Merge branch 'main' into suppress-gh-deployed

Author: janniklasrose

.agent/rules/testing.md

@@ -186,6 +186,28 @@ trace print_requests
 
 **RULE: Route noisy or non-deterministic command output to `LOG.<name>` instead of `output.txt` or `/dev/null`.** `LOG.*` files are visible under `go test -v` but excluded from the diff — see `acceptance/selftest/log/`. Use `&> LOG.<name>` to capture both streams (then `contains.py` to assert invariants like `'!panic' '!internal error'`), or `2>>LOG.<name>` for cleanup-step stderr you'd otherwise drop to `/dev/null`.
 
+**RULE: When a test prints an API GET/read response into `output.txt`, project it to an allow-list of the fields the test asserts — never dump the full payload or strip a deny-list of volatile fields with `jq 'del(...)'`.** The backend keeps adding response fields, and cloud tests run against the real API, so a full payload (or a `del` that only removes today's volatile fields) breaks the golden every time the response grows — even for fields the test does not care about. Instead define a `<resource>_fields()` helper in the resource directory's `script.prepare` that `jq`-selects the fields you assert, and pipe the response through it. Precedent: `acceptance/bundle/resources/postgres_*/script.prepare`.
+
+GOOD:
+
+```bash
+# in script.prepare
+branch_fields() {
+    jq '{branch_id, name, parent, status: (.status | {branch_id, default, is_protected})}'
+}
+# in script
+trace $CLI postgres get-branch "$name" | branch_fields
+```
+
+BAD:
+
+```bash
+trace $CLI postgres get-branch "$name" | jq 'del(.create_time, .update_time)'
+trace $CLI postgres get-branch "$name"   # full payload straight into output.txt
+```
+
+For a field that appears on some responses but not others (e.g. a provenance field absent on a default resource), append `| with_entries(select(.value != null))` to the projected object so the optional field is dropped rather than emitted as `null`.
+
 ### Test server
 
 Acceptance tests run against an in-process fake of the Databricks API in `libs/testserver/` (`FakeWorkspace` and the per-service handler files). The fake keeps real in-memory state and returns the same errors the backend does: 404 on a missing parent, 409 on a duplicate create, 400 on a missing required field, and so on. `test.toml` can also stub a single route with a canned response:

.github/workflows/push.yml

@@ -262,9 +262,9 @@ jobs:
         with:
           cache-key: test-exp-ssh
 
-      # The proxy tests exercise a real OpenSSH server, which the runner image
-      # ships only the client half of. Install it on Linux (the OS the sshd
-      # test is gated to); other platforms skip that test.
+      # The ssh acceptance test drives a real sshd behind the tunnel; the runner
+      # ships only the client. Install it on Linux (the OS the test is gated to);
+      # elsewhere and in the general test job it skips via SKIP_TEST.
       - name: Install OpenSSH server
         if: runner.os == 'Linux'
         run: sudo apt-get update && sudo apt-get install -y openssh-server

.nextchanges/bundles/5877.md

@@ -1 +1 @@
-1.8.0
+1.9.0

.nextchanges/bundles/bundle-init-git-clone-url.md

@@ -1,3 +1,3 @@
 {
-    "timestamp": "2026-07-09 10:51:45+0000"
+    "timestamp": "2026-07-15 14:31:34+0000"
 }

.nextchanges/bundles/bundle-init-unsupported-protocol.md

@@ -1,5 +1,26 @@
 # Version changelog
 
+## Release v1.8.0 (2026-07-15)
+
+### Notable Changes
+
+ * Auto-migrate a bundle from terraform to the direct engine when `bundle.engine` is `"direct"` (or `DATABRICKS_BUNDLE_ENGINE=direct`) and the post-deploy dry-run migration is clean; a warning is emitted if the dry-run surfaces errors or warnings so the automatic migration is skipped.
+
+### CLI
+
+ * experimental `ssh connect`: bare `python`/`pip` in an interactive session now resolve to the environment interpreter (`$DATABRICKS_VIRTUAL_ENV`) instead of the system or cluster-libraries interpreter, so packages installed in the environment are importable without extra setup. The interactive shell is now non-login (`bash -i`) and the server seeds a `~/.bashrc` snippet that re-prepends the environment's bin directory to `PATH` ([#5888](https://github.com/databricks/cli/pull/5888)).
+ * When Claude Code runs the CLI without the Databricks AI tooling installed, the CLI now prints a one-line recommendation on stderr to run `databricks aitools install`. The recommendation is shown at most once per hour per Claude session, and never for human callers or `aitools` commands.
+ * Fixed `databricks auth describe` misattributing a profile selected via `DATABRICKS_CONFIG_PROFILE` as `(from bundle)` when run inside a bundle root ([#5904](https://github.com/databricks/cli/pull/5904)).
+
+### Bundles
+
+ * `bundle generate` now warns when the generated configuration file is not matched by any pattern in the `include` section of `databricks.yml` ([#5868](https://github.com/databricks/cli/pull/5868)).
+ * direct: Match UC Auto Upgrade managed property defaults with a wildcard pattern instead of enumerating each key ([#5877](https://github.com/databricks/cli/pull/5877)).
+ * Recognize `ssh://` template URLs in `databricks bundle init` ([#5891](https://github.com/databricks/cli/pull/5891)).
+ * `databricks bundle init` now reports an actionable error when given a template URL with an unsupported protocol (`http://`, `git://`, `ftp://`, `ftps://`) instead of failing with a confusing "not a bundle template" message ([#5902](https://github.com/databricks/cli/pull/5902)).
+ * Added an `env:` section to `scripts.<name>` for declaring environment variables that may reference `${bundle.*}`, `${workspace.*}`, and `${var.*}` ([#4179](https://github.com/databricks/cli/issues/4179), [#5299](https://github.com/databricks/cli/pull/5299)).
+
+
 ## Release v1.7.0 (2026-07-09)
 
 ### CLI

.nextchanges/version

@@ -0,0 +1,2 @@
+#!/bin/bash
+echo "hello from AI Runtime"