[eng-dev-ecosystem-bot]

Update Databricks CLI to v1.22.1

[github-actions]

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

• PR number: 2270
• Commit SHA: 683b7b57e7074abd3c5cf8d5a238f0541da7231b

Checks will be approved automatically on success.

[rugpanov]

Executive summary — Databricks CLI v1.20.0 → v1.22.1

CLI

• environments setup-local
  • Honors UV_PROJECT_ENVIRONMENT, the same way uv sync does (#7026).
  • Supports uv workspace members: it uses one shared .venv at the workspace root and writes the pins to the root pyproject.toml (#7018).
• Auth
  • auth login --timeout now also applies to the browser OAuth wait (#7103).
  • The 50-workspace limit in the auth login picker is gone, and you can search the picker by name or ID (#7071).
• SSH: ssh connect fails fast with the workspace's reason when serverless port forwarding is disabled (#7057).
• AI tools
  • aitools install installs the latest skills and no longer downgrades them automatically (#7069).
  • 1.22.1 pins skills to 0.2.32 to avoid GitHub API rate limits (#7159).
• Pipelines: pipelines history accepts pipeline IDs, and pipelines show hints how to preview more rows (#6995).
• AI Runtime (air run): shorter preflight (#6994, #7153) and container-name validation that matches the backend (#7154).

Bundles

• Deploy reliability
  • File uploads use the multipart workspace/import endpoint, which has a higher rate limit (#6149).
  • deploy, sync and destroy retry transient 5xx/408/REFUSED_STREAM errors on uploads, get-status, lock release and state reads (#7014, #7044, #7129).
• Bind/unbind
  • Fix: deployment bind no longer silently binds over a deployment state it could not read (#6331).
  • bind and unbind accept type.key, e.g. jobs.foo (#7128).
• Config semantics
  • Zero-value overrides of presets, lifecycle.prevent_destroy and deployment in includes now replace non-zero base values. bundle validate -o json shows explicit zero presets (#7117).
  • Job paths resolve correctly: relative .env files in environment_variables[].spec.files (#6985) and project_environment relative to the YAML file that defines it (#6983).
• experimental.immutable_folder fixes: works with mode: development (#7027), with deployment_history, and with top-level permissions (#7001).
• New: a features resource type (#6952) and an app-appkit template (#7004, #7007).
• New env var: DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH requires a target's host and workspace ID to match exactly one profile (#7109).
• Diagnostics
  • Paths quote map keys that are not identifiers (#6980).
  • The compute_id deprecation warning shows targets.<name>.compute_id (#7048).
  • Fixed a false sync.include/sync.exclude warning when sync.paths is outside the bundle root (#7122).
• Other fixes: Terraform migration with references to resources that were never deployed (#7157). Templates no longer ship CLAUDE.md (#7000).

Dependency updates

• Go 1.26.9 → 1.27.3 (#6996, #7052, #7116). Release binaries now require macOS 13 Ventura or later.
• Go SDK 0.188.0 → 0.189.0 (#7038, #7138), plus bumps for dependencies with known vulnerabilities (#7083).

What could be integrated into the VS Code extension experience

Ordered by value for the effort, highest first.

1. The uv workspace support already in main needs this bump. (no new work; this is a prerequisite)

   • fix(python-setup): select the shared uv workspace venv for a workspace member #2253 and fix(python-setup): recover a uv workspace member from a constraint conflict #2254 read uvWorkspaceRoot and uvWorkspaceBackupPath (PythonSetupResult.ts:122-136).
   • They use those fields in the setup summary (setupSummary.ts:24, :84-116) and in the "Retry DB Connect setup" restore (PythonSetupEnvironmentSetup.ts:806).
   • Only CLI ≥ 1.21 (#7018, #7026) emits these fields. With the bundled 1.20.0 (package.json:1973), the member path never runs.
   • Contributors must re-run yarn workspace databricks run package:cli:fetch. The drift warning at CliWrapper.ts:1427-1444 (called from extension.ts:541) reports a stale binary.

2. Check AI tools update detection against the 1.22.1 skills pin. (possible cleanup; needs a check)

   • AiToolsManager.ts:72-80 flags updateAvailable when the installed version is not equal to latest_version. It does not check for "less than".
   • On activation, initialize() then runs an update silently (AiToolsManager.ts:322-324).
   • 1.22.1 pins skills to 0.2.32 (#7159), and 1.22.0 blocks automatic downgrades (#7069). If aitools list reports the pin as latest_version while newer skills are installed, the extension can show "update available" and run a no-op update on every load.
   • Before merge, check what aitools list --output json (CliWrapper.ts:947-951) returns in that state. If needed, compare versions semver-aware.

