Allow the use of different client IDs in U2M auth by renaudhartert-db · Pull Request #6594 · databricks/cli

renaudhartert-db · 2026-09-09T17:16:56Z

Changes

Allow OAuth U2M authentication to override the CLI client ID through profile client_id or DATABRICKS_CLIENT_ID, and add databricks auth login --client-id. The flag overrides an existing profile value and persists the effective client ID for login, token refresh, and discovery login.

The U2M credential strategy accepts the resolved client ID regardless of whether it came from the profile, environment, or dynamic configuration. The override remains restricted to the databricks-cli auth type so M2M credentials do not leak into U2M.

Why

Organizations may need the CLI U2M flow to authenticate through a custom OAuth application while keeping the override scoped to an explicit login, profile, or environment.

Tests

Full Go lint: zero issues
Full unit suite: 10,032 tests passed
Direct-host and discovery login acceptance tests, including both configured deployment engines
Focused libs/auth tests covering file, environment, and dynamic client ID sources
Tidy, whitespace, deadcode, changelog, lockfile, and Go formatting checks

The full acceptance sweep was blocked before execution because this machine has jq 1.6 and the suite requires jq 1.7 or newer. The pinned Python formatter/linter could not be downloaded because PyPI DNS was unavailable; no Python files changed.

This PR was written by Codex.

eng-dev-ecosystem-bot · 2026-09-09T17:49:47Z

Integration test report

Commit: 7cd98de

Run: 34504731577

	Env	💚RECOVERED	✅pass	🙈skip	Time
💚	aws linux	1	275	17	5:36
💚	aws windows	1	277	15	7:32
💚	azure linux	1	274	17	4:23
💚	azure windows	1	276	15	4:13
💚	gcp linux	1	275	17	4:59
💚	gcp windows	1	277	15	4:57

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚	TestAccept	💚R	💚R	💚R	💚R	💚R	💚R

Top 6 slowest tests (at least 2 minutes):

duration	env	testname
7:30	aws windows	TestAccept
4:56	gcp windows	TestAccept
4:11	azure windows	TestAccept
2:18	azure linux	TestAccept
2:13	aws linux	TestAccept
2:10	gcp linux	TestAccept

mihaimitrea-db

Have a look at the comment

mihaimitrea-db · 2026-09-10T16:27:41Z

+		clientIDConfig, ok := cfg.GetAuthDetails().Configuration["client_id"]
+		if ok && clientIDConfig.Source.Type == config.SourceFile {
+			opts = append(opts, u2m.WithClientID(cfg.ClientID))
+		}


[edge case] If you have a correctly setup profile using the client ID you want, but also set DATABRICKS_CLIENT_ID, this piece of code will make the CLI use its default Client ID.

This is because the cfg first resolves env variables, making this if statement here fail.

eng-dev-ecosystem-bot · 2026-09-10T21:02:18Z

Integration test report

Commit: d1d367d

Run: 34509383550

	Env	❌FAIL	🟨KNOWN	🙈SKIP	✅pass	🙈skip	Time
❌	aws linux	483	5	1	1107	1031	177:27
❌	aws windows	434	5	1	1062	1054	187:38
❌	azure linux	391	1	3	1016	1078	116:07
❌	azure windows	349	1	3	964	1101	141:16
❌	gcp linux	383	1	3	1010	1082	128:28
❌	gcp windows	339	1	3	960	1105	152:06

