Verify project link works in config validate

Author: pete-woods

acceptance/config_test.go

@@ -24,6 +24,7 @@ package acceptance_test
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -248,6 +249,48 @@ func TestConfigValidate_InfersOrgFromGitRemote(t *testing.T) {
 	assert.Check(t, cmp.Equal(fake.LastCompileOwnerID(), testOrgUUID))
 }
 
+// TestConfigValidate_ProjectLinkOverridesGitRemote pins that org inference
+// honours a `circleci project link` binding (.circleci/info.yml) over the git
+// remote — the case where the remote is not the right answer (repository
+// renames, forks, standalone projects). The remote points at one org; the link
+// binds a different one, and the linked org must reach the compile endpoint.
+//
+// The linked project is deliberately NOT registered with the fake: `project
+// link` records the org UUID in info.yml, so inference uses it directly with no
+// project lookup. The linked org resolving without a matching fake project
+// proves that direct-ID path (which also works offline / with a restricted
+// token).
+func TestConfigValidate_ProjectLinkOverridesGitRemote(t *testing.T) {
+	const linkedOrgUUID = "00000000-0000-0000-0000-0000000000cc"
+	const linkedProjUUID = "00000000-0000-0000-0000-0000000000dd"
+
+	fake := fakes.NewCircleCI(t)
+	fake.SetCompileResponse(true, testCompiledYAML)
+	// The git remote resolves to a *different* org. If the link were ignored,
+	// this org would be used and the assertion below would catch it.
+	fake.AddProjectBySlug("gh/otherorg/otherrepo", "00000000-0000-0000-0000-0000000000b3", "otherrepo", testOrgUUID)
+
+	env := testenv.New(t)
+	env.Token = testToken
+	env.CircleCIURL = fake.URL()
+
+	dir := t.TempDir()
+	initGitRepoWithRemote(t, dir, "https://github.com/otherorg/otherrepo")
+	writeConfig(t, dir, testConfigYAML)
+	writeProjectLink(t, dir, linkedOrgUUID, linkedProjUUID)
+
+	result := binary.RunCLI(t, binary.RunOpts{
+		Binary:  binaryPath,
+		Args:    []string{"config", "validate", "--config", ".circleci/config.yml"},
+		Env:     env.Environ(),
+		WorkDir: dir,
+	})
+
+	assert.Check(t, cmp.Equal(result.ExitCode, 0), "stderr: %s", result.Stderr)
+	// The linked project's org — not the git remote's — reached compile.
+	assert.Check(t, cmp.Equal(fake.LastCompileOwnerID(), linkedOrgUUID))
+}
+
 // TestConfigValidate_NoOrgOutsideGitRemote guards the other half of the #1061
 // contract: inference is best-effort. Outside a git checkout (and with no
 // --org) validation still succeeds, compiling with an empty owner_id rather
@@ -447,6 +490,18 @@ func writeConfig(t *testing.T, dir, content string) {
 	writeFile(t, filepath.Join(dir, ".circleci", "config.yml"), content)
 }
 
+// writeProjectLink writes the .circleci/info.yml that `circleci project link`
+// produces, binding the checkout to a CircleCI project by its stable UUIDs.
+func writeProjectLink(t *testing.T, dir, orgID, projectID string) {
+	t.Helper()
+	assert.NilError(t, os.MkdirAll(filepath.Join(dir, ".circleci"), 0o755))
+	content := fmt.Sprintf(
+		"organization:\n  id: %s\nproject:\n  id: %s\n  slug: circleci/%s/%s\n",
+		orgID, projectID, orgID, projectID,
+	)
+	writeFile(t, filepath.Join(dir, ".circleci", "info.yml"), content)
+}
+
 func writeFile(t *testing.T, path, content string) {
 	t.Helper()
 	assert.NilError(t, os.WriteFile(path, []byte(content), 0o644))