3. SSH: errors for disabled serverless port forwarding. (free with the bump)

   • The extension runs ssh connect --ide=… --auto-approve with no --cluster for serverless (CliWrapper.ts:153-166) in a terminal (SshCommands.ts:174-190).
   • With #7057, the terminal shows the workspace's reason immediately, instead of after the server start timeout.
   • Optional small follow-up: catch that message and show it as an in-editor notification, like the warnIfHostCliMissing hint.

4. The OAuth login timeout now works. (free with the bump; the comment can be cleaned up)

   • DatabricksCliCheck.ts:150-152 already passes --timeout 300s (:32) so that a stuck browser flow (e.g. WSL) fails fast.
   • Before #7103, the CLI ignored that flag for the browser wait. With this bump, the existing code does what its comment says.
   • The fallback message at :161-174 now really shows up after 5 minutes.

5. Bundle deploy/sync/destroy are more robust. (free with the bump)

   • The extension runs bundle deploy, bundle destroy, bundle sync and bundle sync --watch (CliWrapper.ts:687-698, :1206, :1249, :1289).
   • Users get the new upload endpoint and the transient-error retries (#6149, #7014, #7044, #7129) with no code change. This should reduce flaky deploy and sync failures.

6. The features resource in YAML autocomplete works now. Regenerating BundleSchema.ts is optional.

   • YAML validation and autocomplete load bundle schema live from the bundled binary (bundleAutocompleteProvider.ts:13, CliWrapper.ts:800-806). Editors pick up features (#6952) right away.
   • The checked-in TS types do not have it: Resources in BundleSchema.ts:286-336 has no features.
   • yarn package:bundle-schema:write (package.json:1989) regenerates the types. That is optional cleanup.
   • Showing features in the resource explorer is net-new UI work: a tree node plus an entry in types.ts:36-50.

7. The app-appkit template appears without changes. (free with the bump; a shortcut would be net-new)

   • BundleInitWizard runs the interactive bundle init in a terminal with no template argument (BundleInitWizard.ts:199-204). The new template (#7004) is in the CLI's own picker.
   • A "New Databricks App" shortcut that passes the template name would be net-new.
   • Templates no longer ship CLAUDE.md (#7000). The extension does not depend on that file.

8. DATABRICKS_BUNDLE_STRICT_PROFILE_MATCH. (net-new; low priority)

   • Bundle commands get DATABRICKS_HOST and DATABRICKS_CONFIG_PROFILE from authProvider.toEnv() (AuthProvider.ts:256-259, merged in CliWrapper.ts:983-987).
   • The extension does not set the new variable. Turning it on would add a guard against an ambiguous profile choice. But because the extension already passes an explicit profile, a setting for it would add little for now.

No change needed in the extension:

• compute_id warning path (#7048): the extension reads bundle.compute_id ?? bundle.cluster_id from the validate JSON (BundleValidateModel.ts:107-109) and does not parse warning text.
• Quoted diagnostic paths (#6980): no src code parses CLI diagnostic paths. The CLI output only appears in the output channel (CliWrapper.ts:1053).
• auth login picker limit and search (#7071): the extension always passes --host (DatabricksCliCheck.ts:146), so it never opens the account workspace picker.
• Bind/unbind (#6331, #7128): no src code calls bundle deployment bind or unbind. A "Bind to existing resource" action in the bundle explorer would be net-new.
• pipelines history/show (#6995): the pipeline run status and table pickers use the SDK (pipelines.getUpdate/listUpdates/listPipelineEvents in PipelineRunStatus.ts:101 and BundlePipelinesManager.ts:331), not these commands.
• Config semantics and path fixes: immutable_folder, zero-value overrides, .env/project_environment paths, the sync.paths warning and the Terraform migration are all inside the CLI (#7001, #7027, #7117, #6985, #6983, #7122, #7157).
• AI Runtime air run changes (#6994, #7153, #7154): no src code runs air.
• Go SDK and toolchain bumps: nothing to do in the extension, except for the platform floor. The bundled CLI needs macOS 13 Ventura or later (#7052), so on macOS 12 and older the extension will not activate. The extension has no OS-version check, so mention this in the release notes or CHANGELOG.

_{🤖 Auto-generated executive summary of the CLI v1.20.0 → v1.22.1 changelog. Integration notes are opportunities, not commitments — verify before acting.}