Uh oh!
There was an error while loading. Please reload this page.
Modify grants to use SDK types - #4666
Merged
Merged
Conversation
denik
marked this pull request as ready for review
March 5, 2026 11:43
denik
requested review from
andrewnester, anton-107, pietern, shreyas-goenka and simonfaltum
as code ownersMarch 5, 2026 11:43
Collaborator
Commit: 8653aba
25 interesting tests: 8 FAIL, 7 KNOWN, 7 SKIP, 2 flaky, 1 BUG
Top 20 slowest tests (at least 2 minutes):
|
Removes five custom grant types (Grant, SchemaGrant, CatalogGrant, ExternalLocationGrant, VolumeGrant) and their associated per-resource privilege enums. All resources now use catalog.PrivilegeAssignment directly from the Databricks SDK. Also removes the reflection-based conversion in PrepareGrantsInputConfig replacing it with a simple type assertion, and removes the now-unnecessary TestSchemaGrantPrivilegesExhaustive test that maintained the enum sync. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…rants INSERT is not a valid Unity Catalog privilege. After switching from the custom Grant type (which used []string for privileges) to catalog.PrivilegeAssignment from the SDK, the privileges field is now enum-validated. MODIFY is the appropriate UC privilege for write operations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CatalogGrant/SchemaGrant/VolumeGrant and their privilege enums were replaced by the unified PrivilegeAssignment/Privilege types. Add aliases in each namespace's __init__.py so existing code continues to work without changes. The generator now reads codegen/aliases_patch.py and emits OldName = NewName assignments into each namespace's __init__.py, including the old names in __all__. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Validates that old per-resource grant aliases (SchemaGrant, SchemaGrantPrivilege) and new unified types (PrivilegeAssignment, Privilege) both work in bundle validate, producing identical output. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
andrewnester
approved these changes
Mar 6, 2026
| "resources.apps.*.resources[*].uc_securable": {"permission", "securable_full_name", "securable_type"}, | ||
| "resources.catalogs.*": {"name"}, | ||
| "resources.catalogs.*.grants[*]": {"privileges", "principal"}, |
Contributor
There was a problem hiding this comment.
Is it expected that now these fields are not required?
ContributorAuthor
There was a problem hiding this comment.
yes, omitempty annotation is different between SDK and our own types.
lennartkats-db
approved these changes
Mar 6, 2026
pietern
approved these changes
Mar 6, 2026
denik
commented
Mar 6, 2026
ContributorAuthor
Alert integration tests timed out, does not seem related. |
denik
disabled auto-merge
March 6, 2026 15:13
Uh oh!
There was an error while loading. Please reload this page.
eng-dev-ecosystem-bot
commented
Mar 6, 2026
Collaborator
Commit: c779b91
45 interesting tests: 16 RECOVERED, 12 FAIL, 8 flaky, 7 KNOWN, 1 BUG, 1 SKIP
Top 50 slowest tests (at least 2 minutes):
|
shreyas-goenka added a commit
that referenced
this pull request
Mar 6, 2026
After rebase on main, adapt to #4666 which switched grants from custom per-resource types to SDK catalog.PrivilegeAssignment. Remove stale per-resource grant annotation entries (descriptions now come from OpenAPI), regenerate schema and python codegen, and clean up .wsignore references to deleted docsgen files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shreyas-goenka added a commit
that referenced
this pull request
Mar 9, 2026
After rebase on main, adapt to #4666 which switched grants from custom per-resource types to SDK catalog.PrivilegeAssignment. Remove stale per-resource grant annotation entries (descriptions now come from OpenAPI), regenerate schema and python codegen, and clean up .wsignore references to deleted docsgen files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
denik added a commit
that referenced
this pull request
Mar 11, 2026
## Changes Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not. This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning. Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources. ## Why Simplification. Supports autogeneration of resource, no need to manually provide allowed levels. Similar change for grants: #4666 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
deco-sdk-taggingBot
added a commit
that referenced
this pull request
Mar 12, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
rauchy pushed a commit
that referenced
this pull request
Mar 17, 2026
## Changes Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not. This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning. Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources. ## Why Simplification. Supports autogeneration of resource, no need to manually provide allowed levels. Similar change for grants: #4666 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
rauchy pushed a commit
that referenced
this pull request
Mar 17, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
denik added a commit
that referenced
this pull request
May 20, 2026
## Changes - Replace five custom grant types (Grant, SchemaGrant, CatalogGrant, ExternalLocationGrant, VolumeGrant) and their associated per-resource privilege enums with catalog.PrivilegeAssignment from the Databricks SDK. - Simplifies PrepareGrantsInputConfig in bundle/direct/dresources/grants.go: removes the reflection-based conversion loop and replaces it with a direct type assertion, now that all grant slices share the same type. ## Why Maintaining custom types is manual process. This prevents us from moving to autogenerated resources. This also causes issues for users where definition in CLI lags behind. #3821#4008 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
denik added a commit
that referenced
this pull request
May 20, 2026
## Changes Replace custom permission types (JobPermission, PipelinePermission, AlertPermission, etc.) and their associated per-resource permission level enums with a single generic-based permission type that embeds Level type from SDK where it's available and iam.PermissionLevel where it is not. This affects enum validation, previously, our types (except for AlertPermission) did not have associated list of values, which means invalid values were not producing a warning. Note, alerts, dashboards, database_instances do not have dedicated permission level type, so their list of possible values includes all valid values for levels for all resources. ## Why Simplification. Supports autogeneration of resource, no need to manually provide allowed levels. Similar change for grants: #4666 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
denik pushed a commit
that referenced
this pull request
May 20, 2026
## Release v0.294.0 ### Bundles * Modify grants to use SDK types ([#4666](#4666)) * Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](#4686)) ### Dependency updates * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](#4631), [#4695](#4695))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Why
Maintaining custom types is manual process. This prevents us from moving to autogenerated resources. This also causes issues for users where definition in CLI lags behind. #3821#4008