Skip to content

Reject empty/control-char names and incomplete pipeline libraries at … - #6305

Draft
radakam wants to merge 5 commits into
mainfrom
fix-illegal-empty-identifiers
Draft

Reject empty/control-char names and incomplete pipeline libraries at …#6305
radakam wants to merge 5 commits into
mainfrom
fix-illegal-empty-identifiers

Conversation

@radakam

@radakam radakam commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Changes

Reject empty, blank, and control-character resource identifiers (and incomplete pipeline library paths) during bundle validation, so these configs fail at initialize instead of later with API 400 / invalid-URL errors.

  • Identifier checks use an explicit allowlist of known identifier fields (not _name heuristics), with OpenAPI required-field warnings kept separate.
  • Missing resource names that previously only warned (e.g. models, apps) now error; omitted UC parents still warn, while explicit empty strings are rejected.
  • Incomplete pipeline file / notebook / glob entries without paths are rejected.
  • Diagnostics use structural dyn.NewPath (no panic on resource keys with path metacharacters) and name the offending control character in the detail.

Why

Found by fuzz testing.

Tests

Acceptance: invalid_identifiers, required, empty_resources, dashboard/sql_warehouse required-name cases, volume_defaults, models validate

…validate

validate --strict previously accepted empty model names, UC/serving names with
control characters, and pipeline file: {}. Those fail later with API 400 or
invalid-URL errors; fail during initialize instead.
@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 16a7c53

Run: 32141393319

Env 🟨​KNOWN 💚​RECOVERED 🙈​SKIP ✅​pass 🙈​skip Time
🟨​ aws linux 3 1 4 286 1150 10:07
🟨​ aws windows 3 1 4 288 1148 7:21
🟨​ azure linux 3 1 4 285 1150 10:21
🟨​ azure windows 3 1 4 287 1148 7:59
💚​ gcp linux 1 5 286 1150 7:30
💚​ gcp windows 1 5 288 1148 5:42
8 interesting tests: 4 SKIP, 3 KNOWN, 1 RECOVERED
Test Name aws linux aws windows azure linux azure windows gcp linux gcp windows
💚​ TestAccept 💚​R 💚​R 💚​R 💚​R 💚​R 💚​R
🙈​ TestAccept/bundle/invariant/no_drift 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🙈​ TestAccept/ssh/connection 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S 🙈​S
🟨​ TestFetchRepositoryInfoAPI_FromRepo 🟨​K 🟨​K 🟨​K 🟨​K 🙈​S 🙈​S
🟨​ TestFetchRepositoryInfoAPI_FromRepo/root 🟨​K 🟨​K 🟨​K 🟨​K
🟨​ TestFetchRepositoryInfoAPI_FromRepo/subdir 🟨​K 🟨​K 🟨​K 🟨​K
Top 6 slowest tests (at least 2 minutes):
duration env testname
5:42 azure windows TestAccept
5:37 aws windows TestAccept
5:34 gcp windows TestAccept
3:56 azure linux TestAccept
3:52 gcp linux TestAccept
3:47 aws linux TestAccept

Keep omitted UC parent fields as warnings, point diagnostics at the field path, tighten tests, and drop duplicate empty-name acceptance coverage.
Build diagnostic paths structurally with dyn.NewPath instead of parsing
concatenated strings: a resource key containing a path metacharacter (e.g.
"weird[0]key") made MustPathFromString panic during bundle validate.

Drive the identifier checks off generated.RequiredFields rather than a
hand-picked list of resource types, so control characters and blank values are
caught consistently (vector search endpoints, apps, experiments and others were
previously silent). Explicit empty strings on UC parent fields are now rejected
too; omitted parents keep warning.

Stop short-circuiting before warnForMissingFields so one validate run reports
every issue, and name the offending character in the diagnostic detail since
control characters are invisible in terminal output.
Collapse OpenAPI warnings, backend-only errors, and blank/control-char
checks into a compiled rule set so nested fields keep accurate messages
and validate stays a single config walk.
Split OpenAPI required-field warnings from identifier checks and drop the
heuristic rule engine so validation policy stays readable and intentional.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants