Role-binding flag text, linter bool-flag exception, logout no-op.

[David Adams (davidadas)]

Release Notes

Bug Fixes

• confluent iam rbac role-binding list --inclusive had a help-text description that contradicted its own documented example and actual behavior. (APIE-1362)
• The RequireValidExamples() lint rule incorrectly flagged boolean flags using --flag=value syntax in command examples. (APIE-1286)
• confluent logout errored or silently auto-logged-in-then-out instead of being a no-op when already logged out. (APIE-1314)

Checklist

• I have successfully built and used a custom CLI binary, without linter issues from this PR.
• I have clearly specified in the What section below whether this PR applies to Confluent Cloud, Confluent Platform, or both.
• I have verified this PR in Confluent Cloud pre-prod or production environment, if applicable.
• I have verified this PR in Confluent Platform on-premises environment, if applicable.
• I have attached manual CLI verification results or screenshots in the Test & Review section below.
• I have added appropriate CLI integration or unit tests for any new or updated commands and functionality.
• I confirm that this PR introduces no breaking changes or backward compatibility issues.
• I have indicated the potential customer impact if something goes wrong in the Blast Radius section below.
• I have put checkmarks below confirming that the feature associated with this PR is enabled in:
  • Confluent Cloud prod
  • Confluent Cloud stag
  • Confluent Platform
  • Check this box if the feature is enabled for certain organizations only

Unchecked items need human follow-up before merge — no Go toolchain was available in the environment this PR was prepared in, so no build/lint/test run or live verification was possible. This is more important than usual for this PR since APIE-1314 changes which PreRun a command uses — please run make build && make lint && make test (especially TestLogout_RemoveUsernamePassword and TestLogout_RemoveUsernamePasswordFail) before merging. Opening as a draft for that reason.

What

Confluent Cloud and Confluent Platform (on-prem) both — all three fixes touch shared code paths used by both login modes.

1. APIE-1362 — the --inclusive flag's help text said "If scopes are unspecified, list only organization-scoped role bindings", contradicting the command's own documented example ("for all scopes") and the reporter's confirmed actual behavior. Corrected the text and the 4 golden fixtures that pinned the old wording.
2. APIE-1286 — RequireValidExamples() (pkg/linter/command_rules.go) flagged any --flag=value in an example. Boolean flags legitimately need = to set the non-default value (e.g. --flag=false). Added a getBoolFlags() helper and excluded boolean flags from that check.
3. APIE-1314 — confluent logout used NewAuthenticatedCLICommand, which requires being logged in. With no active session this produced Error: not logged in; with CONFLUENT_CLOUD_API_KEY/SECRET env vars set, it auto-logged-in only to immediately log back out. Switched to NewAnonymousCLICommand (the same pattern login itself uses) and return immediately with no error when there's no active context. The ccloud client used to revoke the refresh token (previously populated by the Authenticated PreRun) is now constructed directly inside revokeCCloudRefreshToken, only when a real session is confirmed to exist.

Blast Radius

• APIE-1362: text-only fix to a --help description string. No behavior or serialized-output change.
• APIE-1286: dev-tooling only (make lint-cli); no runtime CLI behavior changes for customers.
• APIE-1314: behavior change, but narrowly scoped to confluent logout. Customers who are genuinely logged in see no change (still revokes the token, persists logout, prints the same success message). Customers who run logout while already logged out previously saw an error or an auto-login/logout cycle; they'll now see nothing happen at all, matching the ticket's explicit ask. Worth a careful look during review since it changes which PreRun the command uses.

References

• https://confluentinc.atlassian.net/browse/APIE-1362
• https://confluentinc.atlassian.net/browse/APIE-1286
• https://confluentinc.atlassian.net/browse/APIE-1314

Test & Review

No Go toolchain was available in the environment this PR was prepared in, so make build/make lint/make test were not run here — please run these before merging, and pay particular attention to test/logout_test.go given the APIE-1314 change.

What was actually verified:

• APIE-1362: confirmed the exact flag text and updated all 4 golden fixtures that reference it.
• APIE-1286: confirmed no existing test file covers RequireValidExamples(), so nothing to break; the new getBoolFlags() helper mirrors the existing getAllFlags()/getRequiredFlags() pattern in the same file.
• APIE-1314: confirmed NewAnonymousCLICommand is the same constructor already used by internal/login/command.go; traced command.Version = r.Version into the Anonymous() PreRun function (pkg/cmd/prerunner.go:108) to confirm c.Version is populated before revokeCCloudRefreshToken needs it; confirmed the existing test/logout_test.go tests always log in immediately before logging out, so the no-op path isn't exercised by them (a new test for the no-op case would be worth adding).

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull request overview

This pull request updates the confluent iam rbac role-binding list command help text for the --inclusive flag and refreshes the corresponding integration-test golden fixtures so the expected --help output matches.

Changes:

• Updates the --inclusive flag description in internal/iam/command_rbac_role_binding_list.go.
• Regenerates/updates golden --help outputs for both cloud and on-prem variants (including failure-help fixtures).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
internal/iam/command_rbac_role_binding_list.go	Updates the --inclusive flag help string for role-binding listing.
test/fixtures/output/iam/rbac/role-binding/list-help.golden	Updates expected cloud list --help output for the --inclusive flag line.
test/fixtures/output/iam/rbac/role-binding/list-help-onprem.golden	Updates expected on-prem list --help output for the --inclusive flag line.
test/fixtures/output/iam/rbac/role-binding/list-failure-help-cloud.golden	Updates expected cloud failure help output for the --inclusive flag line.
test/fixtures/output/iam/rbac/role-binding/list-failure-help-onprem.golden	Updates expected on-prem failure help output for the --inclusive flag line.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[David Adams (davidadas)]

Superseded by #3422, opened from a branch on confluentinc/cli directly instead of my fork.