498 interesting tests: 492 FAIL, 5 KNOWN, 1 SKIP

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
🟨	TestAccept	🟨K	🟨K	🟨K	🟨K	🟨K	🟨K
❌	TestAccept/bundle/apps/compute_size	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/apps/compute_size/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/apps/job_permissions	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/apps/job_permissions/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/config-remote-sync/cli_defaults	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/cli_defaults/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/config_edits	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/config_edits/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/dashboard_etag	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/dashboard_etag/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/flushed_cache	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/flushed_cache/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/formatting_preserved	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/formatting_preserved/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/job_fields	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/job_fields/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/job_multiple_tasks	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/job_multiple_tasks/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/job_params_variables	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/job_params_variables/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/job_pipeline_task	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/job_pipeline_task/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/json_status_selectors	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/json_status_selectors/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/multiple_files	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/multiple_files/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/multiple_resources	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/output_json	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/output_json/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/output_no_changes	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/output_no_changes/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/pipeline_fields	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/pipeline_fields/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/policy_injected_cluster_fields	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/policy_injected_cluster_fields/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/resolve_variables	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/resolve_variables/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/select_basic	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/select_basic/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/select_multiple	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/select_multiple/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/skip_deployment	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/skip_deployment/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/skip_permissions	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/skip_permissions/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/target_override	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/target_override/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/config-remote-sync/task_rename_revert	❌F	🙈s	❌F	🙈s	❌F	🙈s
❌	TestAccept/bundle/config-remote-sync/task_rename_revert/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F		❌F		❌F
❌	TestAccept/bundle/deploy/empty-bundle	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/empty-bundle/DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC=/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/empty-bundle/DATABRICKS_BUNDLE_ENABLE_EXPERIMENTAL_YAML_SYNC=true/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/files/no-snapshot-sync	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/files/no-snapshot-sync/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/mlops-stacks	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/mlops-stacks/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/spark-jar-task	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/jobs-and-pipeline	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/jobs-and-pipeline/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/root-path-name-target	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/root-path-name-target/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/root-path-not-scoped	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/root-path-not-scoped/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/sibling-target	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/destroy/sibling-target/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/declined-deploy	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/declined-deploy/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/depends-on	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/depends-on/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/deployment-metadata-change	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/deployment-metadata-change/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/existing-state	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/existing-state/DATABRICKS_BUNDLE_ENGINE=direct/DMS=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/multiple-resources	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/multiple-resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/no-drift	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/no-drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/no-resources	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/no-resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/provenance	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/provenance/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/record-failure	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/record-failure/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/stale-plan	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/stale-plan/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/stale-plan/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/successful-recreate	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/dms/successful-recreate/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/generate/pipeline_and_deploy	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/generate/pipeline_and_deploy/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/generate/python_job_and_deploy	❌F	✅p	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/generate/python_job_and_deploy/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true	❌F	✅p	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=vector_search_index.yml.tmpl/READPLAN=1	✅p	❌F	✅p	✅p	✅p	✅p
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=app.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=app.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=catalog.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=catalog.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster_policy.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=cluster_policy.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=dashboard.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=dashboard.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=experiment.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=experiment.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=genie_space.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=genie_space.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=instance_pool.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=instance_pool.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_for_each_task.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_for_each_task.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_job_cluster.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_job_cluster.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_task_cluster.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_apply_policy_default_values_task_cluster.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_cross_resource_ref.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_cross_resource_ref.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_escaped_refs.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_escaped_refs.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_permission_ref.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_permission_ref.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_pydabs_10_tasks.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_pydabs_10_tasks.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_run.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_run.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_table_update_trigger.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_table_update_trigger.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_with_depends_on.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_with_depends_on.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_with_task.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=job_with_task.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model_serving_endpoint.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model_serving_endpoint.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model_with_permissions.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=model_with_permissions.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_allow_duplicate_names.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_allow_duplicate_names.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_apply_policy_default_values.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_apply_policy_default_values.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_config_dots.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=pipeline_config_dots.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=registered_model.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=registered_model.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema_grant_ref.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema_grant_ref.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema_uppercase_name.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=schema_uppercase_name.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=secret.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=secret_scope.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=secret_scope.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=secret_scope_default_backend_type.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=secret_scope_default_backend_type.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=sql_warehouse.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=sql_warehouse.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=vector_search_endpoint.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=vector_search_endpoint.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=vector_search_index.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=vector_search_index.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume_path_job_ref.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume_path_job_ref.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume_uppercase_name.yml.tmpl/READPLAN=	❌F	❌F	❌F	❌F	❌F	❌F
❌	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=true/INPUT_CONFIG=volume_uppercase_name.yml.tmpl/READPLAN=1	❌F	❌F	❌F	❌F	❌F	❌F

