Merge branch 'main' into fix/export-dir-experiments

Author: varundeepsaini

.codegen/_openapi_sha

@@ -1 +1 @@
-8f5eedbc991c4f04ce1284406577b0c92d59a224
+e1ea3f5ba0bc5b53be94f56535a67ba701a52a52

.gitattributes

@@ -168,6 +168,7 @@ cmd/workspace/volumes/volumes.go linguist-generated=true
 cmd/workspace/warehouses/warehouses.go linguist-generated=true
 cmd/workspace/workspace-bindings/workspace-bindings.go linguist-generated=true
 cmd/workspace/workspace-conf/workspace-conf.go linguist-generated=true
+cmd/workspace/workspace-entity-tag-assignments/workspace-entity-tag-assignments.go linguist-generated=true
 cmd/workspace/workspace-iam-v2/workspace-iam-v2.go linguist-generated=true
 cmd/workspace/workspace-settings-v2/workspace-settings-v2.go linguist-generated=true
 cmd/workspace/workspace/workspace.go linguist-generated=true

.github/CODEOWNERS

@@ -7,5 +7,5 @@
 /cmd/workspace/apps/      @databricks/eng-app-devex
 /libs/apps/               @databricks/eng-app-devex
 /acceptance/apps/         @databricks/eng-app-devex
-/experimental/aitools/    @databricks/eng-app-devex @pietern @lennartkats-db
-/experimental/apps-mcp/   @databricks/eng-app-devex @pietern @lennartkats-db
+/experimental/aitools/    @databricks/eng-app-devex @lennartkats-db
+/experimental/apps-mcp/   @databricks/eng-app-devex @lennartkats-db

.github/ISSUE_TEMPLATE/direct-issue.md

@@ -1,7 +1,7 @@
 ---
 name: Bug report for direct deployment engine for DABs
 about: Use this to report an issue with direct deployment engine in Databricks Asset Bundles.
-labels: DABs engine/direct Bug
+labels: ["DABs", "engine/direct", "Bug"]
 title: ''
 ---
 

.github/workflows/check.yml

@@ -5,6 +5,14 @@ on:
     types: [opened, synchronize]
   merge_group:
     types: [checks_requested]
+  push:
+    # Always run on push to main. The build cache can only be reused
+    # if it was saved by a run from the repository's default branch.
+    # The run result will be identical to that from the merge queue
+    # because the commit is identical, yet we need to perform it to
+    # seed the build cache.
+    branches:
+      - main
 
 jobs:
   lint:

.github/workflows/integration-approve.yml

@@ -70,31 +70,52 @@ jobs:
           # Always run all tests
           echo "targets=[\"test\"]" >> $GITHUB_OUTPUT
 
-  tests:
+  test:
     needs:
       - cleanups
       - testmask
 
     # Only run if the target is in the list of targets from testmask
     if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test') }}
-    runs-on: ${{ matrix.os }}
+    name: "make test (${{matrix.os.name}}, ${{matrix.deployment}})"
+    runs-on: ${{ matrix.os.runner }}
 
     strategy:
       fail-fast: false
       matrix:
+        # Use separate fields for the OS name and runner configuration.
+        # When combined in a single object, "runs-on" errors with "Unexpected value 'name'".
         os:
-          - group: databricks-protected-runner-group-large
-            labels: linux-ubuntu-latest-large
+          - name: linux
+            runner:
+              group: databricks-protected-runner-group-large
+              labels: linux-ubuntu-latest-large
+
+          - name: windows
+            runner:
+              group: databricks-protected-runner-group-large
+              labels: windows-server-latest-large
 
-          # On merge_group events, only run the tests on Linux, to reduce time to merge.
-          - ${{ github.event_name != 'merge_group' && fromJSON('{"group":"databricks-protected-runner-group-large","labels":"windows-server-latest-large"}') || null }}
-          - ${{ github.event_name != 'merge_group' && 'macos-latest' || null }}
+          - name: macos
+            runner:
+              labels: macos-latest
 
         deployment:
           - "terraform"
           - "direct"
+
+        # Include "event_name" in the matrix so we can include/exclude based on it.
+        event:
+          - ${{ github.event_name }}
+
+        # Run on Linux only in merge queue to reduce time to merge.
         exclude:
-          - os: null
+          - event: merge_group
+            os:
+              name: windows
+          - event: merge_group
+            os:
+              name: macos
 
     steps:
       - name: Checkout repository and submodules
@@ -249,6 +270,35 @@ jobs:
         run: |
           make test-pipelines
 