internal/cmd/config/config.go

@@ -98,20 +98,22 @@ func readConfigInput(ctx context.Context, path string) (string, error) {
 // resolveOrgID returns the org UUID to use for private orb resolution during
 // compilation.
 //
-// When --org is empty the org is inferred from the git remote as a best-effort
-// convenience, so configs that reference private or namespaced orbs validate
-// without requiring the flag. If the org can't be determined (not a git
-// checkout, an unrecognised remote, or the project isn't found) it falls back
-// to "" and private orb resolution is skipped — the compile call still
-// proceeds so public configs validate anywhere.
+// When --org is empty the org is inferred from the current project as a
+// best-effort convenience, so configs that reference private or namespaced orbs
+// validate without requiring the flag. Inference honours a `circleci project
+// link` binding first and falls back to the git remote (see cmdutil.InferOrgID).
+// If the org can't be determined (not a linked or git checkout, an unrecognised
+// remote, or the project isn't found) it falls back to "" and private orb
+// resolution is skipped — the compile call still proceeds so public configs
+// validate anywhere.
 //
 // When --org is set explicitly, the slug or UUID is resolved via the API and an
 // unresolvable value is a hard error, so a typo isn't silently ignored.
 //
 // cmdName is used only in the suggestion text of any resulting error.
 func resolveOrgID(ctx context.Context, client *apiclient.Client, org, cmdName string) (string, error) {
 	if org == "" {
-		return cmdutil.InferOrgIDFromGitRemote(ctx, client), nil
+		return cmdutil.InferOrgID(ctx, client), nil
 	}
 	id, err := cmdutil.ResolveOrgSlugOrID(ctx, client, org, cmdName)
 	if err != nil {

internal/cmd/config/process.go

@@ -64,8 +64,10 @@ func newProcessCmd() *cobra.Command {
 			Pass a file path or "-" to read from stdin.
 
 			Private and namespaced orbs are resolved against your organization.
-			The org is inferred from the git remote when --org is omitted; pass
-			--org to override it or to resolve private orbs outside a checkout.
+			When --org is omitted the org is inferred from the current project —
+			a 'circleci project link' binding if present, otherwise the git
+			remote. Pass --org to override this, or to resolve private orbs
+			outside a project.
 		`),
 		Example: heredoc.Doc(`
 			# Process the default config

internal/cmd/config/validate.go

@@ -52,8 +52,10 @@ func newValidateCmd() *cobra.Command {
 			different file, or "-" to read from stdin.
 
 			Private and namespaced orbs are resolved against your organization.
-			The org is inferred from the git remote when --org is omitted; pass
-			--org to override it or to resolve private orbs outside a checkout.
+			When --org is omitted the org is inferred from the current project —
+			a 'circleci project link' binding if present, otherwise the git
+			remote. Pass --org to override this, or to resolve private orbs
+			outside a project.
 
 			JSON fields (--json):
 			  valid          bool    whether the config compiled without errors

internal/cmd/root/testdata/help/circleci/config/process.txt

@@ -9,8 +9,10 @@ CircleCI would actually execute.
 Pass a file path or "-" to read from stdin.
 
 Private and namespaced orbs are resolved against your organization.
-The org is inferred from the git remote when --org is omitted; pass
---org to override it or to resolve private orbs outside a checkout.
+When --org is omitted the org is inferred from the current project —
+a 'circleci project link' binding if present, otherwise the git
+remote. Pass --org to override this, or to resolve private orbs
+outside a project.
 
 ## Usage
 

internal/cmd/root/testdata/help/circleci/config/validate.txt

@@ -6,8 +6,10 @@ Reads .circleci/config.yml by default. Pass --config to specify a
 different file, or "-" to read from stdin.
 
 Private and namespaced orbs are resolved against your organization.
-The org is inferred from the git remote when --org is omitted; pass
---org to override it or to resolve private orbs outside a checkout.
+When --org is omitted the org is inferred from the current project —
+a 'circleci project link' binding if present, otherwise the git
+remote. Pass --org to override this, or to resolve private orbs
+outside a project.
 
 JSON fields (--json):
   valid          bool    whether the config compiled without errors

internal/cmdutil/orgid.go

@@ -101,15 +101,21 @@ func ResolveOrgSlugOrID(ctx context.Context, client *apiclient.Client, ref, cmdN
 	return parseOrgID(org.ID)
 }
 
