jango-blockchained · pull · Jun 5, 2025 · May 30, 2025 · May 30, 2025 · May 30, 2025
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1526,7 +1526,7 @@ jobs:
         uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
 
       - name: Set up Flux CLI
-        uses: fluxcd/flux2/action@8d5f40dca5aa5d3c0fc3414457dda15a0ac92fa4 # v2.5.1
+        uses: fluxcd/flux2/action@b73c7f7191086ca7629840e680e71873349787f8 # v2.6.1
         with:
           # Keep this and the github action up to date with the version of flux installed in dogfood cluster
           version: "2.5.1"

diff --git a/.github/workflows/contrib.yaml b/.github/workflows/contrib.yaml
@@ -42,7 +42,7 @@ jobs:
           # branch should not be protected
           branch: "main"
           # Some users have signed a corporate CLA with Coder so are exempt from signing our community one.
-          allowlist: "coryb,aaronlehmann,dependabot*"
+          allowlist: "coryb,aaronlehmann,dependabot*,blink-so*"
 
   release-labels:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/docs-ci.yaml b/.github/workflows/docs-ci.yaml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Node
         uses: ./.github/actions/setup-node
 
-      - uses: tj-actions/changed-files@3981e4f74104e7a4c67a835e1e5dd5d9eb0f0a57 # v45.0.7
+      - uses: tj-actions/changed-files@115870536a85eaf050e369291c7895748ff12aea # v45.0.7
         id: changed-files
         with:
           files: |

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif

diff --git a/cli/configssh.go b/cli/configssh.go
@@ -235,7 +235,7 @@ func (r *RootCmd) configSSH() *serpent.Command {
 	cmd := &serpent.Command{
 		Annotations: workspaceCommand,
 		Use:         "config-ssh",
-		Short:       "Add an SSH Host entry for your workspaces \"ssh coder.workspace\"",
+		Short:       "Add an SSH Host entry for your workspaces \"ssh workspace.coder\"",
 		Long: FormatExamples(
 			Example{
 				Description: "You can use -o (or --ssh-option) so set SSH options to be used for all your workspaces",

diff --git a/cli/templatepush.go b/cli/templatepush.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -80,6 +81,46 @@ func (r *RootCmd) templatePush() *serpent.Command {
 				createTemplate = true
 			}
 
+			var tags map[string]string
+			// Passing --provisioner-tag="-" allows the user to clear all provisioner tags.
+			if len(provisionerTags) == 1 && strings.TrimSpace(provisionerTags[0]) == "-" {
+				cliui.Warn(inv.Stderr, "Not reusing provisioner tags from the previous template version.")
+				tags = map[string]string{}
+			} else {
+				tags, err = ParseProvisionerTags(provisionerTags)
+				if err != nil {
+					return err
+				}
+
+				// If user hasn't provided new provisioner tags, inherit ones from the active template version.
+				if len(tags) == 0 && template.ActiveVersionID != uuid.Nil {
+					templateVersion, err := client.TemplateVersion(inv.Context(), template.ActiveVersionID)
+					if err != nil {
+						return err
+					}
+					tags = templateVersion.Job.Tags
+					cliui.Info(inv.Stderr, "Re-using provisioner tags from the active template version.")
+					cliui.Info(inv.Stderr, "Tip: You can override these tags by passing "+cliui.Code(`--provisioner-tag="key=value"`)+".")
+					cliui.Info(inv.Stderr, "     You can also clear all provisioner tags by passing "+cliui.Code(`--provisioner-tag="-"`)+".")
+				}
+			}
+
+			{ // For clarity, display provisioner tags to the user.
+				var tmp []string
+				for k, v := range tags {
+					if k == provisionersdk.TagScope || k == provisionersdk.TagOwner {
+						continue
+					}
+					tmp = append(tmp, fmt.Sprintf("%s=%q", k, v))
+				}
+				slices.Sort(tmp)
+				tagStr := strings.Join(tmp, " ")
+				if len(tmp) == 0 {
+					tagStr = "<none>"
+				}
+				cliui.Info(inv.Stderr, "Provisioner tags: "+cliui.Code(tagStr))
+			}
+
 			err = uploadFlags.checkForLockfile(inv)
 			if err != nil {
 				return xerrors.Errorf("check for lockfile: %w", err)
@@ -104,21 +145,6 @@ func (r *RootCmd) templatePush() *serpent.Command {
 				return err
 			}
 
-			tags, err := ParseProvisionerTags(provisionerTags)
-			if err != nil {
-				return err
-			}
-
-			// If user hasn't provided new provisioner tags, inherit ones from the active template version.
-			if len(tags) == 0 && template.ActiveVersionID != uuid.Nil {
-				templateVersion, err := client.TemplateVersion(inv.Context(), template.ActiveVersionID)
-				if err != nil {
-					return err
-				}
-				tags = templateVersion.Job.Tags
-				inv.Logger.Info(inv.Context(), "reusing existing provisioner tags", "tags", tags)
-			}
-
 			userVariableValues, err := codersdk.ParseUserVariableValues(
 				varsFiles,
 				variablesFile,
@@ -214,7 +240,7 @@ func (r *RootCmd) templatePush() *serpent.Command {
 		},
 		{
 			Flag:        "provisioner-tag",
-			Description: "Specify a set of tags to target provisioner daemons.",
+			Description: "Specify a set of tags to target provisioner daemons. If you do not specify any tags, the tags from the active template version will be reused, if available. To remove existing tags, use --provisioner-tag=\"-\".",
 			Value:       serpent.StringArrayOf(&provisionerTags),
 		},
 		{

diff --git a/cli/templatepush_test.go b/cli/templatepush_test.go
@@ -602,7 +602,7 @@ func TestTemplatePush(t *testing.T) {
 			templateVersion = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
 			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
 
