Reject dangling ${resources.*} refs at validate time - #6300
Draft
radakam wants to merge 1 commit into
Draft
Conversation
validate --strict previously accepted references to undefined resources; deploy then failed with an invalid dependency. Fail early during initialize with the same "reference does not exist" error.
denik
reviewed
Aug 18, 2026
| // Identity is resources.<group>.<name>; trailing fields (.id, .permissions, …) | ||
| // are resolved at deploy time and are not required to exist in config. | ||
| resourceKey := p[:3] | ||
| v, err := dyn.GetByPath(b.Config.Value(), resourceKey) |
Contributor
There was a problem hiding this comment.
This checks dynamic tree but references can be to things that are not in the config (remote references in direct and terraform-specific fields).
So it's too strict.
Contributor
There was a problem hiding this comment.
I think once we remove terraform we can think about validating these but for now not worth it.
Collaborator
Integration test reportCommit: 2b057b9
8 interesting tests: 4 SKIP, 3 KNOWN, 1 RECOVERED
Top 6 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add
validate.DanglingResourceReferencesin initialize so${resources.*}refs to undefined resources fail at validate (and deploy) instead of later with an invalid dependency.Why
bundle validate --strictaccepted configs likegroup_name: ${resources.jobs.does_not_exist.id}. Direct deploy then failed withinvalid dependency … no such node. Catch the misconfiguration at validate.Found by fuzz testing.
Tests
origin/main: validate OK, direct deploy → invalid dependencyreference does not existbundle/validate/dangling_resource_refs(terraform & direct)