Uh oh!
There was an error while loading. Please reload this page.
acc: add empty-grants invariant config, disable failing migrate variant - #6055
Merged
Conversation
Adds a schema_empty_grants invariant config (schema with grants: []) found by fuzz testing. The migrate variant fails because Terraform records no grants resource for an empty list, so the direct plan shows a spurious grants -> create after migrate. That variant is disabled in migrate/test.toml with a comment containing the full error; the other invariants pass and keep running it.
denik
approved these changes
Jul 24, 2026
radakam
marked this pull request as ready for review
July 24, 2026 07:40
eng-dev-ecosystem-bot
commented
Jul 24, 2026
Collaborator
Integration test reportCommit: 51dbbc1
8 interesting tests: 4 RECOVERED, 4 SKIP
Top 3 slowest tests (at least 2 minutes):
|
eng-dev-ecosystem-bot
commented
Jul 24, 2026
Collaborator
Integration test reportCommit: e5a3bb4
46 interesting tests: 30 flaky, 8 FAIL, 5 RECOVERED, 2 SKIP, 1 KNOWN
Top 50 slowest tests (at least 2 minutes):
|
janniklasrose pushed a commit
that referenced
this pull request
Aug 5, 2026
) ## Changes Add an optional `SkipCreate` to the direct engine's `IResource`: a resource can report that a desired state needs no create, and `makePlan` omits the node instead of planning one. `ResourceGrants` implements it for an empty grants list. It is only consulted for nodes with no state entry. A node that already has state keeps its plan entry, so emptying a previously deployed `grants:` list still plans the revoke. ## Why Terraform writes no `databricks_grants` resource for an empty list, so `bundle deployment migrate` records no state for the grants node, and `bundle plan` showed a spurious `grants -> create` that contradicted migrate's "no actions planned". Normalizing empty grants away in config (as `apply_bundle_permissions` does for permissions) would instead send an emptied list to the delete branch, where grants' no-op `DoDelete` keeps the grants. _Found by fuzz testing._ ## Tests * Re-enables the `schema_empty_grants` migrate invariant (excluded in #6055 pending this fix). * New `grants/schemas/remove_all` test: emptying a populated list still revokes. Plan summary is per-engine since direct keeps the emptied node in state as unchanged. * Unit tests for the empty, unset, and populated cases, called through the adapter.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
schema_empty_grantsacceptance invariant (a schema withgrants: []), found by fuzz testing. Because Terraform records no grants resource for an empty list, the direct engine's post-migrate plan shows a spuriousgrants -> create, so that one migrate variant is disabled inmigrate/test.toml(with the full error in a comment) while the other invariants keep running.