+  # This job groups the result of all the above test jobs.
+  # It is a required check, so it blocks auto-merge and the merge queue.
+  #
+  # We use `if: always()` to ensure this job runs even when dependencies are skipped.
+  # Without it, GitHub Actions skips jobs whose dependencies are skipped, which would
+  # incorrectly block the merge queue when optional test jobs don't run.
+  #
+  # The step checks `contains(needs.*.result, 'failure')` to fail if any dependency failed.
+  # Reference: https://github.com/orgs/community/discussions/25970
+  test-result:
+    needs:
+      - test
+      - test-exp-aitools
+      - test-exp-apps-mcp
+      - test-exp-ssh
+      - test-pipelines
+
+    if: ${{ always() }}
+    name: test-result
+    runs-on: ubuntu-latest
+
+    steps:
+      - run: |
+          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
+            echo "One or more required jobs failed ❌"
+            exit 1
+          fi
+          echo "All tests passed ✅"
+
   validate-generated-is-up-to-date:
     needs: cleanups
     runs-on: ubuntu-latest
@@ -334,3 +384,77 @@ jobs:
 
             exit 1
           fi
+
+  # Trigger integration tests in a separate repository.
+  # Requires secrets from "test-trigger-is" environment (not available for fork PRs).
+  # Auto-approves for merge groups to avoid running twice and queue timeouts.
+  integration-trigger:
+    needs:
+      - testmask
+
+    if: >-
+      (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork) ||
+      (github.event_name == 'merge_group') ||
+      (github.event_name == 'push')
+
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    environment: "test-trigger-is"
+
+    steps:
+      - name: Generate GitHub App Token
+        if: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
+        id: generate-token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        with:
+          app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }}
+          owner: ${{ secrets.ORG_NAME }}
+          repositories: ${{ secrets.REPO_NAME }}
+
+      # Trigger integration tests if the primary "test" target is triggered by this change.
+      - name: Trigger integration tests (pull request)
+        if: ${{ github.event_name == 'pull_request' && contains(fromJSON(needs.testmask.outputs.targets), 'test') }}
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |-
+          gh workflow run cli-isolated-pr.yml -R ${{ secrets.ORG_NAME }}/${{ secrets.REPO_NAME }} \
+            --ref main \
+            -f pull_request_number=${{ github.event.pull_request.number }} \
+            -f commit_sha=${{ github.event.pull_request.head.sha }}
+
+      # Skip integration tests if the primary "test" target is not triggered by this change.
+      - name: Skip integration tests (pull request)
+        if: ${{ github.event_name == 'pull_request' && !contains(fromJSON(needs.testmask.outputs.targets), 'test') }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |-
+          gh api -X POST -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }} \
+            -f 'state=success' \
+            -f 'context=Integration Tests Check' \
+            -f 'description=⏭️ Skipped'
+
+      - name: Auto-approve for merge group
+        if: ${{ github.event_name == 'merge_group' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |-
+          gh api -X POST -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/${{ github.repository }}/statuses/${{ github.sha }} \
+            -f 'state=success' \
+            -f 'context=Integration Tests Check' \
+            -f 'description=⏭️ Skipped'
+
+      - name: Trigger integration tests (push to main)
+        if: ${{ github.event_name == 'push' }}
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |-
+          gh workflow run cli-isolated-nightly.yml -R ${{ secrets.ORG_NAME }}/${{ secrets.REPO_NAME }} \
+            --ref main \
+            -f commit_sha=${{ github.event.after }}

.github/workflows/integration-main.yml

@@ -1,3 +1,3 @@
 {
-    "timestamp": "2025-11-19 14:13:47+0000"
+    "timestamp": "2025-12-18 13:04:36+0000"
 }