The tofu plugin's credential NeedsAuth rules are missing needsauth.ForCommand("workspace"), which is present in the equivalent Terraform plugin.
Current plugins/tofu/terraform.go:
NeedsAuth: needsauth.IfAny(
needsauth.ForCommand("refresh"),
needsauth.ForCommand("init"),
needsauth.ForCommand("state"),
needsauth.ForCommand("plan"),
needsauth.ForCommand("apply"),
needsauth.ForCommand("destroy"),
needsauth.ForCommand("import"),
needsauth.ForCommand("test"),
// "workspace" is missing
),
Because tofu workspace can switch between workspaces that use different provider credentials, it should behave identically to terraform workspace and inject credentials. The fix is to add needsauth.ForCommand("workspace") to the list.
The tofu plugin's credential NeedsAuth rules are missing needsauth.ForCommand("workspace"), which is present in the equivalent Terraform plugin.
Because tofu workspace can switch between workspaces that use different provider credentials, it should behave identically to terraform workspace and inject credentials. The fix is to add needsauth.ForCommand("workspace") to the list.