From a4bb8c01e6247f9c22c31fa5582f6d20f7d9b743 Mon Sep 17 00:00:00 2001 From: Shreyas Goenka Date: Thu, 20 Aug 2026 08:01:00 +0000 Subject: [PATCH 1/4] apps: stop planning an update on every deploy The backend enables user access token forwarding and reports forward_user_access_token as true even when the bundle omits it. The field became part of apps.App in databricks-sdk-go v0.171.0 and was added to the app update mask, but nothing classified it, so the direct engine read the remote true as drift: every plan reported "action": "update" with a remote value and no local one, and every deploy issued a no-op Apps update call. Declare it under backend_defaults, matching compute_size: the remote value is skipped when the config omits the field, while an explicit value in the config still diffs normally. The fake workspace did not model this default, which is why the regression reached the nightly integration tests instead of failing here. It now reports the field the way the platform does, which reproduces the spurious update without the fix. Co-authored-by: Isaac --- .nextchanges/bundles/apps-forward-user-access-token-drift.md | 1 + .../bundle/resources/apps/create_already_exists/output.txt | 1 + bundle/direct/dresources/resources.yml | 4 ++++ libs/testserver/apps.go | 4 ++++ 4 files changed, 10 insertions(+) create mode 100644 .nextchanges/bundles/apps-forward-user-access-token-drift.md diff --git a/.nextchanges/bundles/apps-forward-user-access-token-drift.md b/.nextchanges/bundles/apps-forward-user-access-token-drift.md new file mode 100644 index 00000000000..72744a95c72 --- /dev/null +++ b/.nextchanges/bundles/apps-forward-user-access-token-drift.md @@ -0,0 +1 @@ +Fixed apps planning an update on every deploy. The backend enables `forward_user_access_token` and reports it as `true` even when the bundle omits it, which the direct engine read as drift and turned into a no-op update call on each deploy. diff --git a/acceptance/bundle/resources/apps/create_already_exists/output.txt b/acceptance/bundle/resources/apps/create_already_exists/output.txt index 2e7f067fe1f..9619e49ef8a 100644 --- a/acceptance/bundle/resources/apps/create_already_exists/output.txt +++ b/acceptance/bundle/resources/apps/create_already_exists/output.txt @@ -19,6 +19,7 @@ "state": "ACTIVE" }, "default_source_code_path": "/Workspace/Users/[USERNAME]/test-app-already-exists", + "forward_user_access_token": true, "id": "1000", "name": "test-app-already-exists", "service_principal_client_id": "[UUID]", diff --git a/bundle/direct/dresources/resources.yml b/bundle/direct/dresources/resources.yml index 0bc65b0a660..ce0564ddc8a 100644 --- a/bundle/direct/dresources/resources.yml +++ b/bundle/direct/dresources/resources.yml @@ -555,6 +555,10 @@ resources: backend_defaults: # Backend sets it "MEDIUM" when not specified in the config - field: compute_size + # Backend enables token forwarding and reports true even when the config omits it, + # so an omitted field would otherwise plan an update on every deploy. An explicit + # value in the config still diffs normally. + - field: forward_user_access_token # lifecycle.started is derived from remote compute status in RemapState, so the # remote side always has a value. When the user omits lifecycle from config, # both old and new are nil and backend_defaults correctly skips the remote value. diff --git a/libs/testserver/apps.go b/libs/testserver/apps.go index e767584e6ec..6b7b5d4190f 100644 --- a/libs/testserver/apps.go +++ b/libs/testserver/apps.go @@ -329,6 +329,10 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response { app.ComputeSize = "MEDIUM" } + // The platform enables user access token forwarding regardless of what the + // request asked for, so the remote always reports true. + app.ForwardUserAccessToken = true + // Assign a service principal to the app, mimicking the real platform. if app.ServicePrincipalClientId == "" { app.ServicePrincipalClientId = nextUUID() From 83fb4d38efeef9f8d48e9a11ed37a24e22ae8198 Mon Sep 17 00:00:00 2001 From: Shreyas Goenka Date: Thu, 20 Aug 2026 08:02:05 +0000 Subject: [PATCH 2/4] changelog: link PR #6328 Co-authored-by: Isaac --- .nextchanges/bundles/apps-forward-user-access-token-drift.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.nextchanges/bundles/apps-forward-user-access-token-drift.md b/.nextchanges/bundles/apps-forward-user-access-token-drift.md index 72744a95c72..2f72119fab4 100644 --- a/.nextchanges/bundles/apps-forward-user-access-token-drift.md +++ b/.nextchanges/bundles/apps-forward-user-access-token-drift.md @@ -1 +1 @@ -Fixed apps planning an update on every deploy. The backend enables `forward_user_access_token` and reports it as `true` even when the bundle omits it, which the direct engine read as drift and turned into a no-op update call on each deploy. +Fixed apps planning an update on every deploy. The backend enables `forward_user_access_token` and reports it as `true` even when the bundle omits it, which the direct engine read as drift and turned into a no-op update call on each deploy ([#6328](https://github.com/databricks/cli/pull/6328)). From e80d1aab8ca5f4aafa42566a98bbe60386538ddc Mon Sep 17 00:00:00 2001 From: Shreyas Goenka Date: Thu, 20 Aug 2026 08:21:23 +0000 Subject: [PATCH 3/4] acc: record forward_user_access_token in the remaining app goldens The fake workspace now reports the field, so the two goldens that dump raw app state (bundle generate and the apps command output) include it. Co-authored-by: Isaac --- acceptance/bundle/generate/app_not_yet_deployed/output.txt | 1 + acceptance/cmd/workspace/apps/output.txt | 2 ++ 2 files changed, 3 insertions(+) diff --git a/acceptance/bundle/generate/app_not_yet_deployed/output.txt b/acceptance/bundle/generate/app_not_yet_deployed/output.txt index 5742aab1b58..8ac4f1220c5 100644 --- a/acceptance/bundle/generate/app_not_yet_deployed/output.txt +++ b/acceptance/bundle/generate/app_not_yet_deployed/output.txt @@ -10,6 +10,7 @@ "message": "App compute is stopped.", "state": "STOPPED" }, + "forward_user_access_token": true, "id": "1000", "name": "my-app", "service_principal_client_id": "[UUID]", diff --git a/acceptance/cmd/workspace/apps/output.txt b/acceptance/cmd/workspace/apps/output.txt index 16da8b36097..7b8e7e4a2df 100644 --- a/acceptance/cmd/workspace/apps/output.txt +++ b/acceptance/cmd/workspace/apps/output.txt @@ -21,6 +21,7 @@ }, "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name", "description": "My app description.", + "forward_user_access_token": true, "id": "1000", "name": "test-name", "resources": [ @@ -62,6 +63,7 @@ }, "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name", "description": "My app description.", + "forward_user_access_token": true, "id": "1001", "name": "test-name", "resources": [ From 5e44f762efcc58d329ccf5c4647fcb9211c4c7ca Mon Sep 17 00:00:00 2001 From: Shreyas Goenka Date: Thu, 20 Aug 2026 08:51:14 +0000 Subject: [PATCH 4/4] Drop the changelog fragment The regression it described has not shipped in a release, so there is nothing user-visible to announce. Co-authored-by: Isaac --- .nextchanges/bundles/apps-forward-user-access-token-drift.md | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .nextchanges/bundles/apps-forward-user-access-token-drift.md diff --git a/.nextchanges/bundles/apps-forward-user-access-token-drift.md b/.nextchanges/bundles/apps-forward-user-access-token-drift.md deleted file mode 100644 index 2f72119fab4..00000000000 --- a/.nextchanges/bundles/apps-forward-user-access-token-drift.md +++ /dev/null @@ -1 +0,0 @@ -Fixed apps planning an update on every deploy. The backend enables `forward_user_access_token` and reports it as `true` even when the bundle omits it, which the direct engine read as drift and turned into a no-op update call on each deploy ([#6328](https://github.com/databricks/cli/pull/6328)).