Merge branch 'databricks:main' into main

Author: benberryallwood

.codegen.json

@@ -0,0 +1 @@
+9ce12048f2c4a4fefb93fc3f55cba9c9798f9cb6

.codegen/_last_sha

@@ -1 +1 @@
-c23b88b906c9d262245e50038211199037d2ee9a
+9ce12048f2c4a4fefb93fc3f55cba9c9798f9cb6

.codegen/_openapi_sha

@@ -1,16 +1,22 @@
 databricks/sdk/__init__.py linguist-generated=true
 databricks/sdk/errors/overrides.py linguist-generated=true
 databricks/sdk/errors/platform.py linguist-generated=true
+databricks/sdk/service/__init__.py linguist-generated=true
+databricks/sdk/service/_internal.py linguist-generated=true
 databricks/sdk/service/agentbricks.py linguist-generated=true
+databricks/sdk/service/aisearch.py linguist-generated=true
 databricks/sdk/service/apps.py linguist-generated=true
 databricks/sdk/service/billing.py linguist-generated=true
+databricks/sdk/service/bundle.py linguist-generated=true
+databricks/sdk/service/bundledeployments.py linguist-generated=true
 databricks/sdk/service/catalog.py linguist-generated=true
 databricks/sdk/service/cleanrooms.py linguist-generated=true
 databricks/sdk/service/compute.py linguist-generated=true
 databricks/sdk/service/dashboards.py linguist-generated=true
 databricks/sdk/service/database.py linguist-generated=true
 databricks/sdk/service/dataclassification.py linguist-generated=true
 databricks/sdk/service/dataquality.py linguist-generated=true
+databricks/sdk/service/disasterrecovery.py linguist-generated=true
 databricks/sdk/service/environments.py linguist-generated=true
 databricks/sdk/service/files.py linguist-generated=true
 databricks/sdk/service/httpcallv2.py linguist-generated=true

.gitattributes

@@ -0,0 +1,33 @@
+# This repository is a read-only mirror; the only PRs that should
+# merge are the release sync PRs from the internal source of truth.
+# This check fails unless the PR carries the `sync` label, which only
+# maintainers can apply — making every merge a deliberate act.
+# Temporary guard until release automation takes over merging.
+name: Sync label
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  # The label gate runs at PR level — a PR can't enter the merge queue
+  # until this check passes there. Merge-group events carry no label
+  # context, so on them the job passes trivially; without this trigger
+  # a required sync-label check would stall every queue entry.
+  merge_group:
+    types: [checks_requested]
+
+jobs:
+  sync-label:
+    name: sync-label
+    runs-on: ubuntu-latest
+    steps:
+      - name: Merge queue — gate already applied at PR level
+        if: ${{ github.event_name == 'merge_group' }}
+        run: echo "merge group — sync label was enforced when the PR entered the queue."
+      - name: Require the `sync` label
+        if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'sync') }}
+        run: |
+          echo "::error::This PR does not carry the 'sync' label. This repository is a read-only mirror — only release sync PRs merge here. If this IS a release sync PR, a maintainer must apply the 'sync' label; community contributions are re-applied in the internal repository instead (see CONTRIBUTING.md)."
+          exit 1
+      - name: Label present
+        if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'sync') }}
+        run: echo "sync label present — this is a release sync PR."

.github/workflows/next-changelog.yml

@@ -4,7 +4,12 @@ name: tagging
 on:
   # Manual dispatch.
   workflow_dispatch:
-    # No inputs are required for the manual dispatch.
+    inputs:
+      packages:
+        description: 'Comma-separated list of packages to tag (e.g. "pkg1,pkg2"). Leave empty to tag all packages with pending releases.'
+        required: false
+        type: string
+        default: ''
 
   # NOTE: Temporarily disable automated releases.
   #
@@ -30,6 +35,15 @@ jobs:
       github.repository == 'databricks/databricks-sdk-go' ||
       github.repository == 'databricks/databricks-sdk-py' ||
       github.repository == 'databricks/databricks-sdk-java'
+    env:
+      # Ref the release is cut from. Releasing from a branch is currently
+      # supported in the terraform repository only: for
+      # terraform-provider-databricks this follows the dispatched branch
+      # (``github.ref_name``), so a release can be cut from a branch other
+      # than main; every other synced repo (SDK go/py/java, …) stays pinned
+      # to main, preserving the pre-existing hardcoded-main behaviour and
+      # blocking branch releases even via a manual non-main dispatch.
+      RELEASE_REF: ${{ github.repository == 'databricks/terraform-provider-databricks' && github.ref_name || 'main' }}
     environment: "release-is"
     runs-on:
       group: databricks-protected-runner-group
@@ -45,6 +59,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          # Check out the release ref. ``RELEASE_REF`` is the dispatched
+          # branch for terraform-provider-databricks and ``main`` for every
+          # other repo (see the job-level ``env``). For scheduled runs and
+          # manual dispatches left at defaults this is the default branch
+          # (main); dispatching terraform with ``--ref <branch>`` cuts the
+          # release from that branch instead.
+          #
+          # Naming the ref explicitly (rather than omitting ``ref:``)
+          # forces re-resolution of the branch head at step time. Without
+          # it, checkout pins to ``github.sha`` — the SHA frozen at
+          # workflow_dispatch time — so re-running a stale dispatch would
+          # check out an older commit even when newer ones exist.
+          ref: ${{ env.RELEASE_REF }}
           fetch-depth: 0
           token: ${{ steps.generate-token.outputs.token }}
 
@@ -55,17 +82,29 @@ jobs:
           git config user.email "DECO-SDK-Tagging[bot]@users.noreply.github.com"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
       - name: Run script
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-        run: uv run --locked tagging.py
+          PACKAGES: ${{ inputs.packages }}
+          # Branch the release is cut from. tagging.py commits the
+          # changelog bump and creates the tag on this branch, and its
+          # concurrent-advance guard checks this branch. Matches the ref
+          # checked out above (``RELEASE_REF``): the dispatched branch for
+          # terraform, main everywhere else.
+          DECO_TAGGING_REF: ${{ env.RELEASE_REF }}
+        run: |
+          if [ -n "$PACKAGES" ]; then
+            uv run --locked tagging.py --package "$PACKAGES"
+          else
+            uv run --locked tagging.py
+          fi
 
       - name: Upload created tags artifact
         if: always()
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: created-tags
           path: created_tags.json

.github/workflows/sync-label.yml

@@ -10,4 +10,5 @@ __pycache__
 databricks-sdk-py.iml
 .databricks
 .coverage
-htmlcov
+htmlcov
+pyrefly.toml

.github/workflows/tagging.yml

@@ -1,3 +1,3 @@
 {
-    "timestamp": "2026-04-23 08:51:37+0000"
+    "timestamp": "2026-06-10 06:11:05+0000"
 }