CXH-2164: add workspace exclude flag to scope sync - #52
Conversation
Add --databricks-exclude-workspaces (BATON_DATABRICKS_EXCLUDE_WORKSPACES), a comma-separated denylist of workspaces to omit from sync, matched by workspace name, deployment name, or numeric workspace ID. Filtering happens in client.ListWorkspaces so both Validate and sync honor it; excluded workspaces and their roles are skipped entirely.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| for _, w := range excludeWorkspaces { | ||
| if w == "" { | ||
| continue | ||
| } | ||
| excludeSet[w] = struct{}{} | ||
| } |
There was a problem hiding this comment.
🟡 Suggestion: Entries aren't trimmed before being added to the exclude set, and matching is exact. The README/docs advertise a "comma-separated list," so a user setting BATON_DATABRICKS_EXCLUDE_WORKSPACES=ws-a, ws-b will get " ws-b" (pflag's StringSlice does not trim whitespace), which silently fails to exclude ws-b. Consider strings.TrimSpace(w) before the empty check. (medium confidence)
| for _, w := range excludeWorkspaces { | |
| if w == "" { | |
| continue | |
| } | |
| excludeSet[w] = struct{}{} | |
| } | |
| for _, w := range excludeWorkspaces { | |
| w = strings.TrimSpace(w) | |
| if w == "" { | |
| continue | |
| } | |
| excludeSet[w] = struct{}{} | |
| } |
Connector PR Review: CXH-2164: add workspace exclude flag to scope syncBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe new commit addresses both prior findings: strings.TrimSpace is now applied to each exclude entry before matching in pkg/databricks/client.go:64, and a new table-driven test in pkg/databricks/client_test.go covers name, deployment-name, and numeric-ID matching plus empty, whitespace, and space-padded entries. The full PR diff was scanned for security and correctness. Workspace.ID is an int so strconv.Itoa is correct, and the ListWorkspaces filtering is safe. No new issues found. Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
Comma-separated --databricks-exclude-workspaces values arrive space-padded (pflag CSV parsing does not trim), and isWorkspaceExcluded does exact map lookups, so an entry like " ws-b" silently never matched. TrimSpace each entry when building the exclude set. Adds a table-driven test covering exclusion by name, deployment name, and numeric ID, plus empty/whitespace entries being ignored.
2 participants
Customers can now exclude specific Databricks workspaces from a sync by name or ID, so an inaccessible or unwanted workspace no longer has to be synced or granted access to.