Validate required/unit-constrained UC fields early in bundle validate - #5818
Merged
radakam merged 15 commits intoJul 16, 2026
Merged
Conversation
Collaborator
Integration test reportCommit: 1ed565c
10 interesting tests: 4 SKIP, 4 flaky, 2 RECOVERED
Top 9 slowest tests (at least 2 minutes):
|
radakam
marked this pull request as ready for review
July 3, 2026 11:29
radakam
force-pushed
the
cli-fix-bundle-validate-required-fields-and-retention-units
branch
from
July 6, 2026 13:54
cfbbb09 to
998cbdf
Compare
radakam
force-pushed
the
cli-fix-bundle-validate-required-fields-and-retention-units
branch
from
July 7, 2026 07:00
998cbdf to
6eb36c8
Compare
radakam
force-pushed
the
cli-fix-bundle-validate-required-fields-and-retention-units
branch
from
July 7, 2026 13:42
6eb36c8 to
81814b5
Compare
radakam
had a problem deploying
to
test-trigger-is
July 13, 2026 13:14 — with
GitHub Actions
Failure
Reject missing sql_warehouse name, missing grant principal, and out-of-range catalog/schema custom_max_retention_hours at validate/plan time instead of letting them pass and fail later at deploy with low-context backend errors. DECO-27550
The retention range (0 or 168-720 hours) is a backend policy value that could change server-side; hardcoding it in the CLI risks rejecting configs the backend would accept. Keep only the stable presence checks (sql_warehouse name, grant principal).
radakam
force-pushed
the
cli-fix-bundle-validate-required-fields-and-retention-units
branch
from
July 13, 2026 13:22
d10fb7a to
556d8e5
Compare
radakam
had a problem deploying
to
test-trigger-is
July 13, 2026 13:30 — with
GitHub Actions
Failure
Iterate b.Config.Resources.SqlWarehouses directly instead of dyn, matching the adjacent dashboards validation. Addresses review feedback.
Iterate the six grant-bearing resource types directly instead of dyn, and drop the now-unused isMissingOrEmptyString helper. Addresses review feedback.
shreyas-goenka
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me. Just one minor comment.
Revert the static per-resource-type grant principal validation back to the dyn-based walk over resources.*.*.grants[*], so any resource with a grants field is validated without enumerating types. Rename warnForMissingBackendFields to warnForMissingGrantPrincipals for clarity.
shreyas-goenka
approved these changes
Jul 16, 2026
radakam
enabled auto-merge
July 16, 2026 07:46
radakam
deleted the
cli-fix-bundle-validate-required-fields-and-retention-units
branch
July 16, 2026 08:33
Collaborator
Integration test reportCommit: c8c397f
114 interesting tests: 100 FAIL, 6 flaky, 4 RECOVERED, 2 KNOWN, 2 SKIP
Top 50 slowest tests (at least 2 minutes):
|
deco-sdk-tagging Bot
added a commit
that referenced
this pull request
Jul 22, 2026
## Release v1.9.0 ### CLI * `databricks auth profiles` no longer stalls on an unreachable workspace and instead fails validation after 5 seconds per host ([#5928](#5928)). * Fixed `databricks fs rm -r` failing on UC Volumes backed by GCS when a directory becomes empty during recursive deletion ([#5958](#5958)). * You can now ask questions about your data directly from the CLI with `databricks genie ask "..."`. Genie answers natural-language questions ("what were total sales last month?", "which tables are in the sales catalog?"), runs the query inside Databricks, and renders the answer in the terminal. This promotes the former `databricks experimental genie ask` command; the experimental alias still works but is deprecated and will be removed in a future release ([#6010](#6010)). ### Bundles * `bundle validate` now reports a clear error when a `sql_warehouse` is missing a `name` (including whitespace-only names), and a warning when a grant is missing a `principal` ([#5818](#5818)). * Bundle templates now scaffold an `AGENTS.md` that points coding agents at Databricks AI Tools, alongside a minimal `CLAUDE.md` that includes it via `@AGENTS.md` ([#5996](#5996)). * `bundle generate job` can now download workspace files referenced by `spark_python_task`, rewriting them to a relative path like it already does for notebooks. This is opt-in via the `--download-spark-python-files` flag ([#5799](#5799)). * Simplified the `default-minimal` bundle template and added an alias `databricks bundle init empty` ([#5899](#5899)). * Add support for the `instance_pools` resource type in Declarative Automation Bundles. Instance pools are only supported in direct deployment mode. * Do not emit "unknown field" warnings for YAML anchors grouped in a list or map, matching the existing suppression for standalone anchors ([#5975](#5975)). * Provide an actionable error message if databricks.yml is missing or DATABRICKS_BUNDLE_ROOT is invalid ([#5953](#5953)). ### Dependency Updates * Bump `github.com/databricks/databricks-sdk-go` from v0.154.0 to v0.160.0 ([#5982](#5982)). * Bump Terraform provider from v1.121.0 to v1.122.0 ([#5977](#5977)).
renaudhartert-db
pushed a commit
to yansonggao-db/cli
that referenced
this pull request
Jul 24, 2026
## Changes Promote the `grant principal is required` diagnostic from a warning to a hard validation error, so `bundle validate`/`plan`/`deploy` fail up front when a `grants[*]` entry has no `principal`. ## Why databricks#5818 added this as a warning only because the backend contract was unconfirmed. It's now confirmed: on the direct engine the securable is created and *then* the grants PATCH fails with `400 INVALID_PARAMETER_VALUE — at least one of 'principal' or 'principal_id' must be set`, leaving a partially-applied deployment. `principal` is the only way to name a grantee in a bundle (the config struct has no `principal_id`), so a missing one is always invalid. Erroring at validation stops the deploy before anything is created. ## Tests Updated `acceptance/bundle/validate/grants_required_principal` to assert the error and that `bundle deploy` aborts with zero Unity Catalog requests (no partial deploy).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
bundle validate(and thereforeplan/deploy) now reports two UC fields that the SDK models as optional but the backend treats differently:sql_warehouses.*.name— errorsql_warehouse name is required(backend-confirmed as required; whitespace-only names are also rejected, matching the backend'sname.trim.nonEmpty).grants[*].principal— warninggrant principal is required, on every securable that supports grants (catalogs, schemas, volumes, external_locations, registered_models, vector_search_indexes). Kept as a warning since the backend contract is unconfirmed.Implemented in the existing
validate:requiredmutator (runs inphases.Initialize(), covering validate/plan/deploy), following the existing dashboard bespoke-validation precedent. Validation diagnostics are sorted deterministically so multiple messages have stable ordering.Why
These fields are modeled as loosely-typed/optional (
json:"...,omitempty"), sobundle validateandbundle planpass while the deploy is rejected by the backend with late, low-context 400s. Discovered via fuzz testing; affects both the Terraform and direct engines. Reporting the offending field by name at validate time is much more actionable.Tests
acceptance/bundle/validate/:sql_warehouse_required_name/(both engines; covers a missing name and a whitespace-only name)grants_required_principal/(verifies a missing principal warns while a valid grant passes)empty_resourcesgolden files that surface thesql_warehouse name is requirederror.