Skip to content

Commit 4714f92

Browse files
Merge branch 'main' into demo-lakebox
2 parents 23861c7 + c037584 commit 4714f92

1,107 files changed

Lines changed: 28498 additions & 3973 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
---
2+
name: bump-cli-compat
3+
description: "Bump cli-compat.json with new AppKit and Agent Skills versions, then create a PR. Use when the user says 'bump cli-compat', 'update cli-compat', 'bump compatibility manifest', 'new appkit release cli-compat', or wants to update the CLI compatibility manifest after an AppKit or Agent Skills release."
4+
user-invocable: true
5+
allowed-tools: Read, Edit, Write, Bash, Glob, Grep, AskUserQuestion
6+
---
7+
8+
# Bump CLI Compatibility Manifest
9+
10+
Updates `internal/build/cli-compat.json` with new AppKit and Agent Skills versions, validates the result, and creates a PR.
11+
12+
## Arguments
13+
14+
Parse the user's input for optional named flags:
15+
16+
- `--appkit <version>` → AppKit version (e.g. `0.28.0`)
17+
- `--skills <version>` → Agent Skills version (e.g. `0.1.6`)
18+
- No args → auto-detect latest versions from GitHub tags
19+
20+
Versions should be provided **without** the `v` prefix (e.g. `0.28.0`, not `v0.28.0`). If provided with the prefix, strip it.
21+
22+
## Workflow
23+
24+
### Step 1: Resolve versions
25+
26+
If both `--appkit` and `--skills` versions were provided, skip to Step 2.
27+
28+
For any missing version, fetch the latest tag from GitHub:
29+
30+
```bash
31+
# Latest appkit version (strip leading 'v')
32+
gh api repos/databricks/appkit/tags --jq '.[0].name' | sed 's/^v//'
33+
34+
# Latest skills version (strip leading 'v')
35+
gh api repos/databricks/databricks-agent-skills/tags --jq '.[0].name' | sed 's/^v//'
36+
```
37+
38+
Show the resolved versions to the user and ask:
39+
40+
> The latest versions are:
41+
> - AppKit: `{appkit_version}`
42+
> - Agent Skills: `{skills_version}`
43+
>
44+
> Have these versions been evaluated (evals passed with no regressions)?
45+
46+
**Do NOT proceed until the user confirms.** If the user says no or wants different versions, ask them to provide the correct versions.
47+
48+
### Step 2: Validate tags exist
49+
50+
Verify that the corresponding Git tags exist on GitHub. For AppKit, also validate the `template-v` tag (used by `apps init`):
51+
52+
```bash
53+
# AppKit release tag
54+
gh api repos/databricks/appkit/git/ref/tags/v{appkit_version} --jq '.ref'
55+
56+
# AppKit template tag (used by apps init)
57+
gh api repos/databricks/appkit/git/ref/tags/template-v{appkit_version} --jq '.ref'
58+
59+
# Agent Skills tag
60+
gh api repos/databricks/databricks-agent-skills/git/ref/tags/v{skills_version} --jq '.ref'
61+
```
62+
63+
If any tag doesn't exist, report the error and stop.
64+
65+
### Step 3: Read current manifest
66+
67+
Read `internal/build/cli-compat.json`. Note the current versions and the list of versioned entries.
68+
69+
### Step 4: Determine update type
70+
71+
Ask the user:
72+
73+
> Do any of these apply?
74+
> - **AppKit**: The new templates require new CLI logic in `apps init` (e.g. new flags, prompts, or template handling that older CLIs don't have)
75+
> - **Skills**: The new skills version uses CLI commands that older CLIs don't support
76+
>
77+
> If **neither** applies, this is a non-breaking bump (default).
78+
79+
- **No breaking changes** (default): proceed to Step 4a.
80+
- **Breaking changes**: proceed to Step 4b.
81+
82+
### Step 4a: No breaking changes (update in-place)
83+
84+
Update the **highest versioned entry** to the new appkit and skills versions. Do NOT add new versioned keys. The manifest is range-based: updating the highest entry automatically covers all CLI versions in that range.
85+
86+
Write the updated `internal/build/cli-compat.json`.
87+
88+
### Step 4b: Breaking changes (add new entry)
89+
90+
Ask the user for the **minimum CLI version** that supports the new features.
91+
92+
Add a new entry keyed to that CLI version with the new appkit and skills versions. Keep older entries unchanged so older CLI binaries stay compatible.
