Fix airflow config get-value silently succeeding on a missing option

[Eason09053360]

airflow config get-value exited 0 with nothing on stdout when the option did not exist, so a script capturing its output could not tell a missing option from an empty one. The parser's "not found" warning also landed on stdout, corrupting the value the command exists to produce.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines

[potiuk]

First of all This is user facing change so newsfragment should be added explaining the behaviour change (which otherwise makes sense).

But more importantly - you need to make a wider chaeck in all similar methods and see what behaviour is there - and raise this change proposal to devlist, describing a general change in the interface (config get-value is part of the public interface). Also you should consult airflow-ctl behaviour and make sure those are synchronized.

[Eason09053360]

Thanks for the steer — I did the wider check before taking this to the list.

Devlist thread: https://lists.apache.org/thread/v7wonnnlf2t444ojgkmdx0j03cw51op3

What the audit found

I ran every airflow CLI command that takes an identifier, looks one thing up and
prints it to stdout, in Breeze against a migrated metadata DB — redirecting stdout and
stderr to separate files so the two streams could be told apart and sized:

• 8 of the 10 cases already exit non-zero on "not found"; 7 of those with a clean
  one-line message on stderr.
• config get-value (this PR) and airflow dags state <dag> <bad-run-id> are the only
  two that exit 0. The latter prints the literal string None to stdout. git log
  suggests that was never a decision: Use DB where possible for quicker airflow dag subcommands #21793 added a SystemExit for the missing-DAG
  case in the same function but left that branch alone, and Handle null logical date in CLI commands #46407 mechanically
  preserved it while refactoring for null logical dates.
• tasks states-for-dag-run exits non-zero but surfaces a raw DagRunNotFound
  traceback rather than a clean message. Cosmetic and a different problem — left out
  of scope.

The script I ran (breeze --answer yes run bash /opt/airflow/dev/audit.sh)

#!/usr/bin/env bash
set -uo pipefail
cd /opt/airflow

airflow db migrate    >/dev/null 2>&1
airflow dags reserialize >/dev/null 2>&1

# a real DAG is needed for the "dag exists, run does not" probe
EXISTING_DAG=$(airflow dags list -o json | python -c \
  'import json,sys; d=json.load(sys.stdin); print(d[0]["dag_id"] if d else "")')

run_case() {
  local label="$1"; shift
  local out err rc
  out=$(mktemp); err=$(mktemp)
  "$@" >"$out" 2>"$err"; rc=$?          # separate files -> streams stay distinguishable
  printf '\nCASE : %s\nCMD  : %s\nEXIT : %s\n' "$label" "$*" "$rc"
  printf 'OUT  : %s bytes\n' "$(wc -c <"$out" | tr -d ' ')"; [ -s "$out" ] && sed 's/^/     > /' "$out"
  printf 'ERR  : %s bytes\n' "$(wc -c <"$err" | tr -d ' ')"; [ -s "$err" ] && sed 's/^/     ! /' "$err"
  rm -f "$out" "$err"
}

run_case "config get-value"          airflow config get-value missing-section missing-option
run_case "variables get"             airflow variables get no_such_variable
run_case "pools get"                 airflow pools get no_such_pool
run_case "connections get"           airflow connections get no_such_conn
run_case "providers get"             airflow providers get no.such.provider
run_case "dags details"              airflow dags details no_such_dag
run_case "dags state (dag missing)"  airflow dags state no_such_dag some_run_id
run_case "dags state (run missing)"  airflow dags state "$EXISTING_DAG" no_such_run_id
run_case "tasks states-for-dag-run"  airflow tasks states-for-dag-run "$EXISTING_DAG" no_such_run_id
run_case "assets details"            airflow assets details --name no_such_asset

The row that matters most, verbatim:

CASE : dags state (run missing)
CMD  : airflow dags state aggregate_regional_sales no_such_run_id
EXIT : 0
OUT  : 5 bytes
     > None
ERR  : 0 bytes

On airflow-ctl

airflowctl config get exists but is generated over the Public API rather than
hand-written, and that endpoint already returns 404 Option [section/option] not found.. So the REST API and airflowctl already treat this as an error — the legacy
CLI is the outlier, not the other way round.

That is the framing the devlist thread proposes: this is not a new convention, it is
finishing an existing one. It also notes that under AIP-94
(contributing-docs/27_cli_implementation_guide.rst) the existing airflow CLI remote
commands get rewired to call the Public API, so config get-value will inherit the 404
and stop exiting 0 regardless — the open question is whether that happens deliberately
now with a newsfragment, or silently later as a side effect.

Newsfragment

Happy to add one to this PR now. Holding off only until the list has had a chance to
weigh in on whether the behaviour change is wanted at all, so the note describes what
actually lands — say the word and I will push it straight away.

---

Drafted-by: Claude Code (Opus 5); reviewed by @Eason09053360 before posting

[ColtenOuO]

Thanks for the steer — I did the wider check before taking this to the list.