Top 50 slowest tests (at least 2 minutes):

duration	env	testname
48:33	aws linux	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
20:29	aws linux	TestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
19:46	aws windows	TestAccept/bundle/resources/clusters/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
14:59	aws windows	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=1
13:09	gcp windows	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
12:28	gcp linux	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
12:06	aws linux	TestAccept/bundle/resources/clusters/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
11:17	aws windows	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=
10:35	aws windows	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
9:44	aws windows	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=
7:47	gcp linux	TestAccept/bundle/resources/clusters/deploy/local_ssd_count/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:44	azure linux	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
7:42	gcp windows	TestAccept/bundle/resources/clusters/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:41	aws windows	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:35	gcp windows	TestAccept/bundle/resources/clusters/deploy/local_ssd_count/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:33	aws windows	TestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:27	aws windows	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
7:26	aws linux	TestAccept/bundle/invariant/delete_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=1
7:15	aws linux	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=1
7:14	aws linux	TestAccept/bundle/invariant/delete_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=1
7:11	aws windows	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=1
7:09	aws windows	TestAccept/bundle/invariant/destroy_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster.yml.tmpl/READPLAN=1
6:59	aws linux	TestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
6:59	azure windows	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:56	gcp linux	TestAccept/bundle/resources/clusters/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:54	aws windows	TestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
6:49	aws linux	TestAccept/bundle/invariant/delete_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=
6:47	azure linux	TestAccept/bundle/resources/apps/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:43	aws linux	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:32	aws linux	TestAccept/bundle/invariant/no_drift/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=
6:21	aws windows	TestAccept/bundle/resources/clusters/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:17	gcp linux	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:08	azure linux	TestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
6:08	azure windows	TestAccept/bundle/resources/clusters/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:39	gcp linux	TestAccept/bundle/resources/apps/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:28	aws linux	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
5:25	azure linux	TestAccept/bundle/resources/clusters/lifecycle-started/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:22	aws linux	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
5:14	aws linux	TestAccept/bundle/resources/clusters/deploy/simple/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:14	aws linux	TestAccept/bundle/invariant/destroy_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/DMS=/INPUT_CONFIG=cluster_apply_policy_default_values.yml.tmpl/READPLAN=1
5:12	gcp linux	TestAccept/bundle/resources/apps/lifecycle-started-omitted/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:03	aws linux	TestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:02	azure linux	TestAccept/bundle/config-remote-sync/multiple_resources/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
5:02	gcp linux	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
4:58	gcp linux	TestAccept/bundle/resources/clusters/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
4:54	gcp windows	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
4:54	gcp windows	TestAccept/bundle/resources/apps/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
4:53	gcp linux	TestAccept/bundle/resources/apps/inline_config/DATABRICKS_BUNDLE_ENGINE=terraform/DMS=
4:52	gcp windows	TestAccept/bundle/resources/clusters/lifecycle-started-toggle/DATABRICKS_BUNDLE_ENGINE=direct/DMS=
4:44	aws linux	TestAccept/bundle/deploy/spark-jar-task/DATABRICKS_BUNDLE_ENGINE=direct/DMS=

(320 table rows omitted to keep the report under 60000 bytes)

## Changes Allow OAuth U2M authentication to override the CLI client ID through profile `client_id` or `DATABRICKS_CLIENT_ID`, and add `databricks auth login --client-id`. The flag overrides an existing profile value and persists the effective client ID for login, token refresh, and discovery login. The U2M credential strategy accepts the resolved client ID regardless of whether it came from the profile, environment, or dynamic configuration. The override remains restricted to the `databricks-cli` auth type so M2M credentials do not leak into U2M. ## Why Organizations may need the CLI U2M flow to authenticate through a custom OAuth application while keeping the override scoped to an explicit login, profile, or environment. ## Tests - Full Go lint: zero issues - Full unit suite: 10,032 tests passed - Direct-host and discovery login acceptance tests, including both configured deployment engines - Focused `libs/auth` tests covering file, environment, and dynamic client ID sources - Tidy, whitespace, deadcode, changelog, lockfile, and Go formatting checks The full acceptance sweep was blocked before execution because this machine has jq 1.6 and the suite requires jq 1.7 or newer. The pinned Python formatter/linter could not be downloaded because PyPI DNS was unavailable; no Python files changed. _This PR was written by Codex._

## Release v1.17.0 ### Notable Changes * Bump the direct deployment state version to 3. Clients older than v1.8.0 will reject bundles deployed with this release. ([#6713](#6713)) ### CLI * Add an `INVALID_REFRESH_TOKEN` error code to `databricks auth token --output json` failures. ([#6684](#6684)) * Add experimental `databricks auth docker configure` to configure Docker credential helper access for Databricks Artifact Registry. ([#6700](#6700)) * Add experimental `databricks auth docker token` to generate Docker credentials for Databricks Artifact Registry. ([#6699](#6699)) * `databricks environments setup-local` now reports the `E_PROVISION_CONFLICT` error code instead of the generic `E_PROVISION` when `uv sync` fails to resolve a dependency conflict. ([#6666](#6666)) * Preserve SSH sessions across temporary tunnel disconnects, with bounded replay and backpressure for large transfers. ([#6650](#6650)) * Allow OAuth U2M logins to override the CLI client ID with `--client-id`, profile `client_id`, or `DATABRICKS_CLIENT_ID`. ([#6594](#6594)) ### Bundles * direct: Store a dashboard's `serialized_dashboard` in state as a content hash instead of its full contents. ([#6105](#6105)) * direct: Fix pipelines recreation when the whole `ingestion_definition` block is added or removed. ([#6589](#6589)) * `bundle plan`, `deploy`, and `destroy` no longer report removing `permissions`, `grants`, or secret scope ACLs from a bundle as a deletion, since it leaves the resource untouched. ([#6647](#6647)) * `bundle plan` and `deploy` no longer list or count a resource that was already deleted remotely as a deletion, matching `bundle destroy`; applying still cleans up its stale state entry. ([#6675](#6675)) * Fix `bundle run` failing with `expected an int, found a string` when an unrelated resource references another resource that is not deployed. `bundle run` now resolves `${resources.*}` references only within the resource being run. ([#6690](#6690)) * Add grants support for the AI Gateway `model_service`, `mcp_service`, and `model_provider_service` resources (direct engine). ([#6635](#6635)) * Add bundle support for the AI Gateway `mcp_service` resource (direct engine). ([#6633](#6633)) * Add bundle support for the AI Gateway `model_provider_service` resource (direct engine). ([#6634](#6634)) * Add bundle support for the AI Gateway `model_service` resource (direct engine). ([#6525](#6525)) * Prevent resource drift on catalogs if `storage_root` contained a trailing slash in the URL. ([#6622](#6622)) * Fixed a "lineage mismatch in state files" error that could occur after destroying a bundle and redeploying it from another machine. `bundle destroy` now removes the local state file so no stale lineage is left behind, and prunes the state directories it leaves empty (such as `.internal/` and `sync-snapshots/`). ([#6210](#6210), [#6685](#6685)) * direct: `bundle plan` no longer reports a permanent update on a cluster that uses a cluster policy: when the cluster spec sets `policy_id`, a field present in the remote but absent from the bundle config is not treated as drift. ([#6531](#6531)) * `bundle deploy` on the direct engine now reports each resource as soon as it is deployed, instead of listing them all after the deployment finishes. A deploy that fails part way through now reports the resources it did apply. ([#6361](#6361)) * Direct-engine bundles no longer flag phantom drift on server-populated nested fields under reused config types (e.g. `external_locations` file-event-queue resource IDs, `database_instances` parent-instance refs, `apps` git credential ID). ([#6618](#6618)) * `databricks bundle generate app` now reproduces a git-backed app's `git_repository` and `git_source` configuration instead of emitting a workspace `source_code_path`, so generating from a Git-deployed app no longer silently converts it to workspace source. ([#6656](#6656)) * Improved configuration load time for bundles with many included files. ([#6195](#6195)) * `bundle destroy` no longer deletes triggered job runs, leaving them untouched on the backend. ([#6672](#6672)) * direct: resources.job\_runs: new lifecycle.triggers.on\_file\_change setting to restart the run when monitored files change. Can be set to a series of paths or globs. ([#6309](#6309)) * Bundle summary now shows a name for Postgres branches, endpoints, databases, and roles instead of a blank Name field. ([#6663](#6663)) * Added PyDABs (Python) support for cluster policies, dashboards, and Genie spaces. ([#6585](#6585)) * CLI commands no longer imply that a resource whose type has no workspace URL is merely not deployed yet. ([#6583](#6583)) * Capture the implicit dependency a vector search index has on a catalog or schema defined in the same bundle, so the catalog and schema are deployed first. ([#6655](#6655)) ### Dependency Updates * Bump dependencies with known vulnerabilities. ([#6695](#6695)) * Bump `github.com/databricks/databricks-sdk-go` from v0.177.0 to v0.178.0. ([#6673](#6673)) * Bump Terraform provider from v1.131.0 to v1.132.0. ([#6671](#6671))