93+
94+
Write the updated `internal/build/cli-compat.json`.
95+
96+
### Step 5: Validate
97+
98+
Run the Go tests to ensure the manifest is well-formed:
99+
100+
```bash
101+
go test ./libs/clicompat/... -run TestEmbeddedManifest -v
102+
```
103+
104+
If validation fails, show the errors and fix them before proceeding.
105+
106+
### Step 6: Create branch, commit, and PR
107+
108+
```bash
109+
# Create a new branch from the current branch (or main)
110+
git checkout -b bump-cli-compat-appkit-{appkit_version}-skills-{skills_version}
111+
112+
# Stage and commit
113+
git add internal/build/cli-compat.json
114+
git commit -s -m "Bump cli-compat to appkit {appkit_version}, skills {skills_version}"
115+
116+
# Push and create PR
117+
git push -u origin HEAD
118+
gh pr create \
119+
--title "Bump cli-compat to appkit {appkit_version}, skills {skills_version}" \
120+
--body "$(cat <<'EOF'
121+
## Summary
122+
Bump `cli-compat.json` to use:
123+
- AppKit `{appkit_version}`
124+
- Agent Skills `{skills_version}`
125+
126+
## Checklist
127+
- [ ] Evals passed with no regressions
128+
- [ ] `go test ./libs/clicompat/... -run TestEmbeddedManifest` passes
129+
EOF
130+
)"
131+
```
132+
133+
Show the PR URL to the user when done.
134+
135+
## Examples
136+
137+
### Example: With explicit versions
138+
```
139+
/bump-cli-compat --appkit 0.28.0 --skills 0.1.6
140+
```
141+
Validates tags exist (including `template-v0.28.0`), updates manifest, creates PR.
142+
143+
### Example: Auto-detect latest
144+
```
145+
/bump-cli-compat
146+
```
147+
Fetches latest tags, asks for eval confirmation, then updates and creates PR.
148+
149+
### Example: Only bump AppKit
150+
```
151+
/bump-cli-compat --appkit 0.28.0
152+
```
153+
Auto-detects latest skills version, asks for confirmation, then updates both.

.agent/skills/pr-checklist/SKILL.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ Before submitting a PR, run these commands to match what CI checks. CI uses the
1616
# 3. Tests (CI runs with both deployment engines)
1717
./task test
1818

19-
# 4. If you changed bundle config structs or schema-related code:
19+
# 4. If you changed bundle config structs, schema, or direct-engine resource code:
2020
./task generate-schema
21+
./task generate-direct
2122

2223
# 5. If you changed files in python/:
2324
./task pydabs-codegen pydabs-test pydabs-lint pydabs-docs
2425

25-
# 6. If you changed experimental/aitools or experimental/ssh:
26-
./task test-exp-aitools # only if aitools code changed
26+
# 6. If you changed cmd/aitools/, libs/aitools/, experimental/aitools/, or experimental/ssh/:
27+
./task test-exp-aitools # only if aitools code changed (top-level or experimental)
2728
./task test-exp-ssh # only if ssh code changed
2829
```
2930

.codegen/_openapi_sha

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
11ae6f9d98f0d0838a5e53c27032f178fecc4ee0
1+
a499dda0f7802e37868d3f3076f62639165475d8

.gitattributes

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ cmd/account/credentials/credentials.go linguist-generated=true
88
cmd/account/csp-enablement-account/csp-enablement-account.go linguist-generated=true
99
cmd/account/custom-app-integration/custom-app-integration.go linguist-generated=true
1010
cmd/account/disable-legacy-features/disable-legacy-features.go linguist-generated=true
11+
cmd/account/disaster-recovery/disaster-recovery.go linguist-generated=true
1112
cmd/account/enable-ip-access-lists/enable-ip-access-lists.go linguist-generated=true
1213
cmd/account/encryption-keys/encryption-keys.go linguist-generated=true
1314
cmd/account/endpoints/endpoints.go linguist-generated=true
@@ -151,6 +152,7 @@ cmd/workspace/resource-quotas/resource-quotas.go linguist-generated=true
151152
cmd/workspace/restrict-workspace-admins/restrict-workspace-admins.go linguist-generated=true
152153
cmd/workspace/rfa/rfa.go linguist-generated=true
153154
cmd/workspace/schemas/schemas.go linguist-generated=true
155+
cmd/workspace/secrets-uc/secrets-uc.go linguist-generated=true
154156
cmd/workspace/secrets/secrets.go linguist-generated=true
155157
cmd/workspace/service-principal-secrets-proxy/service-principal-secrets-proxy.go linguist-generated=true
156158
cmd/workspace/service-principals-v2/service-principals-v2.go linguist-generated=true
