[eng-dev-ecosystem-bot]

Update Databricks CLI to v1.22.0

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

• PR number: 2269
• Commit SHA: 034c6ba75641b3e562d00bdcb80f105f664af320

Checks will be approved automatically on success.

[rugpanov]

Executive summary — Databricks CLI v1.20.0 → v1.22.0

CLI

• databricks environments setup-local:
  • Supports uv workspace members. It uses the shared .venv at the workspace root and writes the constraints to the root pyproject.toml. (#7018)
  • Uses UV_PROJECT_ENVIRONMENT when it is set, the same as uv sync. (#7026)
• auth login:
  • --timeout now also applies to the browser login. Before, it waited for the OAuth redirect with no limit. (#7103)
  • The 50-workspace limit is removed. You can now search workspaces by name or ID. (#7071)
• ssh connect fails immediately with the workspace's reason when port forwarding to serverless compute is disabled. Before, it waited until the server start timeout. (#7057)
• aitools install no longer overwrites newer skills with an older pinned release. It installs the latest published skills and prevents automatic downgrades. (#7069)
• pipelines history accepts pipeline IDs. pipelines show gives a hint for previewing more rows. (#6995)
• AI Runtime (air run): shorter preflight validation, a faster submit (it only fetches the user name from SCIM), and container name validation that matches the backend. (#6994, #7153, #7154)

Bundles

• Reliability:
  • bundle deploy, bundle sync and sync retry transient 5xx/408 errors on uploads. (#7014)
  • They also retry the get-status path check, including on HTTP/2 REFUSED_STREAM. (#7044)
  • deploy and destroy retry more transient errors, including the lock release and state reads. (#7129)
  • File uploads use the multipart workspace/import endpoint, which has a higher rate limit. (#6149)
• Bind/unbind:
  • bundle deployment bind no longer binds silently over deployment state that it cannot read. (#6331)
  • bind and unbind accept type.key, e.g. jobs.foo. (#7128)
• New:
  • DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH requires a target's host and workspace ID to match exactly one profile. (#7109)
  • New features resource type. (#6952)
  • New app-appkit template. (#7004, #7007)
• Config semantics:
  • In includes, zero-value overrides of presets, lifecycle.prevent_destroy and deployment now replace non-zero base values. bundle validate -o json shows explicit zero presets. (#7117)
  • Relative .env paths in a job's environment_variables[].spec.files are translated to their deployed workspace locations. (#6985)
  • A job's project_environment paths resolve relative to the YAML file that defines them. (#6983)
• Fixes:
  • experimental.immutable_folder now works with mode: development (#7027), with deployment_history, and with top-level permissions (#7001).
  • Migration from Terraform no longer fails on a reference to a resource that was never deployed. (#7157)
  • bundle validate no longer gives a false sync.include/sync.exclude warning when sync.paths is outside the bundle root. (#7122)
• Diagnostics and templates:
  • Diagnostic paths now quote map keys that are not identifiers. (#6980)
  • The compute_id deprecation warning shows the full targets.<name>.compute_id path. (#7048)
  • Templates no longer include CLAUDE.md. (#7000)

Dependency updates

• Go 1.27.2 → toolchain 1.27.3. Release binaries now require macOS 13 Ventura or later. (#7052, #7116, #6996)
• Go SDK 0.188.0 → v0.189.0. (#7038, #7138)
• Dependencies with known vulnerabilities are bumped. (#7083)

What could be integrated into the VS Code extension experience

1. Already built, turned on by this bump (no new code, verify only)

uv workspace members and UV_PROJECT_ENVIRONMENT in setup-local (#7018, #7026)

• The extension already reads the new result fields. See uvWorkspaceRoot, uvWorkspaceBackupPath, and the venvPath doc about ../../.venv and an absolute UV_PROJECT_ENVIRONMENT (src/python-setup/models/PythonSetupResult.ts:123-136).
• resolveVenvDir already resolves a climbing or absolute venvPath (src/python-setup/controllers/PythonSetupEnvironmentSetup.ts:773-785).
• The success summary already has workspace-root text (src/python-setup/utils/setupSummary.ts:24, :84, :108).
• This code came in fix(python-setup): select the shared uv workspace venv for a workspace member #2253 and fix(python-setup): recover a uv workspace member from a constraint conflict #2254 (the two most recent python-setup commits). It sits unused with the bundled v1.20.0, because that CLI never sends these fields.
• process.env is the base of the spawn env (src/extension.ts:1305-1308). So a user's UV_PROJECT_ENVIRONMENT gets to the CLI with no change.
• Action: manually test on a uv workspace member and on a project that sets UV_PROJECT_ENVIRONMENT. No code is needed.

auth login --timeout now applies to the browser flow (#7103)

• The extension already passes --timeout 300s (src/configuration/auth/DatabricksCliCheck.ts:32, :150-152). The comment says the purpose is "so a non-completing OAuth flow (e.g. WSL) fails fast".
• Before v1.22.0, the CLI ignored this flag for the browser wait. The fallback that shows the manual command (DatabricksCliCheck.ts:161+) only ran when the user cancelled.
• Action: none. This bump makes the existing intent work. Do a short WSL or no-browser test to confirm that the fallback message now shows after 5 minutes.

2. Transparent improvements (no action)

• Sync and deploy retries, multipart upload (#7014, #7044, #7129, #6149): the extension runs bundle sync --watch --output json (src/cli/CliWrapper.ts:687-700) and runs deploy through the CLI. Fewer transient failures will show up in the sync and deploy flows. No code changes.
• ssh connect fast failure (#7057): the extension sends the command to a terminal (src/ssh/SshCommands.ts:485-506, args from src/cli/CliWrapper.ts:152-166). The user sees the workspace's reason in that terminal. The extension does not parse the output, so nothing changes in code.
• aitools install downgrade fix (#7069): this is a CLI-side fix. The extension calls aitools install and list (src/cli/CliWrapper.ts:848-856). One item to check: computeUpdateStatus sets "update available" when the installed version is not equal to latest_version (src/aitools/AiToolsManager.ts:78). Confirm that aitools list in v1.22.0 still reports latest_version as the published latest. If it does not, a newer-than-pinned install can show a false "update available" badge.
• auth login workspace picker (#7071): no effect. The extension always passes --host (DatabricksCliCheck.ts:146), so the picker never shows.
• Bundle semantics fixes (#6985, #6983, #7117, #7027, #7001, #7122, #7157, #6331): these are CLI-side. BundleValidateModel reads bundle.compute_id from the validate JSON (src/bundle/models/BundleValidateModel.ts:108). It does not read presets or prevent_destroy anywhere outside the generated schema. So the change to zero-value overrides does not affect the extension's logic.
• Diagnostic path quoting and compute_id warning text (#6980, #7048): the extension does not parse bundle diagnostic paths. Its Diagnostics come from pipeline events (src/bundle/BundlePipelinesManager.ts:225-245). No effect.
• app-appkit template, no CLAUDE.md in templates (#7004, #7007, #7000): BundleInitWizard runs interactive bundle init in a terminal (src/bundle/BundleInitWizard.ts:199-212). The new template shows in the CLI's picker with no extension change.
• pipelines history/show, all air run items, Go SDK and vulnerability bumps: the extension does not use these. It reads pipeline updates through the JS SDK (client.pipelines.listUpdates, src/bundle/BundlePipelinesManager.ts:331). No action.

3. Small cleanup (low effort)

Regenerate BundleSchema.ts for the features resource (#6952)

• ResourcesClass (src/bundle/BundleSchema.ts:282+) is generated by package:bundle-schema:write (packages/databricks-vscode/package.json:1989). It does not have features.
• Run yarn workspace databricks run package:bundle-schema:write after the bump. This keeps the typed model current.
• A features resource will not show in the resource explorer. KNOWN_RESOURCE_TYPES is only jobs and pipelines (src/ui/bundle-resource-explorer/types.ts:36-39). The resource also has no icon entry. Showing it is a separate, optional change (see item 5).

4. Release-note item (no code, but we must communicate it)

The CLI binary needs macOS 13 Ventura or later (#7052)

• The extension ships the CLI in darwin-x64 and darwin-arm64 VSIXes (packages/databricks-vscode/scripts/package-vsix.sh:16-22). It does not check the OS version. engines is only vscode ^1.104.0 and node >=22.0 (package.json:8-11).
• On macOS 12 or older, the bundled CLI will not start. Then extension activation fails, and the configuration view stays on "Initializing...".
• Action: add a line to the extension changelog. As an option, add a friendly error when the CLI spawn fails on old macOS. That error is net-new work.

5. Net-new feature work (only if there is demand)

• Strict profile match for bundle commands (#7109): getBundleCommandEnvVars (src/cli/CliWrapper.ts:968+) is the one place to set DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH. The extension already puts much effort into stopping the CLI from authenticating against the wrong profile (comments at CliWrapper.ts:984-999, src/bundle/models/BundleRemoteStateModel.ts:85, src/bundle/models/BundleValidateModel.ts:83).
  • The code change is one line. But turning it on is a behavior change: today, ambiguous configs work, and with the flag they fail. It needs an error UX and tests.
  • Do it as an opt-in setting first, or as defense in depth in normal mode only. Remote mode already forces a missing config file.
• Bind/unbind from the resource explorer (#6331, #7128): the extension does not call bundle deployment bind or unbind. A grep finds no "bind"/"unbind" args. The new type.key form and the safer bind make a "Bind to existing resource…" tree action practical. That is net-new work: a command, a picker for the remote resource ID, and when-clauses on BundleCommands (src/ui/bundle-resource-explorer/BundleCommands.ts).
• Show features resources in the explorer (#6952): add features to the explorer types, plus a tree node and an icon. This is net-new UI work. The value is low until users use the resource type.

_{🤖 Auto-generated executive summary of the CLI v1.20.0 → v1.22.0 changelog. Integration notes are opportunities, not commitments — verify before acting.}