, stack := range preFiltered {
 		wf := workflowMap[stack.WorkflowID]
 
+		hasAccessibleSource := false
 	outer:
 		for _, as := range wf.Artifacts {
 			if as.StackID != stack.ID {
@@ -70,7 +71,13 @@ func FetchWorkflows(
 			}
 
 			for _, f := range as.Files {
-				src := sourceMap[f.SourceID]
+				src, ok := sourceMap[f.SourceID]
+				if !ok {
+					continue
+				}
+
+				hasAccessibleSource = true
+
 				if src.Type == portainer.SourceTypeGit {
 					gitConfigs[stack.ID] = MergeSourceAndFile(&src, &f)
 					break outer
@@ -78,6 +85,10 @@ func FetchWorkflows(
 			}
 		}
 
+		if stack.Type == portainer.KubernetesStack && !hasAccessibleSource {
+			continue
+		}
+
 		filtered = append(filtered, stack)
 	}
 	stacks = filtered