Devlist thread: https://lists.apache.org/thread/v7wonnnlf2t444ojgkmdx0j03cw51op3

What the audit found

I ran every airflow CLI command that takes an identifier, looks one thing up and prints it to stdout, in Breeze against a migrated metadata DB — redirecting stdout and stderr to separate files so the two streams could be told apart and sized:
skip...

Maybe some of this can be added in the PR description? That will be helpful for reviwer more understand what this PR do and its scope of influence

[potiuk]

Hello @Eason09053360 - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 33 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Return only the latest Dag version from iter_all_latest_version_dags #70935 - Return only the latest Dag version from iter_all_latest_version_dags
• Fix airflow config get-value silently succeeding on a missing option #72145 - Fix airflow config get-value silently succeeding on a missing option
• Fix airflowctl tracebacks on an unusable credentials file #72468 - Fix airflowctl tracebacks on an unusable credentials file
• Make suppress_logs_and_warning CLI decorator return the wrapped result #72600 - Make suppress_logs_and_warning CLI decorator return the wrapped result
• Fix dateless dag.test and tasks test destroying unrelated Dag runs #72656 - Fix dateless dag.test and tasks test destroying unrelated Dag runs
• Fix airflowctl commands crashing instead of printing their result #72675 - Fix airflowctl commands crashing instead of printing their result
• Show a clean error when airflow backfill create targets an unknown Dag #72893 - Show a clean error when airflow backfill create targets an unknown Dag
• Fix tasks clear --task-regex matching as a plain substring #72941 - Fix tasks clear --task-regex matching as a plain substring
• Speed up airflow dags list on deployments with many Dags #73033 - Speed up airflow dags list on deployments with many Dags
• Fix airflow dags next-execution crashing on --field data_interval.start #73070 - Fix airflow dags next-execution crashing on --field data_interval.start
• Fix airflow connections import corrupting JSON values in .env files #73083 - Fix airflow connections import corrupting JSON values in .env files
• Fix structlog log assertions never matching a single-field dict #73112 - Fix structlog log assertions never matching a single-field dict
• Fix misleading type errors from expand_kwargs and default_args #73120 - Fix misleading type errors from expand_kwargs and default_args
• Fix bare traceback from kubernetes cleanup-pods without kube config #73121 - Fix bare traceback from kubernetes cleanup-pods without kube config
• Fix airflowctl pools export/import dropping pool team ownership #73132 - Fix airflowctl pools export/import dropping pool team ownership
• Mask extra and credentials in connections list --hide-sensitive #73157 - Mask extra and credentials in connections list --hide-sensitive
• Fix missing task alert emails on Dags using native template rendering #73228 - Fix missing task alert emails on Dags using native template rendering
• Stop providers lazy-loaded from writing the default config #73348 - Stop providers lazy-loaded from writing the default config
• Fix api-server --apps silently dropping apps and accepting typos #73371 - Fix api-server --apps silently dropping apps and accepting typos
• Fix Task SDK dry-run mode crashing on task instance start #73373 - Fix Task SDK dry-run mode crashing on task instance start
• Fix CLI --bundle-name finding no Dags in Git bundles #73377 - Fix CLI --bundle-name finding no Dags in Git bundles
• Fix empty audit log dag_id for DAG.cli() subcommands #73379 - Fix empty audit log dag_id for DAG.cli() subcommands
• Drop ignored --bundle-name and --dagfile-path from DAG.cli() #73387 - Drop ignored --bundle-name and --dagfile-path from DAG.cli()
• Fix indexing mapped task results with a NumPy integer #73400 - Fix indexing mapped task results with a NumPy integer
• Respect maximum_page_limit in batch list endpoints #73409 - Respect maximum_page_limit in batch list endpoints
• Stop the JWT revocation check stalling the API server event loop #73422 - Stop the JWT revocation check stalling the API server event loop
• Fix task instance 404 detail being a JSON array instead of a string #73424 - Fix task instance 404 detail being a JSON array instead of a string
• API: Remove unreachable Accept branch and last deprecated 422 alias #73463 - API: Remove unreachable Accept branch and last deprecated 422 alias
• API: Cap run_ids on the grid TI summaries stream endpoint #73465 - API: Cap run_ids on the grid TI summaries stream endpoint
• Rate-limit JWKS fetch attempts while the endpoint is down #73472 - Rate-limit JWKS fetch attempts while the endpoint is down
• UI: Fix grid columns vanishing when a Dag version has been cleaned #73514 - UI: Fix grid columns vanishing when a Dag version has been cleaned

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• Fix scheduler refusing to start when [scheduler] only_idle is enabled #73141 - Fix scheduler refusing to start when [scheduler] only_idle is enabled
• Batch Team lookups when syncing Dag bundles to the database #73154 - Batch Team lookups when syncing Dag bundles to the database

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting