Support team-scoped secrets in LocalFilesystemBackend

[FrankYang0529]

Why

• multi-team.rst says the local filesystem secrets backend is team-aware. However, LocalFilesystemBackend.get_connection() and get_variable() accept team_name but never use it, so every team gets the same global value and there is no way to define a team-scoped entry in the file.

airflow/airflow-core/docs/core-concepts/multi-team.rst

Line 106 in 123b1be

Airflow's secrets backends, including: environment variables, metastore and local filesystem are team-aware. Custom

How

• A <team>___<id> key in the connections or variables file holds that team's value. The lookup tries the team key first and falls back to the plain key. ___ is the separator the environment variables backend already uses.
• With [core] multi_team off, nothing changes: the backend matches keys verbatim.

Verification

• uv run --frozen --project airflow-core pytest airflow-core/tests/unit/always/test_secrets_local_filesystem.py

---

Was generative AI tooling used to co-author this PR?

• Yes - Claude Code

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[potiuk]

Hello @FrankYang0529 - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 30 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Avoid deactivating configured Dag bundles on transient get bundle errors #69698 - Avoid deactivating configured Dag bundles on transient get bundle errors
• Add gzip compression option for GCS remote task logs #71678 - Add gzip compression option for GCS remote task logs
• Fix comma-separated selected_fields in BigQuery to SQL transfers #71775 - Fix comma-separated selected_fields in BigQuery to SQL transfers
• Fix the API server silently ignoring its gunicorn worker hooks #71837 - Fix the API server silently ignoring its gunicorn worker hooks
• Fix docs omitting asset from the Dag discovery safe-mode heuristic #72027 - Fix docs omitting asset from the Dag discovery safe-mode heuristic
• Add missing Druid Ingest connection type #72104 - Add missing Druid Ingest connection type
• Fix scheduler crash when the Kafka event producer plugin is enabled #72138 - Fix scheduler crash when the Kafka event producer plugin is enabled
• Fix unscheduled tasks left on a stale Dag version #72153 - Fix unscheduled tasks left on a stale Dag version
• Make AzureBatchOperator batch_max_retries take effect #72317 - Make AzureBatchOperator batch_max_retries take effect
• Fix airflow.utils.context deprecation shim returning a module object #72593 - Fix airflow.utils.context deprecation shim returning a module object
• Support team-scoped secrets in LocalFilesystemBackend #72626 - Support team-scoped secrets in LocalFilesystemBackend
• Honour dag_ignore_file_syntax in Task SDK and example plugin loading #72802 - Honour dag_ignore_file_syntax in Task SDK and example plugin loading
• Restore CLI commands from custom executors and auth managers #72858 - Restore CLI commands from custom executors and auth managers
• Restore helpful error for unregistered priority weight strategies #72884 - Restore helpful error for unregistered priority weight strategies
• Fix flaky test_trigger_log in triggerer job tests #72919 - Fix flaky test_trigger_log in triggerer job tests
• Fix API server failing to start when [api] access_logfile is set #72920 - Fix API server failing to start when [api] access_logfile is set
• Fix missing task display name and map index in API audit logs #73020 - Fix missing task display name and map index in API audit logs
• Fail Gemini batch job operators when the job does not succeed #73029 - Fail Gemini batch job operators when the job does not succeed
• Fix extra Dag versions from template field callables if paths change #73031 - Fix extra Dag versions from template field callables if paths change
• Fix Dags staying blocked by max_active_runs until the next parse #73032 - Fix Dags staying blocked by max_active_runs until the next parse
• Reject async callables in @task.virtualenv and @task.external_python #73081 - Reject async callables in @task.virtualenv and @task.external_python
• Fix env var names in airflow config list for dotted and team sections #73136 - Fix env var names in airflow config list for dotted and team sections
• Fix OpenLineage jobDependencies run ID after upstream task is cleared #73247 - Fix OpenLineage jobDependencies run ID after upstream task is cleared
• Fix SFTPSensor skipping python_callable in deferrable mode #73312 - Fix SFTPSensor skipping python_callable in deferrable mode

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• Add KafkaSharedStreamProducer and KafkaSharedStreamTrigger #68625 - Add KafkaSharedStreamProducer and KafkaSharedStreamTrigger
• Add rerun policy for rollups when an upstream partition is re-run #68778 - Add rerun policy for rollups when an upstream partition is re-run
• Replace AirflowException with ValueError in ProduceToTopicOperator #70351 - Replace AirflowException with ValueError in ProduceToTopicOperator
• Catch stale entries in the Java SDK dependency trust list #71869 - Catch stale entries in the Java SDK dependency trust list
• Support priority_weight in EdgeExecutor #72057 - Support priority_weight in EdgeExecutor
• Speed up the event logs API by loading only display names #73021 - Speed up the event logs API by loading only display names

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting