Fix workload identity project updates (#16373)

* fix: enable workload identity credentials for project updates

* Add explanatory comment for credential context handling

* Revert build_passwords

awx/main/models/workflow.py

@@ -335,9 +335,7 @@ class WorkflowJobNode(WorkflowNodeBase):
             # or labels, because they do not propogate WFJT-->node at all
 
             # Combine WFJT prompts with node here, WFJT at higher level
-            # Empty string values on the workflow job (e.g. from IaC setting limit: "")
-            # should not override a node's explicit non-empty prompt value
-            node_prompts_data.update({k: v for k, v in wj_prompts_data.items() if v != ''})
+            node_prompts_data.update(wj_prompts_data)
             accepted_fields, ignored_fields, errors = ujt_obj._accept_or_ignore_job_kwargs(**node_prompts_data)
             if errors:
                 logger.info(

awx/main/tasks/jobs.py

@@ -1682,7 +1682,7 @@ class RunProjectUpdate(BaseTask):
         return params
 
     def build_credentials_list(self, project_update):
-        if project_update.scm_type == 'insights' and project_update.credential:
+        if project_update.credential:
             return [project_update.credential]
         return []
 

awx/main/tests/functional/models/test_workflow.py

@@ -291,33 +291,6 @@ class TestWorkflowJob:
         assert set(data['labels']) == set(node_labels)  # as exception, WFJT labels not applied
         assert data['limit'] == 'wj_limit'
 
-    def test_node_limit_not_overridden_by_empty_string_wj_limit(self, project, inventory):
-        """
-        When the workflow job has an empty string limit (e.g., set via IaC with limit: ""),
-        the node-level limit should still be passed to the spawned job, not silently suppressed.
-        """
-        jt = JobTemplate.objects.create(
-            project=project,
-            inventory=inventory,
-            ask_limit_on_launch=True,
-        )
-        # Simulate a workflow job whose WFJT was created via IaC with `limit: ""`
-        # (e.g. awx.awx.workflow_job_template: ... limit: "")
-        # This stores '' in char_prompts instead of treating it as None/"no limit".
-        wj = WorkflowJob.objects.create(name='test-wf-job')
-        wj.limit = ''  # stores {'limit': ''} in char_prompts - the IaC bug scenario
-        wj.save()
-
-        node = WorkflowJobNode.objects.create(workflow_job=wj, unified_job_template=jt)
-        node.limit = 'web_servers'
-        node.save()
-
-        data = node.get_job_kwargs()
-        # The node-level limit should be applied; the WJ's empty string limit is not meaningful
-        assert data.get('limit') == 'web_servers', (
-            "Node-level limit 'web_servers' was not passed to the job. " "Likely caused by an empty string WJ limit overriding the node limit"
-        )
-
 
 @pytest.mark.django_db
 class TestWorkflowJobTemplate:

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=45", "setuptools_scm[toml]>=6.2"]
+requires = ["setuptools>=45", "setuptools_scm[toml]>=6.2,<10"]
 build-backend = "setuptools.build_meta"
 
 # Do not uncomment the line below. We need to be able to override the version via a file, and this