Spurious "Commit Changes" modal after bulk tagging secrets on Overview page

[flare19]

Product

Secret Manager

Describe the bug

After bulk-assigning tags to multiple secrets on the Overview page, hovering over an affected secret and clicking "View Tags" shows an empty tag list despite the bulk tag operation succeeding. This immediately triggers a spurious "Commit Changes" modal showing the tag as removed (before: tag1, after: -). If the user commits, the tag is permanently deleted server-side. If the user declines, the tag reappears correctly in the View Tags popover.

To Reproduce

1. Create two or more secrets on the Overview page
2. Create a tag (e.g. tag1)
3. Enable batch mode
4. Select all secrets and click the add tags button in the selection panel
5. Add tag1 and apply — confirm the success notification appears
6. Immediately hover over one of the affected secrets and click View Tags
7. Observe that the tag list is empty despite the bulk tag succeeding
8. Observe the spurious "Commit Changes" modal appears showing tag1 as removed
9. Click Commit Changes — the tag is permanently deleted server-side

Expected behavior

When bulk-assigning tags to secrets, the tags should appear immediately in the View Tags popover after the operation succeeds. No pending changes modal should be triggered, as the user has not made any manual edits to the affected secrets.

Screenshots

No response

Deployment Type

Self-hosted

Additional context

No response

[linear]

ENG-5234

[jaydeep-pipaliya]

Hi, I've traced the root cause and would like to fix this.

Root cause: in SecretTagForm.tsx, the useEffect that calls onTagsChange fires on the initial mount (after the 500ms debounce). When a secret's tags are applied via bulk-tagging, the parent row's form is still initialized with [] from before the tags existed. React Hook Form freezes defaultValues at mount time and doesn't update them when props change. So the form's watchedTags stays at [] while originalTagsRef is updated to reflect the new server tags. When the user opens the tag popover, SecretTagForm mounts and—even without any user interaction—fires onTagsChange([]) after 500ms. That sets the parent form's tags to [], which the batch auto-apply timer detects as a change vs the server state and creates a pending change.

Fix: skip the first onTagsChange call in the effect (guard with isFirstRun = useRef(true)). On mount, the component should not propagate its initial form value upstream—only subsequent user interactions should. Assigning myself to implement this.