Migrate bundle state filer read off workspace-files to /workspace/export - #6219
Open
Sankalp-Mittal wants to merge 3 commits into
Open
Migrate bundle state filer read off workspace-files to /workspace/export#6219Sankalp-Mittal wants to merge 3 commits into
Sankalp-Mittal wants to merge 3 commits into
Conversation
Collaborator
Integration test reportCommit: b11f1be
8 interesting tests: 4 RECOVERED, 4 SKIP
Top 4 slowest tests (at least 2 minutes):
|
Sankalp-Mittal
changed the title
Sankalp-Mittal
force-pushed
the
sankalp-mittal/workspace-import-migration
branch
from
August 12, 2026 13:25
2a99228 to
af88c8f
Compare
Co-authored-by: Isaac
…tion filer.go now reads state via /api/2.0/workspace/export (a2946f2b7); regenerate the acceptance goldens to match. Note: state/basic and force_pull_commands filter captured requests on the old workspace-files path, so their goldens are now empty and their state-read assertions need the filters repointed at /workspace/export (follow-up). Co-authored-by: Isaac
Sankalp-Mittal
force-pushed
the
sankalp-mittal/workspace-export-migration
branch
from
August 12, 2026 13:46
291eb0a to
b11f1be
Compare
Sankalp-Mittal
changed the base branch from
sankalp-mittal/workspace-import-migration
to
main
August 12, 2026 13:46
Sankalp-Mittal
marked this pull request as ready for review
August 12, 2026 13:52
shreyas-goenka
approved these changes
Aug 13, 2026
| // Read via the raw apiClient.Do (not the SDK's Workspace.Download) so | ||
| // auth.WorkspaceIDHeaders can drop the CLI-only "none" workspace-id sentinel | ||
| // that Download would send literally. See PR #6149 for the write-path equivalent. | ||
| urlPath := "/api/2.0/workspace/export?path=" + url.QueryEscape(absPath) + "&direct_download=true" |
Contributor
There was a problem hiding this comment.
Why can't we use the SDK again here? I don't follow the point about auth.WorkspaceIDHeaders. Can we make this comment clearer?
Contributor
There was a problem hiding this comment.
Is it because the streaming endpoint is not accessible via the SDK?
Collaborator
Author
There was a problem hiding this comment.
no the issue is only when the during auth login the --skip-workspace flag is passed, this causes WorkspaceID = "none" to be passed (which I could handle separately, but I wanted to keep the code change as small as possible)
Collaborator
Author
There was a problem hiding this comment.
Can check out libs/auth/arguments.go:8 for definition of this sentinel
shreyas-goenka
requested changes
Aug 13, 2026
shreyas-goenka
left a comment
shreyas-goenka
left a comment
Contributor
There was a problem hiding this comment.
Sorry, did not mean to approve the PR. The current PR is good but please lets clarify why SDK is not usable here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bundle: read deploy state via /workspace/export instead of deprecated workspace-files API
Summary
The DABs state filer (
bundle/deploy/filer.go,stateFiler.Read) reads bundle state files(
terraform.tfstate,resources.json) from the workspace. It did this with a rawGET /api/2.0/workspace-files/{path}. This PR switches that read to the officially supportedGET /api/2.0/workspace/export?path=<path>&direct_download=true.Why
context-based ingress (CBI) with fine-grained scoped tokens, it was only reachable via the
all_apismaster scope, sobundle deployreturned 403s for customers on least-privilege scopedtokens.
/workspace/exportis properly scoped, so state reads now work underleast-privilege auth.
Key detail:
direct_download=truePlain
/workspace/exportreturns base64 JSON capped at 10 MB — too small for large state files,which is exactly why the workaround existed.
direct_download=trueselects the streaming variant(500 MB for regular files), so large state files stream through fine. This flag is load-bearing:
without it the migration would regress large-state deploys.
Testing
GET /api/2.0/workspace/exportwithdirect_download=truein place of theworkspace-filesreads (user_agent,statesuites).correctly) is in progress — not yet confirmed end-to-end.
This pull request and its description were written by Isaac.