supplying --workspace-env REMOTE_DEV_TRUST_PROJECTS=1 to devpod up explicitly is arguably even more annoying...

I am not sure I follow. Could there be a case where the user is working on a repository and wants to grant trust through env or through the trust dialog?

For security purposes, I think the default should be to deny unless an override is supplied.

The dialog provides three choices (see https://www.jetbrains.com/help/idea/project-security.html#projects_security):

• "Don't Open" - this is not a viable choice: if you do not want to open the project because you do not trust it, do not run devpod up ;)
• "Trust Project" - I think that this is the intention of running devpod up, so this should not just be the default but the only meaningful choice;
• "Preview in Safe Mode" - I personally see no use for this, nor is it (I think) an option for the non-JetBrains IDEs; requiring the developer to click on something to be able to work with the code seems unnecessary to me; but if you think that the default for JetBrains workspaces should be to deny, I am not going to argue - as long as a way to seamlessly remove this dialog is provided.

I am fine with this change, but let's log a warning message stating that it is opening in unsafe (or trusted) mode.

If there is a demographic of 1 user, I don't see any reason for us to not support that preference, and we could reevaluate at a later time.

I am fine with this change, but let's log a warning message stating that it is opening in unsafe (or trusted) mode.

If there is a demographic of 1 user, I don't see any reason for us to not support that preference, and we could reevaluate at a later time.

In the current form, this pull request no longer auto-sets anything; instead, it provides a way to supply the devpod up --workspace-env option via an environment variable DEVPOD_WORKSPACE_ENV. This is yet another step in the direction of enabling describing the environment via environment variables - and in this case, it can be used (by those who figure it out ;)) to set the default to "trust the projects that I open".

What do you think - should I re-instate the trust dialog suppression (with a warning you suggested) or leave it at that? Thanks!

the trust dialog suppression (with a warning you suggested)

If you are using IntelliJ on the regular basis, then I would add it. It improves the UX.

I do, but my UX will be fine with this pull request as is: it lets me set DEVPOD_WORKSPACE_ENV="REMOTE_DEV_TRUST_PROJECTS=1" in my .envrc file, and the "trust" pop up does not pop up any more...

I think for now I will just add the general facility to use environment variables DEVPOD_WORKSPACE_ENV (and DEVPOD_SINGLE_MACHINE).

@skevetter for some reason, my pull request branches do not get deleted on merge...