Skip to content

Add a new boolean field 'sensitive' for variables - #7288

Open
andrewnester wants to merge 2 commits into
mainfrom
fix/sensitive-redaction
Open

Add a new boolean field 'sensitive' for variables#7288
andrewnester wants to merge 2 commits into
mainfrom
fix/sensitive-redaction

Conversation

@andrewnester

@andrewnester andrewnester commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Changes

Add a new boolean field 'sensitive' for variables

Why

This allows to mark certain variables senstive and as a result all the other variable values won't be redacted in validate json output

Fixes #7099

Tests

Added accptance tests

@andrewnester
andrewnester requested review from a team as code owners November 2, 2026 13:18
@github-actions github-actions Bot added the DABs DABs related issues label Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Commit: 2a09d2a26 | Workflow run

Regression test report

Selected 3 changed tests (limit=20, 0 not selected)

6 tests: regression=6 unreleased=0 coverage=0 failing=0

test branch main (aae07ca) latest (v1.23.0)
TestAccept/bundle/refschema/DMS= ✅ ❌ ❌
TestAccept/bundle/refschema/DMS=true ✅ ❌ ❌
TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS= ✅ ❌ ❌
TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=true ✅ ❌ ❌
TestAccept/bundle/variables/sensitive/DMS= ✅ ❌ ❌
TestAccept/bundle/variables/sensitive/DMS=true ✅ ❌ ❌
TestAccept/bundle/refschema/DMS=: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/root.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=852868020/001/output/root.txt
        @@ -148,7 +148,6 @@
         environments.*.variables.*.lookup.query	string	INPUT
         environments.*.variables.*.lookup.service_principal	string	INPUT
         environments.*.variables.*.lookup.warehouse	string	INPUT
        -environments.*.variables.*.sensitive	bool	INPUT
         environments.*.variables.*.type	variable.VariableType	INPUT
         environments.*.variables.*.value	any	INPUT
         environments.*.workspace	*config.Workspace	INPUT
        @@ -365,7 +364,6 @@
         targets.*.variables.*.lookup.query	string	INPUT
         targets.*.variables.*.lookup.service_principal	string	INPUT
         targets.*.variables.*.lookup.warehouse	string	INPUT
        -targets.*.variables.*.sensitive	bool	INPUT
         targets.*.variables.*.type	variable.VariableType	INPUT
         targets.*.variables.*.value	any	INPUT
         targets.*.workspace	*config.Workspace	INPUT
        @@ -449,7 +447,6 @@
         variables.*.lookup.query	string	INPUT
         variables.*.lookup.service_principal	string	INPUT
         variables.*.lookup.warehouse	string	INPUT
        -variables.*.sensitive	bool	INPUT
         variables.*.type	variable.VariableType	INPUT
         variables.*.value	any	INPUT
         workspace	config.Workspace	INPUT

latest (v1.23.0):

acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/jobs.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=3721377662/001/output/jobs.txt
        @@ -193,8 +193,6 @@
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients	compute.ClientsTypes	ALL
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.jobs	bool	ALL
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.notebooks	bool	ALL
        -resources.jobs.*.job_clusters[*].serverless_compute	*jobs.JobClusterServerlessCompute	ALL
        -resources.jobs.*.job_clusters[*].serverless_compute.policy_id	string	ALL
         resources.jobs.*.job_clusters[*].serverless_compute_id	string	ALL
         resources.jobs.*.job_id	int64	REMOTE
         resources.jobs.*.lifecycle	resources.Lifecycle	INPUT
        @@ -233,42 +231,6 @@
         resources.jobs.*.tags.*	string	ALL
         resources.jobs.*.tasks	[]jobs.Task	ALL
         resources.jobs.*.tasks[*]	jobs.Task	ALL
        -resources.jobs.*.tasks[*].ai_function_task	*jobs.AiFunctionTask	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify	*jobs.AiClassifyFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.enable_rationales	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels	*jobs.AiClassifyFunctionInlineLabels	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels	[]jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*]	jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*].description	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*].name	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.instructions	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.multilabel	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract	*jobs.AiExtractFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.enable_citations	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.instructions	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.mode	jobs.AiExtractFunctionMode	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.schema	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document	*jobs.AiParseDocumentFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.description_element_types	[]jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.description_element_types[*]	jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.image_output_path	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.page_range	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table	*jobs.DeltaTableSource	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.input_column	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.merge_key_columns	[]string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.merge_key_columns[*]	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.table_name	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output	jobs.QualifiedName	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.catalog	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.schema	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.table	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.volume	*jobs.VolumeSource	ALL
        -resources.jobs.*.tasks[*].ai_function_task.volume.volume_path	string	ALL
         resources.jobs.*.tasks[*].ai_runtime_task	*jobs.AiRuntimeTask	ALL
         resources.jobs.*.tasks[*].ai_runtime_task.code_source_path	string	ALL
         resources.jobs.*.tasks[*].ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
        @@ -377,42 +339,6 @@
         resources.jobs.*.tasks[*].for_each_task.concurrency	int	ALL
         resources.jobs.*.tasks[*].for_each_task.inputs	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task	jobs.Task	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task	*jobs.AiFunctionTask	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify	*jobs.AiClassifyFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.enable_rationales	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels	*jobs.AiClassifyFunctionInlineLabels	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels	[]jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*]	jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*].description	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*].name	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.instructions	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.multilabel	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract	*jobs.AiExtractFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.enable_citations	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.instructions	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.mode	jobs.AiExtractFunctionMode	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.schema	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document	*jobs.AiParseDocumentFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.description_element_types	[]jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.description_element_types[*]	jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.image_output_path	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.page_range	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table	*jobs.DeltaTableSource	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.input_column	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.merge_key_columns	[]string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.merge_key_columns[*]	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.table_name	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output	jobs.QualifiedName	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.catalog	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.schema	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.table	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.volume	*jobs.VolumeSource	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.volume.volume_path	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task	*jobs.AiRuntimeTask	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.code_source_path	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
        @@ -1117,12 +1043,6 @@
         resources.jobs.*.trigger.file_arrival.min_time_between_triggers_seconds	int	ALL
         resources.jobs.*.trigger.file_arrival.url	string	ALL
         resources.jobs.*.trigger.file_arrival.wait_after_last_change_seconds	int	ALL
        -resources.jobs.*.trigger.job_completion	*jobs.JobCompletionTriggerConfiguration	ALL
        -resources.jobs.*.trigger.job_completion.if_status	jobs.JobCompletionTriggerConfigurationIfStatus	ALL
        -resources.jobs.*.trigger.job_completion.jobs	[]jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*]	jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*].job_id	string	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*].workspace_id	string	ALL
         resources.jobs.*.trigger.model	*jobs.ModelTriggerConfiguration	ALL
         resources.jobs.*.trigger.model.aliases	[]string	ALL
         resources.jobs.*.trigger.model.aliases[*]	string	ALL
        @@ -1166,17 +1086,6 @@
         resources.jobs.*.trigger_details[*].state.continuous.next_attempt_ms	int64	REMOTE
         resources.jobs.*.trigger_details[*].state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
         resources.jobs.*.trigger_details[*].state.file_arrival.using_file_events	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion	*jobs.JobCompletionTriggerState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states	[]jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*]	jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].has_seen_completion	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].is_deleted	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].job_id	string	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_completion_time	*time.Time	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_run_id	string	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].latest_non_matching_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].workspace_id	string	REMOTE
         resources.jobs.*.trigger_details[*].state.model	*jobs.ModelTriggerState	REMOTE
         resources.jobs.*.trigger_details[*].state.pause_status	jobs.PauseStatus	REMOTE
         resources.jobs.*.trigger_details[*].state.periodic	*jobs.PeriodicTriggerState	REMOTE
        @@ -1195,17 +1104,6 @@
         resources.jobs.*.trigger_state	*jobs.TriggerStateProto	REMOTE
         resources.jobs.*.trigger_state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
         resources.jobs.*.trigger_state.file_arrival.using_file_events	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion	*jobs.JobCompletionTriggerState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states	[]jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*]	jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].has_seen_completion	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].is_deleted	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].job_id	string	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_completion_time	*time.Time	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_run_id	string	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].latest_non_matching_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].workspace_id	string	REMOTE
         resources.jobs.*.trigger_state.pause_status	jobs.PauseStatus	REMOTE
         resources.jobs.*.trigger_state.sql_condition	*jobs.SqlConditionState	REMOTE
         resources.jobs.*.trigger_state.sql_condition.latest_condition_evaluation_satisfied	bool	REMOTE
        @@ -1229,12 +1127,6 @@
         resources.jobs.*.triggers[*].file_arrival.min_time_between_triggers_seconds	int	ALL
         resources.jobs.*.triggers[*].file_arrival.url	string	ALL
         resources.jobs.*.triggers[*].file_arrival.wait_after_last_change_seconds	int	ALL
        -resources.jobs.*.triggers[*].job_completion	*jobs.JobCompletionTriggerConfiguration	ALL
        -resources.jobs.*.triggers[*].job_completion.if_status	jobs.JobCompletionTriggerConfigurationIfStatus	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs	[]jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*]	jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*].job_id	string	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*].workspace_id	string	ALL
         resources.jobs.*.triggers[*].model	*jobs.ModelTriggerConfiguration	ALL
         resources.jobs.*.triggers[*].model.aliases	[]string	ALL
         resources.jobs.*.triggers[*].model.aliases[*]	string	ALL
        
    acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/root.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=3721377662/001/output/root.txt
        @@ -148,7 +148,6 @@
         environments.*.variables.*.lookup.query	string	INPUT
         environments.*.variables.*.lookup.service_principal	string	INPUT
         environments.*.variables.*.lookup.warehouse	string	INPUT
        -environments.*.variables.*.sensitive	bool	INPUT
         environments.*.variables.*.type	variable.VariableType	INPUT
         environments.*.variables.*.value	any	INPUT
         environments.*.workspace	*config.Workspace	INPUT
        @@ -365,7 +364,6 @@
         targets.*.variables.*.lookup.query	string	INPUT
         targets.*.variables.*.lookup.service_principal	string	INPUT
         targets.*.variables.*.lookup.warehouse	string	INPUT
        -targets.*.variables.*.sensitive	bool	INPUT
         targets.*.variables.*.type	variable.VariableType	INPUT
         targets.*.variables.*.value	any	INPUT
         targets.*.workspace	*config.Workspace	INPUT
        @@ -449,7 +447,6 @@
         variables.*.lookup.query	string	INPUT
         variables.*.lookup.service_principal	string	INPUT
         variables.*.lookup.warehouse	string	INPUT
        -variables.*.sensitive	bool	INPUT
         variables.*.type	variable.VariableType	INPUT
         variables.*.value	any	INPUT
         workspace	config.Workspace	INPUT
TestAccept/bundle/refschema/DMS=true: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/root.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=true2059035718/001/output/root.txt
        @@ -148,7 +148,6 @@
         environments.*.variables.*.lookup.query	string	INPUT
         environments.*.variables.*.lookup.service_principal	string	INPUT
         environments.*.variables.*.lookup.warehouse	string	INPUT
        -environments.*.variables.*.sensitive	bool	INPUT
         environments.*.variables.*.type	variable.VariableType	INPUT
         environments.*.variables.*.value	any	INPUT
         environments.*.workspace	*config.Workspace	INPUT
        @@ -365,7 +364,6 @@
         targets.*.variables.*.lookup.query	string	INPUT
         targets.*.variables.*.lookup.service_principal	string	INPUT
         targets.*.variables.*.lookup.warehouse	string	INPUT
        -targets.*.variables.*.sensitive	bool	INPUT
         targets.*.variables.*.type	variable.VariableType	INPUT
         targets.*.variables.*.value	any	INPUT
         targets.*.workspace	*config.Workspace	INPUT
        @@ -449,7 +447,6 @@
         variables.*.lookup.query	string	INPUT
         variables.*.lookup.service_principal	string	INPUT
         variables.*.lookup.warehouse	string	INPUT
        -variables.*.sensitive	bool	INPUT
         variables.*.type	variable.VariableType	INPUT
         variables.*.value	any	INPUT
         workspace	config.Workspace	INPUT

latest (v1.23.0):

acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/root.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=true1825588135/001/output/root.txt
        @@ -148,7 +148,6 @@
         environments.*.variables.*.lookup.query	string	INPUT
         environments.*.variables.*.lookup.service_principal	string	INPUT
         environments.*.variables.*.lookup.warehouse	string	INPUT
        -environments.*.variables.*.sensitive	bool	INPUT
         environments.*.variables.*.type	variable.VariableType	INPUT
         environments.*.variables.*.value	any	INPUT
         environments.*.workspace	*config.Workspace	INPUT
        @@ -365,7 +364,6 @@
         targets.*.variables.*.lookup.query	string	INPUT
         targets.*.variables.*.lookup.service_principal	string	INPUT
         targets.*.variables.*.lookup.warehouse	string	INPUT
        -targets.*.variables.*.sensitive	bool	INPUT
         targets.*.variables.*.type	variable.VariableType	INPUT
         targets.*.variables.*.value	any	INPUT
         targets.*.workspace	*config.Workspace	INPUT
        @@ -449,7 +447,6 @@
         variables.*.lookup.query	string	INPUT
         variables.*.lookup.service_principal	string	INPUT
         variables.*.lookup.warehouse	string	INPUT
        -variables.*.sensitive	bool	INPUT
         variables.*.type	variable.VariableType	INPUT
         variables.*.value	any	INPUT
         workspace	config.Workspace	INPUT
        