@@ -159,12 +161,14 @@ cmd/workspace/settings/settings.go linguist-generated=true
159161
cmd/workspace/shares/shares.go linguist-generated=true
160162
cmd/workspace/sql-results-download/sql-results-download.go linguist-generated=true
161163
cmd/workspace/storage-credentials/storage-credentials.go linguist-generated=true
164+
cmd/workspace/supervisor-agents/supervisor-agents.go linguist-generated=true
162165
cmd/workspace/system-schemas/system-schemas.go linguist-generated=true
163166
cmd/workspace/table-constraints/table-constraints.go linguist-generated=true
164167
cmd/workspace/tables/tables.go linguist-generated=true
165168
cmd/workspace/tag-policies/tag-policies.go linguist-generated=true
166169
cmd/workspace/temporary-path-credentials/temporary-path-credentials.go linguist-generated=true
167170
cmd/workspace/temporary-table-credentials/temporary-table-credentials.go linguist-generated=true
171+
cmd/workspace/temporary-volume-credentials/temporary-volume-credentials.go linguist-generated=true
168172
cmd/workspace/token-management/token-management.go linguist-generated=true
169173
cmd/workspace/tokens/tokens.go linguist-generated=true
170174
cmd/workspace/users-v2/users-v2.go linguist-generated=true

.github/OWNERS

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,5 +59,13 @@
5959
# Internal
6060
/internal/ team:platform
6161

62+
# AI tools
63+
/cmd/aitools/ team:eng-apps-devex team:platform @lennartkats-db
64+
/libs/aitools/ team:eng-apps-devex team:platform @lennartkats-db
65+
66+
# CLI compatibility manifest
67+
/internal/build/cli-compat.json team:eng-apps-devex team:platform
68+
/libs/clicompat/ team:eng-apps-devex team:platform
69+
6270
# Experimental
6371
/experimental/aitools/ team:eng-apps-devex @lennartkats-db

.github/workflows/tagging.yml

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,12 @@ name: tagging
44
on:
55
# Manual dispatch.
66
workflow_dispatch:
7-
# No inputs are required for the manual dispatch.
7+
inputs:
8+
packages:
9+
description: 'Comma-separated list of packages to tag (e.g. "pkg1,pkg2"). Leave empty to tag all packages with pending releases.'
10+
required: false
11+
type: string
12+
default: ''
813

914
# NOTE: Temporarily disable automated releases.
1015
#
@@ -31,8 +36,8 @@ jobs:
3136
github.repository == 'databricks/databricks-sdk-java'
3237
environment: "release-is"
3338
runs-on:
34-
group: databricks-deco-testing-runner-group
35-
labels: ubuntu-latest-deco
39+
group: databricks-protected-runner-group
40+
labels: linux-ubuntu-latest
3641
steps:
3742
- name: Generate GitHub App Token
3843
id: generate-token
@@ -44,6 +49,12 @@ jobs:
4449
- name: Checkout repository
4550
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4651
with:
52+
# Force re-resolution of ``main`` at step time. Without
53+
# ``ref:``, checkout pins to ``github.sha`` — the SHA frozen
54+
# at workflow_dispatch time — which means re-running a stale
55+
# dispatch checks out an older main even when newer commits
56+
# exist.
57+
ref: main
4758
fetch-depth: 0
4859
token: ${{ steps.generate-token.outputs.token }}
4960

@@ -60,4 +71,18 @@ jobs:
6071
env:
6172
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
6273
GITHUB_REPOSITORY: ${{ github.repository }}
63-
run: uv run --locked internal/genkit/tagging.py
74+
PACKAGES: ${{ inputs.packages }}
75+
run: |
76+
if [ -n "$PACKAGES" ]; then
77+
uv run --locked internal/genkit/tagging.py --package "$PACKAGES"
78+
else
79+
uv run --locked internal/genkit/tagging.py
80+
fi
81+
82+
- name: Upload created tags artifact
83+
if: always()
84+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
85+
with:
86+
name: created-tags
87+
path: created_tags.json
88+
if-no-files-found: ignore

.release_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
"timestamp": "2026-05-07 10:05:31+0000"
2+
"timestamp": "2026-05-13 14:20:07+0000"
33
}

CHANGELOG.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,32 @@
11
# Version changelog
22

3+
## Release v0.299.2 (2026-05-13)
4+
5+
### Notable Changes
6+
* Breaking change: `vector_search_endpoints` renamed `min_qps` to `target_qps` in DABs configuration and the `vector-search-endpoints` commands, following the SDK rename in v0.131.0. Update any `databricks.yml` using `min_qps:` to `target_qps:` and any CLI invocations using `--min-qps` to `--target-qps`.