## Summary - retrieve custom OAuth tokens through `databricks auth token` when `ENABLE_CUSTOM_OAUTH_FROM_CLI=1` - pass the configured custom client ID through `DATABRICKS_CLIENT_ID` and preserve `--force-refresh` - require Databricks CLI v1.17.0 only for the gated path; keep the existing SDK flow unchanged otherwise ## Testing - `UV_CACHE_DIR=/tmp/uv-cache uv run pytest tests/test_custom_oauth.py -q` - `UV_CACHE_DIR=/tmp/uv-cache uv run ruff check src/ucode/custom_oauth.py tests/test_custom_oauth.py` ## Version note PR databricks/cli#6594 is included in Databricks CLI v1.17.0. The requested v0.17.0 predates this feature, so this change uses v1.17.0 as the feature-specific minimum. ``` "apiKeyHelper": "/tmp/unity-gateway-custom-oauth/.venv/bin/ug auth-token --profile devtools-prod --client-id 4f7af981-8977-4042-b90e-a5dea5b62e19", ``` --------- Co-authored-by: Lilly <[email protected]>

@renaudhartert-db

…ks#6763) > Supersedes databricks#6621 — identical change, moved to an **in-repo branch** so the integration tests run with secrets (a fork PR can't access them). databricks#6621 was approved by @renaudhartert-db; this one needs a fresh approval. ## Changes Add a repeatable `--resource` flag to `databricks auth login` that sends [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) resource indicator(s) as `resource` query parameters on the OAuth **authorization** request. Threaded through `u2m.PersistentAuth` via a new `WithResources` option, appended to the authorization endpoint URL (preserving any query the endpoint already carries; the `oauth2` library appends `client_id`/PKCE/etc. after). Requires `--host` (added to the discovery-incompatible flag list), since a resource indicator targets a specific workspace's `/oidc`. Example: ``` databricks auth login \ --host https://<workspace> \ --client-id <app> \ --resource https://<workspace>/ai-gateway/mcp-services/system.ai.github ``` produces: ``` https://<workspace>/oidc/v1/authorize?resource=https%3A%2F%2F<workspace>%2Fai-gateway%2Fmcp-services%2Fsystem.ai.github&client_id=<app>&code_challenge=...&redirect_uri=http%3A%2F%2Flocalhost%3A8020&response_type=code&scope=offline_access+all-apis&state=... ``` ## Why Builds on databricks#6594 (`--client-id`). A resource-aware authorization server can use the `resource` indicator to scope the login to a specific protected resource and drive **that resource's own login** before issuing the authorization code — e.g. a per-user connection credential behind an AI Gateway MCP service (`system.ai.github`), where the user must complete a downstream SaaS login the first time. Without the indicator the authorization server only sees `client_id` + user, not which connection the flow is for. This is a **draft / POC** to enable end-to-end validation of that flow; the resource indicator is currently sent on the authorization request only (not the token exchange). ## Tests - `TestPersistentAuthResources` — none / single / multiple `resource` params appear on the built authorize URL. - `TestValidateDiscoveryFlagCompatibility` — `--resource` requires `--host`. - `go test ./libs/auth/u2m/ ./cmd/auth/` pass; `go vet` clean; `gofmt` clean. _This pull request and its description were written by Isaac._ ## Update since the initial review on databricks#6621 Per @renaudhartert-db's review, the requested resources are now **persisted to the `resources` profile key**, so `databricks auth token` and a re-run of `auth login` without `--resource` reuse them, and the token cache refreshes when they change. It's a CLI-only profile key written via a dedicated helper (no `databricks-sdk-go` change). Added tests: `TestLoadProfilesResources`, `TestU2MResourcesFromProfile`, `TestSaveResourcesToProfile`. Co-authored-by: Isaac <[email protected]>

