Repository navigation
feat: auto-seed a fresh workspace from the global CF login - #49
Merged
Merged
Conversation
A brand-new workspace started empty, so every git worktree forced its own `cf login` (or a manual `cfs import`) even though it is the same user and foundation — producing dozens of per-worktree contexts that each expire independently. runShim now, when a workspace has no CF config yet and a global target is available, imports the global login into the new context before invoking cf (reusing the same cfhome.Import path as `cfs import`). One global login is shared across workspaces; org/space stay per-workspace, and an existing target is never overwritten (only empty workspaces are seeded). The old 'run cfs import' hint remains as a fallback when no global login exists.
Auto-seeding the whole global config also copied the global org/space into a fresh workspace, so a 'cf push' before 'cf target' could hit the wrong org. Add cfhome.ImportSharedAuth, which carries auth + API endpoint but clears OrganizationFields/SpaceFields, and use it for the auto-seed. The workspace is authenticated but untargeted; the caller picks org/space with 'cf target', keeping targets per-workspace while sharing one login.
After the shared-login auto-seed a workspace has credentials + API but no
org/space yet. Report workspace-target as warn ('choose org/space with cf
target') instead of pass 'ready', so doctor stays honest and the E2E that
expects a freshly-seeded workspace to still need a target keeps holding.
govulncheck flags GO-2026-6617 in net/http/internal/http2 at go1.27.1 (reached via updatecheck's http.Client.Do); fixed in go1.27.2. Bump the CI and release Go version so the security scan passes and release binaries use the patched standard library.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
cfs isolates the whole CF home per workspace, so a brand-new workspace starts empty. Because the context ID is keyed on the git-worktree path, every worktree gets its own context and forces its own
cf login(or a manualcfs import) — even though it's the same user and the same foundation. The result is dozens of per-worktree contexts whose tokens expire independently, i.e. "I keep having to log in again in every workspace."Change
runShimnow, when the workspace has no CF config yet and a global target is available, imports the global login into the new context before invokingcf(reusing the samecfhome.Importpath ascfs import). So:cfs global login/CFS_DISABLE=1 cf login) is shared across workspaces — new worktrees inherit it automatically, no re-login, no manualcfs import.cf pushhitting the wrong org). org/space stay per-workspace; only auth is shared.cfs import" hint remains as a fallback when no global login exists.This keeps cfs's per-workspace target isolation while giving the "global auth" behaviour.
Not covered (follow-up)
An already-existing context whose token expired is not re-seeded (it's non-empty), to avoid overwriting its saved target. Re-login once, or
cfs resetit to re-seed. Field-level auth-only merge for existing contexts (preserving target, matching foundation) would need more care and is left as a follow-up.Tests
go build ./...andgo test ./...pass.TestShimSuggestsImportForFreshWorkspaceis replaced byTestShimSeedsFreshWorkspaceFromGlobal, asserting a fresh workspace is auto-seeded (command succeeds against the seeded home, stderr announces the seed) and that a subsequent non-empty run is not re-seeded.