7+
8+
### CLI
9+
10+
* `auth login` no longer falls back to plaintext when the OS keyring is reachable but locked. The unlock prompt shown by the probe now runs in parallel with the OAuth flow, and the token is stored in the keyring once the user has typed their password.
11+
* `databricks auth describe` now reports where U2M (`databricks-cli`) tokens are stored: `plaintext` (`~/.databricks/token-cache.json`) or `secure` (OS keyring), and the source of the choice (env var, config setting, or default).
12+
* Marked the default profile in the interactive pickers shown by `databricks auth switch`, `databricks auth logout`, `databricks auth token`, and `databricks auth login`, and moved it to the top of the list. `databricks auth login` and `databricks auth logout` now offer the same selectors as `databricks auth token` and `databricks auth switch` respectively.
13+
* The interactive auth profile pickers now start in search mode so typing immediately filters the list, and the action entries (`+ Create a new profile`, `→ Enter a host URL manually`) are visually distinct from real profiles and stay visible regardless of the search query.
14+
* Shortened the host prompt label shown after `→ Enter a host URL manually` in `databricks auth login` so the prompt no longer leaves stale lines on screen when typing or pasting a host URL.
15+
16+
### Bundles
17+
* Stop applying `presets.name_prefix` (and the dev-mode `[dev <user>]` rename) to `vector_search_endpoints` ([#5209](https://github.com/databricks/cli/pull/5209)).
18+
19+
* Fix `bundle generate` job to preserve nested notebook directory structure ([#4596](https://github.com/databricks/cli/pull/4596))
20+
* Propagate authentication environment (including `DATABRICKS_CONFIG_PROFILE`) to the `experimental.python` subprocess so bundle validate/deploy no longer fails with a multi-profile host ambiguity error when several profiles in `~/.databrickscfg` share the same host.
21+
* Fixed `--force-pull` on `bundle summary` and `bundle open` so the flag bypasses the local state cache and reads state from the workspace.
22+
23+
### Dependency updates
24+
25+
* Bump Go toolchain to 1.25.10 ([#5213](https://github.com/databricks/cli/pull/5213)).
26+
* Bump `github.com/databricks/databricks-sdk-go` from v0.128.0 to v0.132.0.
27+
* Bump Terraform provider to v1.115.0.
28+
29+
330
## Release v0.299.1 (2026-05-07)
431

532
### CLI

NEXT_CHANGELOG.md

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,23 @@
11
# NEXT CHANGELOG
22

3-
## Release v0.299.2
3+
## Release v0.300.0
4+
5+
### Notable Changes
6+
7+
* Breaking change: OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) instead of `~/.databricks/token-cache.json`. After upgrading, run `databricks auth login` once per profile to re-authenticate; cached tokens from older versions are not migrated. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg` (the env var takes precedence over the config setting), then re-run `databricks auth login`. On systems where the OS keyring is not reachable (e.g. Linux containers without a D-Bus session bus), the CLI transparently falls back to the file cache when reading tokens so legacy `token-cache.json` entries remain accessible without manual configuration.
48

59
### CLI
610

7-
* `databricks auth describe` now reports where U2M (`databricks-cli`) tokens are stored: `plaintext` (`~/.databricks/token-cache.json`) or `secure` (OS keyring), and the source of the choice (env var, config setting, or default).
8-
* Marked the default profile in the interactive pickers shown by `databricks auth switch`, `databricks auth logout`, `databricks auth token`, and `databricks auth login`, and moved it to the top of the list. `databricks auth login` and `databricks auth logout` now offer the same selectors as `databricks auth token` and `databricks auth switch` respectively.
11+
* Added `databricks aitools` command group for installing Databricks skills into your coding agents (Claude Code, Cursor, Codex CLI, OpenCode, GitHub Copilot, Antigravity). Skills are fetched from [github.com/databricks/databricks-agent-skills](https://github.com/databricks/databricks-agent-skills) and either symlinked into each agent's skills directory or copied into the current project. Use `databricks aitools install` to set up, `update` to pull newer versions, `list` to see what's available, and `uninstall` to remove them. Pick where they go with `--scope=project|global` (`--scope=both` is accepted on `update` and `list`).
