feat: add DEFANG_TENANT environment variable support for tenant selection

Author: raphaeltm

pkgs/npm/README.md

@@ -32,6 +32,7 @@ The Defang CLI recognizes the following environment variables:
 - `DEFANG_HIDE_HINTS` - If set to `true`, hides hints in the CLI output; defaults to `false`
 - `DEFANG_HIDE_UPDATE` - If set to `true`, hides the update notification; defaults to `false`
 - `DEFANG_PROVIDER` - The name of the cloud provider to use, `auto` (default), `aws`, `digitalocean`, or `defang`
+- `DEFANG_TENANT` - The name of the tenant to use.
 - `NO_COLOR` - If set to any value, disables color output; by default, color output is enabled depending on the terminal
 - `TZ` - The timezone to use for log timestamps: an IANA TZ name like `UTC` or `Europe/Amsterdam`; defaults to `Local`
 - `XDG_STATE_HOME` - The directory to use for storing state; defaults to `~/.local/state`

src/README.md

@@ -41,6 +41,7 @@ The Defang CLI recognizes the following environment variables:
 - `DEFANG_PULUMI_BACKEND` - The Pulumi backend URL or `"pulumi-cloud"`; defaults to a self-hosted backend
 - `DEFANG_PULUMI_DIR` - Run Pulumi from this folder, instead of spawning a cloud task; requires `--debug` (BYOC only)
 - `DEFANG_PULUMI_VERSION` - Override the version of the Pulumi image to use (`aws` provider only)
+- `DEFANG_TENANT` - The name of the tenant to use.
 - `NO_COLOR` - If set to any value, disables color output; by default, color output is enabled depending on the terminal
 - `PULUMI_ACCESS_TOKEN` - The Pulumi access token to use for authentication to Pulumi Cloud; see `DEFANG_PULUMI_BACKEND`
 - `PULUMI_CONFIG_PASSPHRASE` - Passphrase used to generate a unique key for your stack, and configuration and encrypted state values

src/cmd/cli/command/commands.go

@@ -373,7 +373,11 @@ var RootCmd = &cobra.Command{
 
 		// Configure tenant selection based on --tenant flag
 		if f := cmd.Root().Flag("tenant"); f != nil && f.Changed {
+			// Highest precedence: explicit --tenant flag
 			auth.SetSelectedTenantName(tenantFlag)
+		} else if envTenant := os.Getenv("DEFANG_TENANT"); strings.TrimSpace(envTenant) != "" {
+			// Next precedence: DEFANG_TENANT environment variable
+			auth.SetSelectedTenantName(envTenant)
 		} else {
 			// Default behavior: auto-select tenant by JWT subject if no explicit name is provided
 			auth.SetAutoSelectBySub(true)