-			// Push new template version without provisioner tags. CLI should reuse tags from the previous version.
+			// Push new template version with different provisioner tags.
 			source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 				Parse:          echo.ParseComplete,
 				ProvisionApply: echo.ApplyComplete,
@@ -639,6 +639,75 @@ func TestTemplatePush(t *testing.T) {
 			require.EqualValues(t, map[string]string{"foobar": "foobaz", "owner": "", "scope": "organization"}, templateVersion.Job.Tags)
 		})
 
+		t.Run("DeleteTags", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			// Start the first provisioner with no tags.
+			client, provisionerDocker, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+				ProvisionerDaemonTags:    map[string]string{},
+			})
+			defer provisionerDocker.Close()
+
+			// Start the second provisioner with a tag set.
+			provisionerFoobar := coderdtest.NewTaggedProvisionerDaemon(t, api, "provisioner-foobar", map[string]string{
+				"foobar": "foobaz",
+			})
+			defer provisionerFoobar.Close()
+
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+			// Create the template with initial tagged template version.
+			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+				ctvr.ProvisionerTags = map[string]string{
+					"foobar": "foobaz",
+				}
+			})
+			templateVersion = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
+
+			// Stop the tagged provisioner daemon.
+			provisionerFoobar.Close()
+
+			// Push new template version with no provisioner tags.
+			source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
+				Parse:          echo.ParseComplete,
+				ProvisionApply: echo.ApplyComplete,
+			})
+			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", template.Name, "--provisioner-tag=\"-\"")
+			clitest.SetupConfig(t, templateAdmin, root)
+			pty := ptytest.New(t).Attach(inv)
+
+			execDone := make(chan error)
+			go func() {
+				execDone <- inv.WithContext(ctx).Run()
+			}()
+
+			matches := []struct {
+				match string
+				write string
+			}{
+				{match: "Upload", write: "yes"},
+			}
+			for _, m := range matches {
+				pty.ExpectMatch(m.match)
+				pty.WriteLine(m.write)
+			}
+
+			require.NoError(t, <-execDone)
+
+			// Verify template version tags
+			template, err := client.Template(ctx, template.ID)
+			require.NoError(t, err)
+
+			templateVersion, err = client.TemplateVersion(ctx, template.ActiveVersionID)
+			require.NoError(t, err)
+			require.EqualValues(t, map[string]string{"owner": "", "scope": "organization"}, templateVersion.Job.Tags)
+		})
+
 		t.Run("DoNotChangeTags", func(t *testing.T) {
 			t.Parallel()
 

diff --git a/cli/testdata/coder_--help.golden b/cli/testdata/coder_--help.golden
@@ -18,7 +18,7 @@ SUBCOMMANDS:
     completion        Install or update shell completion scripts for the
                       detected or chosen shell.
     config-ssh        Add an SSH Host entry for your workspaces "ssh
-                      coder.workspace"
+                      workspace.coder"
     create            Create a workspace
     delete            Delete a workspace
     dotfiles          Personalize your workspace by applying a canonical

diff --git a/cli/testdata/coder_config-ssh_--help.golden b/cli/testdata/coder_config-ssh_--help.golden
@@ -3,7 +3,7 @@ coder v0.0.0-devel
 USAGE:
   coder config-ssh [flags]
 
-  Add an SSH Host entry for your workspaces "ssh coder.workspace"
+  Add an SSH Host entry for your workspaces "ssh workspace.coder"
 
     - You can use -o (or --ssh-option) so set SSH options to be used for all
   your

diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
@@ -23,7 +23,7 @@
       "workspace_id": "===========[workspace ID]===========",
       "workspace_name": "test-workspace",
       "workspace_owner_id": "==========[first user ID]===========",
-      "workspace_owner_username": "testuser",
+      "workspace_owner_name": "testuser",
       "template_version_id": "============[version ID]============",
       "template_version_name": "===========[version name]===========",
       "build_number": 1,

diff --git a/cli/testdata/coder_templates_push_--help.golden b/cli/testdata/coder_templates_push_--help.golden
@@ -33,7 +33,10 @@ OPTIONS:
           generated if not provided.
 
       --provisioner-tag string-array
-          Specify a set of tags to target provisioner daemons.
+          Specify a set of tags to target provisioner daemons. If you do not
+          specify any tags, the tags from the active template version will be
+          reused, if available. To remove existing tags, use
+          --provisioner-tag="-".
 
       --var string-array
           Alias of --variable.