12+
* `[__settings__].default_profile` is now consulted as a fallback by `databricks api`, `databricks auth token`, and bundle commands when neither `--profile` nor `DATABRICKS_CONFIG_PROFILE` is set. `databricks auth token` continues to give precedence to `DATABRICKS_HOST` over `default_profile`. For bundle commands, `default_profile` only applies when the bundle does not pin its own `workspace.host`.
13+
* `databricks workspace import-dir` now skips `.git`, `.databricks`, and `node_modules` directories during recursive imports. To import one of these directories deliberately, pass it as `SOURCE_PATH` ([#5118](https://github.com/databricks/cli/pull/5118)).
14+
* `databricks postgres create-role --help` now documents the `--json` body shape and rejects the common mistake of wrapping the body in `{"role": ...}` client-side with a hint pointing at the correct shape ([#5111](https://github.com/databricks/cli/pull/5111)).
15+
* `databricks aitools list` honors `--output json`, emitting a structured `{release, skills[...], summary{}}` document so coding agents and CI can consume the skill/version/installation matrix without scraping the tabular text output ([#5233](https://github.com/databricks/cli/pull/5233)).
916

1017
### Bundles
11-
* Stop applying `presets.name_prefix` (and the dev-mode `[dev <user>]` rename) to `vector_search_endpoints` ([#5209](https://github.com/databricks/cli/pull/5209)).
12-
13-
* Fix `bundle generate` job to preserve nested notebook directory structure ([#4596](https://github.com/databricks/cli/pull/4596))
14-
* Propagate authentication environment (including `DATABRICKS_CONFIG_PROFILE`) to the `experimental.python` subprocess so bundle validate/deploy no longer fails with a multi-profile host ambiguity error when several profiles in `~/.databrickscfg` share the same host.
15-
* Fixed `--force-pull` on `bundle summary` and `bundle open` so the flag bypasses the local state cache and reads state from the workspace.
18+
* Make sure warnings asking for approval are understood by agents ([#5239](https://github.com/databricks/cli/pull/5239))
19+
* Support `replace_existing: true` on `postgres_branches` and `postgres_endpoints` so bundles can manage the implicitly-created production branch and primary read-write endpoint of a Lakebase project.
20+
* Add `postgres_catalogs` resource to bind a Unity Catalog catalog to a Postgres database on a Lakebase Autoscaling branch ([#5265](https://github.com/databricks/cli/pull/5265)).
21+
* engine/direct: Changes to state file now persisted to .wal file right away instead of being saved in the end ([#5149](https://github.com/databricks/cli/pull/5149))
1622

1723
### Dependency updates
18-
19-
* Bump Go toolchain to 1.25.10 ([#5213](https://github.com/databricks/cli/pull/5213)).

NOTICE

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,6 @@ google/uuid - https://github.com/google/uuid
6666
Copyright (c) 2009,2014 Google Inc. All rights reserved.
6767
License - https://github.com/google/uuid/blob/master/LICENSE
6868

69-
manifoldco/promptui - https://github.com/manifoldco/promptui
70-
Copyright (c) 2017, Arigato Machine Inc. All rights reserved.
71-
License - https://github.com/manifoldco/promptui/blob/master/LICENSE.md
72-
7369
hexops/gotextdiff - https://github.com/hexops/gotextdiff
7470
Copyright (c) 2009 The Go Authors. All rights reserved.
7571
License - https://github.com/hexops/gotextdiff/blob/main/LICENSE
@@ -143,6 +139,10 @@ charmbracelet/lipgloss - https://github.com/charmbracelet/lipgloss
143139
Copyright (c) 2021-2025 Charmbracelet, Inc
144140
License - https://github.com/charmbracelet/lipgloss/blob/master/LICENSE
145141

142+
charmbracelet/x/ansi - https://github.com/charmbracelet/x
143+
Copyright (c) 2023-2025 Charmbracelet, Inc
144+
License - https://github.com/charmbracelet/x/blob/main/ansi/LICENSE
145+
146146
Masterminds/semver - https://github.com/Masterminds/semver
147147
Copyright (C) 2014-2019, Matt Butcher and Matt Farina
148148
License - https://github.com/Masterminds/semver/blob/master/LICENSE.txt

0 commit comments

Comments
 (0)