Repository navigation
fix(no-ticket): bake the Workspace and API host into the Terraform helper - #488
Open
cloudsmith-iduffy wants to merge 5 commits into
Open
cloudsmith-iduffy wants to merge 5 commits into
cloudsmith-iduffy wants to merge 5 commits into
Conversation
cloudsmith-iduffy
force-pushed
the
iduffy/v2-workspace-domains
branch
from
October 15, 2026 16:28
d0e491f to
78a2ab3
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/terraform-helper-workspace
branch
from
October 15, 2026 16:28
10f0a31 to
7924d85
Compare
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused changes have regression coverage and no identified blocking issues; tests were inspected but not executed.
0 open findings
What changed in this PR
Preserves the Workspace and API host when Terraform launches the credentials helper, supporting the domain discovery introduced in #476.
Changes:
- Persists
-wand configured--api-hostin helper arguments. - Adds missing-Workspace guidance and updates terminology.
- Adds regression coverage while retaining
--orgcompatibility.
| File | Description |
|---|---|
| cloudsmith_cli/credential_helpers/terraform/terraformrc.py | Updates the argument documentation example. |
| cloudsmith_cli/credential_helpers/terraform/runtime.py | Updates the missing-Workspace error. |
| cloudsmith_cli/credential_helpers/terraform/installer.py | Updates installer documentation examples. |
| cloudsmith_cli/cli/tests/test_credential_helper_terraform.py | Checks Workspace error guidance. |
| cloudsmith_cli/cli/tests/test_credential_helper_terraform_installer.py | Covers persisted arguments, aliases, and guidance. |
| cloudsmith_cli/cli/commands/credential_helper/terraform.py | Updates CLI help terminology and examples. |
| cloudsmith_cli/cli/commands/credential_helper/manage.py | Persists configuration and adds Workspace guidance. |
| CHANGELOG.md | Documents the Terraform helper fixes. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
cloudsmith-iduffy
force-pushed
the
iduffy/v2-workspace-domains
branch
from
October 15, 2026 17:07
78a2ab3 to
3a6e200
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/terraform-helper-workspace
branch
from
October 15, 2026 17:08
7924d85 to
7f6dce3
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/v2-workspace-domains
branch
from
October 15, 2026 17:22
3a6e200 to
d948a88
Compare
cloudsmith-iduffy
force-pushed
the
iduffy/terraform-helper-workspace
branch
from
October 15, 2026 17:22
7f6dce3 to
1c38e5b
Compare
The CLI kept a table of Cloudsmith hostnames. That table pinned the CLI
to the production hosts. The CLI now gets the domains of a Workspace
from GET /v2/workspaces/{workspace}/domains/ on the configured API host.
The answer includes the Cloudsmith-owned hosts, in preference order.
- Remove the built-in hostname table and the [domains] section in
config.ini.
- Keep version 1 of the domains list JSON document. Set primary and
created_at to null, because the API does not give them.
- Without a Workspace, domains list uses the cached domains. If no
domains are cached, it gets the domains of a Workspace that the
credential is a member of.
- Name the domain cache after the full API base URL, so two deployments
on one hostname do not share a cache.
- Put the org in the Terraform token for every host that the API lists
as Cloudsmith-owned, not only for *.cloudsmith.io hosts.
- Make the credential helper installers configure the Cloudsmith-owned
hosts that the API lists. They use their default host only when they
cannot get the domains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cloudsmith-iduffy
force-pushed
the
iduffy/v2-workspace-domains
branch
from
October 16, 2026 19:06
d948a88 to
49dfad5
Compare
…lper The Terraform helper matches custom domains at run time, through the Workspace and the API host. The install wrote --org into the terraformrc args, and it did not write the API host. A helper installed against another API host then looked up the domains on the default API host. - Write -w <workspace> into the args. Blocks with --org still work, because --org is an alias of --workspace. - Write --api-host into the args when an API host is set. - Without a Workspace, tell the user how to set one. - Use Workspace in the Terraform messages and help. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cloudsmith-iduffy
force-pushed
the
iduffy/terraform-helper-workspace
branch
from
October 16, 2026 19:10
1c38e5b to
f06fcad
Compare
The CLI kept a table of Cloudsmith hostnames. That table pinned the CLI
to the production hosts. The CLI now gets the domains of a Workspace
from GET /v2/workspaces/{workspace}/domains/ on the configured API host.
The answer includes the Cloudsmith-owned hosts, in preference order.
- Remove the built-in hostname table and the [domains] section in
config.ini.
- Keep version 1 of the domains list JSON document. Set primary and
created_at to null, because the API does not give them.
- Without a Workspace, domains list uses the cached domains. If no
domains are cached, it gets the domains of a Workspace that the
credential is a member of.
- Name the domain cache after the full API base URL, so two deployments
on one hostname do not share a cache.
- Put the org in the Terraform token for every host that the API lists
as Cloudsmith-owned, not only for *.cloudsmith.io hosts.
- Make the credential helper installers configure the Cloudsmith-owned
hosts that the API lists. They use their default host only when they
cannot get the domains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cloudsmith-iduffy
force-pushed
the
iduffy/v2-workspace-domains
branch
from
October 19, 2026 09:35
49dfad5 to
4dcd7a5
Compare
Collaborator
Author
|
@copilot resolve the merge conflicts in this pull request |
cloudsmith-iduffy
marked this pull request as draft
October 19, 2026 10:43
…o iduffy/terraform-helper-workspace # Conflicts: # CHANGELOG.md Co-authored-by: cloudsmith-iduffy <178375997+cloudsmith-iduffy@users.noreply.github.com>
Contributor
Resolved the conflict and merged |
Collaborator
Author
|
@copilot resolve the merge conflicts on this branch. |
cloudsmith-iduffy
enabled auto-merge (squash)
October 19, 2026 21:51
…lper-workspace # Conflicts: # CHANGELOG.md Co-authored-by: cloudsmith-iduffy <178375997+cloudsmith-iduffy@users.noreply.github.com>
auto-merge was automatically disabled
October 19, 2026 21:54
Head branch was pushed to by a user without write access
Contributor
Merged the current |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Stacked on #476.
The Terraform helper does not need domain discovery at install time. Terraform calls the credentials helper for every registry host that has no
credentialsblock, and the helper then matches the host against the domains of the Workspace (#476 gets them from the v2 API). I checked this withterraform initon a module fromterraform.cloudsmith.ioand from a custom Terraform domain. Both downloaded through the installed helper, and the control run without the helper failed.That match needs the Workspace and the API host at run time. Terraform starts the helper in a new process, so the install writes them into the
terraformrcargs. Two things were wrong:--api-hostlooked up the domains on the default API host, so custom domains of another API host never matched.terraform init.Changes:
-w <workspace>into the args, not--org. A block that has--orgstill works, because--orgis an alias of--workspace.--api-hostinto the args when an API host is set.-w/--workspace,CLOUDSMITH_WORKSPACE,workspaceinconfig.ini) in the Terraform error message and help.Type of Change
Additional Notes
Install-time discovery for the other helpers. I ran
credential-helper install docker|cargo|pnpm --workspace <ws> --refreshinto temporaryDOCKER_CONFIG,CARGO_HOMEandNPM_CONFIG_USERCONFIGlocations, with this stack and with master. Both wrote the same hosts. cargo and pnpm each discovered the custom domain of the Workspace. Docker discovered none, because none of the Workspaces I can use has a custom Docker domain. Docker uses the sameget_format_domainscall as cargo and pnpm.🤖 Generated with Claude Code