Skip to content

fix: auth describe should not label DATABRICKS_CONFIG_PROFILE as from bundle#5904

Open
mvanhorn wants to merge 1 commit into
databricks:mainfrom
mvanhorn:fix/auth-describe-config-profile-env
Open

fix: auth describe should not label DATABRICKS_CONFIG_PROFILE as from bundle#5904
mvanhorn wants to merge 1 commit into
databricks:mainfrom
mvanhorn:fix/auth-describe-config-profile-env

Conversation

@mvanhorn

Copy link
Copy Markdown

Changes

databricks auth describe reports the wrong source for the profile
configuration attribute when run inside a bundle root while the profile was
selected via the DATABRICKS_CONFIG_PROFILE environment variable. It renders
(from bundle) instead of (from DATABRICKS_CONFIG_PROFILE environment variable).

Fixes #2303.

Inside a bundle root, Workspace.Config() (bundle/config/workspace.go) labels
every resolved attribute with the bundle source, so a profile that actually
came from the environment is misattributed. getAuthDetails already
post-processes attribute sources to correct the --profile and --host flag
cases; this extends the profile branch to also detect
DATABRICKS_CONFIG_PROFILE, following the same precedence as
cmd/root/bundle.go's getProfile (an explicit --profile flag wins, then the
environment variable). The env branch relabels only when the environment
variable equals the resolved profile value, so a profile set in databricks.yml
still reads (from bundle) and flag precedence is preserved.

Why

When debugging auth inside a bundle, the source label is the whole point of
auth describe: it tells you where a value came from. Attributing an
environment-selected profile to the bundle is misleading and sends users
looking in the wrong place (databricks.yml) for a value that came from their
shell.

Tests

Added an acceptance test under
acceptance/cmd/auth/describe/bundle-profile-env/ that runs auth describe
inside a bundle root with DATABRICKS_CONFIG_PROFILE set and asserts the
profile renders (from DATABRICKS_CONFIG_PROFILE environment variable) while
genuine bundle attributes (host, timeouts) still render (from bundle).
go build ./..., go test ./cmd/auth/..., and the new acceptance test pass.

Closes #2303

…source

Inside a bundle root the resolved config labels every attribute with the
"bundle" source, so a profile selected via DATABRICKS_CONFIG_PROFILE was
rendered as "(from bundle)" instead of "(from DATABRICKS_CONFIG_PROFILE
environment variable)". Extend getAuthDetails to detect the env var, mirroring
the flag > env precedence in cmd/root/bundle.go:getProfile. The value guard
keeps genuine bundle-file profiles reading "(from bundle)".

Closes databricks#2303

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M1ZTEJFKv3BAW36VmBwe2v
@github-actions

Copy link
Copy Markdown
Contributor

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

  • PR number: 5904
  • Commit SHA: 85e3a1d5d0bd95ff07a4186534c630d1e118ddb2

Checks will be approved automatically on success.

@github-actions

Copy link
Copy Markdown
Contributor

Approval status: pending

/cmd/auth/ - needs approval

Files: cmd/auth/describe.go
Suggested: @simonfaltum
Also eligible: @renaudhartert-db, @hectorcast-db, @parthban-db, @tanmay-db, @Divyansh-db, @tejaskochar-db, @mihaimitrea-db, @chrisst, @rauchy

General files (require maintainer)

6 files changed
Based on git history:

  • @simonfaltum -- recent work in cmd/auth/

Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose) can approve all areas.
See OWNERS for ownership rules.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

databricks auth describe misattributes auth credentials source inside a bundle

1 participant