renaudhartert-db added 2 commits September 9, 2026 17:15

auth: support profile client IDs for U2M

3bc4457

changelog: link U2M client ID PR

96ed003

renaudhartert-db changed the title ~~auth: support profile client IDs for U2M~~ Allow the use of different client IDs in U2M auth Sep 9, 2026

auth: add client ID flag to login

32af45e

renaudhartert-db requested a review from mihaimitrea-db September 10, 2026 14:08

Merge branch 'main' into auth-u2m-profile-client-id

a054769

renaudhartert-db enabled auto-merge September 10, 2026 16:23

mihaimitrea-db reviewed Sep 10, 2026

View reviewed changes

auth: allow environment client ID for U2M

7cd98de

mihaimitrea-db approved these changes Sep 10, 2026

View reviewed changes

renaudhartert-db added this pull request to the merge queue Sep 10, 2026

Merged via the queue into main with commit d1d367d Sep 10, 2026
35 checks passed

renaudhartert-db deleted the auth-u2m-profile-client-id branch September 10, 2026 17:37

sunishsheth2009 mentioned this pull request Sep 10, 2026

Allow OAuth U2M logins to send RFC 8707 resource indicators #6621

Closed

lilly-luo mentioned this pull request Sep 16, 2026

Use Databricks CLI for gated custom OAuth databricks/unity-gateway#695

Merged

rugpanov mentioned this pull request Sep 17, 2026

Update Databricks CLI to v1.17.0 databricks/databricks-vscode#2200

Merged

sunishsheth2009 mentioned this pull request Sep 20, 2026

Allow OAuth U2M logins to send RFC 8707 resource indicators #6763

Merged

Navigation Menu

Allow the use of different client IDs in U2M auth - #6594

Allow the use of different client IDs in U2M auth#6594
renaudhartert-db merged 5 commits into
mainfrom
auth-u2m-profile-client-id

renaudhartert-db commented Sep 9, 2026 •

edited

Loading

Uh oh!

eng-dev-ecosystem-bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

mihaimitrea-db left a comment

Uh oh!

mihaimitrea-db Sep 10, 2026

Uh oh!

Uh oh!

eng-dev-ecosystem-bot commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

renaudhartert-db commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

Tests

Uh oh!

eng-dev-ecosystem-bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integration test report

Uh oh!

mihaimitrea-db left a comment

Choose a reason for hiding this comment

Uh oh!

mihaimitrea-db Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

eng-dev-ecosystem-bot commented Sep 10, 2026

Integration test report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renaudhartert-db commented Sep 9, 2026 •

edited

Loading

eng-dev-ecosystem-bot commented Sep 9, 2026 •

edited

Loading