-// InferOrgIDFromGitRemote best-effort resolves the org UUID for the current
-// git remote's project. It is the lenient counterpart to ResolveOrgSlugOrID,
-// for commands where the org is an optional convenience rather than required —
-// e.g. config compilation passes it so private and namespaced orbs resolve
-// without an explicit --org. It returns "" (with no error) whenever the org
-// cannot be determined — not a git checkout, an unrecognised remote, or a
-// failed project lookup — so callers fall back to public-only behaviour
-// instead of failing.
-func InferOrgIDFromGitRemote(ctx context.Context, client *apiclient.Client) string {
+// InferOrgID best-effort resolves the org UUID for the current directory's
+// CircleCI project. Detection follows gitremote.Detect's resolution order — a
+// `circleci project link` binding (.circleci/info.yml) takes precedence over
+// the git remote, so an explicit link wins when the remote is not the right
+// answer (repository renames, forks, standalone projects). When the link
+// recorded the org as a UUID it is used directly; otherwise the resolved
+// project is looked up through the API to recover its owning org.
+//
+// It is the lenient counterpart to ResolveOrgSlugOrID, for commands where the
+// org is an optional convenience rather than required — e.g. config compilation
+// passes it so private and namespaced orbs resolve without an explicit --org.
+// It returns "" (with no error) whenever the org cannot be determined — not a
+// git checkout, an unrecognised remote, or a failed project lookup — so callers
+// fall back to public-only behaviour instead of failing.
+func InferOrgID(ctx context.Context, client *apiclient.Client) string {
 	// The hint strings are unused: any error is swallowed into a "" result.
 	raw, err := orgIDFromGitRemote(ctx, client, "", "")
 	if err != nil {
@@ -128,6 +134,16 @@ func orgIDFromGitRemote(ctx context.Context, client *apiclient.Client, detectHin
 	if err != nil {
 		return "", GitDetectErr(err, detectHint)
 	}
+	// A `circleci project link` binding records the org ID directly. When it is a
+	// UUID — the same form the project lookup below returns — use it as-is and
+	// skip the API round-trip, so the org resolves even offline or with a token
+	// that can't read the project. A non-UUID (compact) recorded ID falls through
+	// to the lookup, which yields the canonical UUID.
+	if info.OrgID != "" {
+		if id, err := uuid.Parse(info.OrgID); err == nil {
+			return id.String(), nil
+		}
+	}
 	proj, err := client.GetProjectBySlug(ctx, info.Slug)
 	if err != nil {
 		return "", clierrors.New("org.resolve_failed", "Could not resolve organization",

internal/gitremote/detect.go

@@ -46,6 +46,12 @@ type ProjectInfo struct {
 	Branch string
 	// DefaultBranch is the default branch name.
 	DefaultBranch string
+	// OrgID is the organization ID recorded by `circleci project link`
+	// (.circleci/info.yml). It is empty when the project was resolved from the
+	// git remote, because the org ID is not derivable from a remote URL without
+	// an API lookup. Its form is whatever link persisted (a UUID, or a compact
+	// base62 ID); consumers that need a UUID must parse and fall back on failure.
+	OrgID string
 }
 
 var (
@@ -111,6 +117,7 @@ func Detect() (*ProjectInfo, error) {
 				Slug:          ref.EffectiveSlug(),
 				Branch:        branch,
 				DefaultBranch: defaultBranch,
+				OrgID:         ref.Organization.ID,
 			}, nil
 		}
 	}

internal/gitremote/detect_test.go

@@ -155,9 +155,10 @@ func TestSlugFromRemote(t *testing.T) {
 // to the canonical "circleci/<orgID>/<projectID>" slug.
 func TestDetect_PrefersInfoYml(t *testing.T) {
 	tests := []struct {
-		name     string
-		info     projectref.Info
-		wantSlug string
+		name      string
+		info      projectref.Info
+		wantSlug  string
+		wantOrgID string
 	}{
 		{
 			name: "uuids present yields canonical slug",
@@ -168,7 +169,8 @@ func TestDetect_PrefersInfoYml(t *testing.T) {
 					ID:   "13c8F7nusayivoSxC6GMsw",
 				},
 			},
-			wantSlug: "circleci/E6i3yYZeWZhcf8UNqcKfjN/13c8F7nusayivoSxC6GMsw",
+			wantSlug:  "circleci/E6i3yYZeWZhcf8UNqcKfjN/13c8F7nusayivoSxC6GMsw",
+			wantOrgID: "E6i3yYZeWZhcf8UNqcKfjN",
 		},
 		{
 			name:     "slug-only falls through verbatim",
@@ -190,6 +192,9 @@ func TestDetect_PrefersInfoYml(t *testing.T) {
 			info, err := Detect()
 			assert.NilError(t, err)
 			assert.Check(t, cmp.Equal(info.Slug, tc.wantSlug))
+			// The org ID recorded by `project link` is surfaced verbatim so
+			// callers can use it without a project lookup.
+			assert.Check(t, cmp.Equal(info.OrgID, tc.wantOrgID))
 		})
 	}
 }