Uh oh!
There was an error while loading. Please reload this page.
direct: Add support for secret scopes - #3886
Merged
Merged
Conversation
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 7, 2025 12:33 — with 
GitHub Actions
Inactive
Collaborator
Commit: 7e1c917
17 interesting tests: 11 flaky, 4 RECOVERED, 2 SKIP
Top 22 slowest tests (at least 2 minutes):
|
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 19:47 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 20:00 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:40 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:41 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:44 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:45 — with GitHub Actions
Inactive
ContributorAuthor
There was a problem hiding this comment.
Newly added tests give more than enough coverage for this. (see basic test)
| Local = true | ||
| Cloud = false | ||
| RecordRequests = true | ||
| Local = false |
ContributorAuthor
There was a problem hiding this comment.
We only run it on cloud because there's ordering issues in the permissions returned by GET that are not worth dealing with (because of the different user names, there is no stable sort).
Contributor
There was a problem hiding this comment.
Ordering issues can be addressed by recording requests in env-specific file:
> out.requests.$DATABRICKS_BUNDLE_ENGINE.json
ContributorAuthor
There was a problem hiding this comment.
We would need to split them into local vs. cloud. The ordering issue here is the permissions being in a different order even after sorting.
It's doable but I'd rather skip it since the cloud coverage is the more important bit to ensure.
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:49 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
November 10, 2025 21:53 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
December 3, 2025 13:51 — with GitHub Actions
Inactive
denik
reviewed
Dec 3, 2025
Uh oh!
There was an error while loading. Please reload this page.
andrewnester
approved these changes
Dec 4, 2025
shreyas-goenkatemporarily deployed
to
test-trigger-is
December 4, 2025 13:21 — with GitHub Actions
Inactive
denik
approved these changes
Dec 4, 2025
| // setACLs reconciles the desired ACLs with the current state | ||
| func (r *ResourceSecretScopeAcls) setACLs(ctx context.Context, scopeName string, desiredAcls []workspace.AclItem) (string, error) { | ||
| // Get current ACLs | ||
| currentAcls, err := r.client.Secrets.ListAclsAll(ctx, workspace.ListAclsRequest{ |
Contributor
There was a problem hiding this comment.
Agree, could be a follow up. a comment TODO would be nice to have here.
shreyas-goenkatemporarily deployed
to
test-trigger-is
December 9, 2025 19:21 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
December 10, 2025 01:21 — with GitHub Actions
Inactive
shreyas-goenkatemporarily deployed
to
test-trigger-is
December 10, 2025 02:36 — with GitHub Actions
Inactive
Uh oh!
There was an error while loading. Please reload this page.
eng-dev-ecosystem-bot
commented
Dec 10, 2025
Collaborator
Commit: a4ab082
16 interesting tests: 8 flaky, 7 RECOVERED, 1 SKIP
Top 50 slowest tests (at least 2 minutes):
|
pietern added a commit
that referenced
this pull request
Jan 12, 2026
…moval The secret scope permissions test fails ~33% of the time when using the Terraform bundle engine. The root cause is a backend API race condition where parallel ACL modifications return inconsistent results. The direct bundle engine already works around this by sequentializing ACL operations (see #3886): // Set ACLs. The service returns inconsistent results for parallel // API calls. That's why we do them sequentially here to maintain // correctness. The Terraform provider has a similar workaround for creates via robustPutACL with retry/verification (terraform-provider-databricks#4885, issue #4195), but deletions have no such protection. This change adds a depends_on chain between ACL resources, forcing Terraform to execute them sequentially: ACL_0 → depends_on: [scope] ACL_1 → depends_on: [scope, ACL_0] ACL_2 → depends_on: [scope, ACL_1] This avoids triggering the backend race condition without requiring changes to the Terraform provider. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
pietern added a commit
that referenced
this pull request
Jan 12, 2026
…removal (#4258) ## Changes This change adds a depends_on chain between ACL resources, forcing Terraform to execute them sequentially: ``` ACL_0 → depends_on: [scope] ACL_1 → depends_on: [scope, ACL_0] ACL_2 → depends_on: [scope, ACL_1] ``` ## Why The secret scope permissions test fails ~33% of the time when using the Terraform deployment engine. The root cause is a backend API race condition where parallel ACL modifications return inconsistent results. The direct bundle engine already works around this by sequentializing ACL operations (see #3886): ``` // Set ACLs. The service returns inconsistent results for parallel // API calls. That's why we do them sequentially here to maintain // correctness. ``` The Terraform provider has a similar workaround for creates via robustPutACL with retry/verification (databricks/terraform-provider-databricks#4885, issue databricks/terraform-provider-databricks#4195), but deletions have no such protection. This avoids triggering the backend race condition without requiring changes to the Terraform provider. ## Tests Manually ran the failing test 10 times and confirmed it no longer fails. Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Summary Field triggers apply to the state type, since they are applied after `PrepareState`. They do not apply on the input config schema. This was not a problem until now because both state and config were the same. That's not the case, however, for secret scopes. Created a separate PR because of the prompt in: #3886 (comment) --------- Co-authored-by: Claude <noreply@anthropic.com>
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Changes Adds direct deployment support for secret scopes. ### Mock Server Fix Fixed `libs/testserver/secret_scopes.go` to automatically grant MANAGE permission to the creator when a scope is created, matching real Databricks behavior. ## Tests New local and cloud acceptance tests.
denik pushed a commit
that referenced
this pull request
May 20, 2026
…removal (#4258) ## Changes This change adds a depends_on chain between ACL resources, forcing Terraform to execute them sequentially: ``` ACL_0 → depends_on: [scope] ACL_1 → depends_on: [scope, ACL_0] ACL_2 → depends_on: [scope, ACL_1] ``` ## Why The secret scope permissions test fails ~33% of the time when using the Terraform deployment engine. The root cause is a backend API race condition where parallel ACL modifications return inconsistent results. The direct bundle engine already works around this by sequentializing ACL operations (see #3886): ``` // Set ACLs. The service returns inconsistent results for parallel // API calls. That's why we do them sequentially here to maintain // correctness. ``` The Terraform provider has a similar workaround for creates via robustPutACL with retry/verification (databricks/terraform-provider-databricks#4885, issue databricks/terraform-provider-databricks#4195), but deletions have no such protection. This avoids triggering the backend race condition without requiring changes to the Terraform provider. ## Tests Manually ran the failing test 10 times and confirmed it no longer fails. Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Adds direct deployment support for secret scopes.
Mock Server Fix
Fixed
libs/testserver/secret_scopes.goto automatically grant MANAGE permission to the creator when a scope is created, matching real Databricks behavior.Tests
New local and cloud acceptance tests.