[Copilot]

The CLI already parsed child sections nested under a workspaces entry in environment override files, but the override merger ignored them. Only the workspace container's own properties were applied. As a result, workspace APIs, backends, loggers and other child resources were published with source-environment values.

workspaces:
  - name: my-workspace
    apis:
      - name: my-api
        properties:
          serviceUrl: "https://prod.example.com"   # previously ignored

Changes

• Scope resolution (override-merger.ts)
  • New resolveOverrideScope(): if descriptor.workspace is set (and the resource is not the Workspace container itself), it finds the workspace entry (case-insensitive) and builds an OverrideConfig from that entry's children. Only the 11 child sections the config loader accepts are included.
  • applyOverrides resolves this scope first, then reuses the existing direct, child and grandchild lookups. This covers workspace API diagnostics, operations, policies and releases, operation policies, and product policies with no duplicated logic.
• Behavior change: top-level sections (e.g. top-level apis) no longer apply to workspace-scoped resources with the same name. This matches the Toolkit's parent-chain resolution. Workspace overrides likewise never apply to service-level resources.
• Named values: hasNamedValueOverride(name, overrides, workspace?) now checks the workspace's namedValues section. Its callers in publish-service.ts and secret-redaction-guard.ts pass descriptor.workspace. Auto-generated workspace named values with an explicit override are therefore published and scanned instead of skipped.
• Docs: replaced the Workspace-scoped override properties not applied #118 known-limitation note in environment-overrides.md with a description of the scoping rules.
• Tests: added a workspace-scoped overrides suite to override-merger.test.ts. It covers the container itself, top-level child resources, nested API and product sub-resources, isolation between service and workspace scope in both directions, and hasNamedValueOverride.

Reviewer notes

• Workspace-level policies are still not overridable: the config loader doesn't accept a policies section under a workspace, and the issue didn't ask for one.
• Code review against the constitution (.squad/identity/constitution.md) is requested, as required for changes under src/.

• Fixes Workspace-scoped override properties not applied #118

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 2 · 2

Open (4)

• WORKSPACE_CHILD_SECTIONS needs to stay in sync with the config loader’s accepted workspace child… · New
• resolveOverrideScope allocates a new scoped object and loops WORKSPACE_CHILD_SECTIONS on… · New
• This sentence mixes “workspace child sections” (e.g., workspaces.<ws>.children.apis) with “API… · New
• applyOverrides is tested for case-insensitive workspace matching, but hasNamedValueOverride… · New

[Alexander Zaslonov (azaslonov)]

Copilot resolve the merge conflicts in this pull request

[Copilot]

Copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts, committed, and pushed the merge as 87cebd5.

[Copilot]

🟡 Changes recommended

Targeted coverage is missing for workspace API releases and secret-redaction scanning.

3 open findings

• Add workspace API release override coverage · New
• Test secret scanning for workspace named-value overrides · New
• applyOverrides is tested for case-insensitive workspace matching, but hasNamedValueOverride…

3 resolved since last review

• resolveOverrideScope allocates a new scoped object and loops WORKSPACE_CHILD_SECTIONS on…
• WORKSPACE_CHILD_SECTIONS needs to stay in sync with the config loader’s accepted workspace child…
• This sentence mixes “workspace child sections” (e.g., workspaces.<ws>.children.apis) with “API…

🧠 Review effort: Balanced