    acceptance_test.go:1342: Diff:
        --- bundle/refschema/output/jobs.txt
        +++ /tmp/TestAcceptbundlerefschemaDMS=true1825588135/001/output/jobs.txt
        @@ -193,8 +193,6 @@
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients	compute.ClientsTypes	ALL
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.jobs	bool	ALL
         resources.jobs.*.job_clusters[*].new_cluster.workload_type.clients.notebooks	bool	ALL
        -resources.jobs.*.job_clusters[*].serverless_compute	*jobs.JobClusterServerlessCompute	ALL
        -resources.jobs.*.job_clusters[*].serverless_compute.policy_id	string	ALL
         resources.jobs.*.job_clusters[*].serverless_compute_id	string	ALL
         resources.jobs.*.job_id	int64	REMOTE
         resources.jobs.*.lifecycle	resources.Lifecycle	INPUT
        @@ -233,42 +231,6 @@
         resources.jobs.*.tags.*	string	ALL
         resources.jobs.*.tasks	[]jobs.Task	ALL
         resources.jobs.*.tasks[*]	jobs.Task	ALL
        -resources.jobs.*.tasks[*].ai_function_task	*jobs.AiFunctionTask	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify	*jobs.AiClassifyFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.enable_rationales	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels	*jobs.AiClassifyFunctionInlineLabels	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels	[]jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*]	jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*].description	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.inline_labels.labels[*].name	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.instructions	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.multilabel	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_classify.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract	*jobs.AiExtractFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.enable_citations	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.instructions	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.mode	jobs.AiExtractFunctionMode	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.schema	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_extract.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document	*jobs.AiParseDocumentFunction	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.description_element_types	[]jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.description_element_types[*]	jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.image_output_path	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.page_range	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.ai_parse_document.version	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table	*jobs.DeltaTableSource	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.input_column	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.merge_key_columns	[]string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.merge_key_columns[*]	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.delta_table.table_name	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output	jobs.QualifiedName	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.catalog	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.schema	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.output.table	string	ALL
        -resources.jobs.*.tasks[*].ai_function_task.volume	*jobs.VolumeSource	ALL
        -resources.jobs.*.tasks[*].ai_function_task.volume.volume_path	string	ALL
         resources.jobs.*.tasks[*].ai_runtime_task	*jobs.AiRuntimeTask	ALL
         resources.jobs.*.tasks[*].ai_runtime_task.code_source_path	string	ALL
         resources.jobs.*.tasks[*].ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
        @@ -377,42 +339,6 @@
         resources.jobs.*.tasks[*].for_each_task.concurrency	int	ALL
         resources.jobs.*.tasks[*].for_each_task.inputs	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task	jobs.Task	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task	*jobs.AiFunctionTask	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify	*jobs.AiClassifyFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.enable_rationales	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels	*jobs.AiClassifyFunctionInlineLabels	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels	[]jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*]	jobs.AiClassifyFunctionLabel	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*].description	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.inline_labels.labels[*].name	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.instructions	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.multilabel	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_classify.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract	*jobs.AiExtractFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.enable_citations	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.enable_confidence_scores	bool	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.instructions	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.mode	jobs.AiExtractFunctionMode	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.schema	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_extract.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document	*jobs.AiParseDocumentFunction	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.description_element_types	[]jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.description_element_types[*]	jobs.AiParseDocumentFunctionDescriptionElementType	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.image_output_path	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.page_range	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.ai_parse_document.version	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table	*jobs.DeltaTableSource	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.input_column	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.merge_key_columns	[]string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.merge_key_columns[*]	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.delta_table.table_name	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output	jobs.QualifiedName	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.catalog	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.schema	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.output.table	string	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.volume	*jobs.VolumeSource	ALL
        -resources.jobs.*.tasks[*].for_each_task.task.ai_function_task.volume.volume_path	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task	*jobs.AiRuntimeTask	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.code_source_path	string	ALL
         resources.jobs.*.tasks[*].for_each_task.task.ai_runtime_task.deployments	[]jobs.DeploymentSpec	ALL
        @@ -1117,12 +1043,6 @@
         resources.jobs.*.trigger.file_arrival.min_time_between_triggers_seconds	int	ALL
         resources.jobs.*.trigger.file_arrival.url	string	ALL
         resources.jobs.*.trigger.file_arrival.wait_after_last_change_seconds	int	ALL
        -resources.jobs.*.trigger.job_completion	*jobs.JobCompletionTriggerConfiguration	ALL
        -resources.jobs.*.trigger.job_completion.if_status	jobs.JobCompletionTriggerConfigurationIfStatus	ALL
        -resources.jobs.*.trigger.job_completion.jobs	[]jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*]	jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*].job_id	string	ALL
        -resources.jobs.*.trigger.job_completion.jobs[*].workspace_id	string	ALL
         resources.jobs.*.trigger.model	*jobs.ModelTriggerConfiguration	ALL
         resources.jobs.*.trigger.model.aliases	[]string	ALL
         resources.jobs.*.trigger.model.aliases[*]	string	ALL
        @@ -1166,17 +1086,6 @@
         resources.jobs.*.trigger_details[*].state.continuous.next_attempt_ms	int64	REMOTE
         resources.jobs.*.trigger_details[*].state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
         resources.jobs.*.trigger_details[*].state.file_arrival.using_file_events	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion	*jobs.JobCompletionTriggerState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states	[]jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*]	jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].has_seen_completion	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].is_deleted	bool	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].job_id	string	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_completion_time	*time.Time	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].last_seen_run_id	string	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].latest_non_matching_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_details[*].state.job_completion.monitored_job_states[*].workspace_id	string	REMOTE
         resources.jobs.*.trigger_details[*].state.model	*jobs.ModelTriggerState	REMOTE
         resources.jobs.*.trigger_details[*].state.pause_status	jobs.PauseStatus	REMOTE
         resources.jobs.*.trigger_details[*].state.periodic	*jobs.PeriodicTriggerState	REMOTE
        @@ -1195,17 +1104,6 @@
         resources.jobs.*.trigger_state	*jobs.TriggerStateProto	REMOTE
         resources.jobs.*.trigger_state.file_arrival	*jobs.FileArrivalTriggerState	REMOTE
         resources.jobs.*.trigger_state.file_arrival.using_file_events	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion	*jobs.JobCompletionTriggerState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states	[]jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*]	jobs.JobCompletionTriggerStateMonitoredJobState	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].has_seen_completion	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].is_deleted	bool	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].job_id	string	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_completion_time	*time.Time	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].last_seen_run_id	string	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].latest_non_matching_result	jobs.TerminationCodeCode	REMOTE
        -resources.jobs.*.trigger_state.job_completion.monitored_job_states[*].workspace_id	string	REMOTE
         resources.jobs.*.trigger_state.pause_status	jobs.PauseStatus	REMOTE
         resources.jobs.*.trigger_state.sql_condition	*jobs.SqlConditionState	REMOTE
         resources.jobs.*.trigger_state.sql_condition.latest_condition_evaluation_satisfied	bool	REMOTE
        @@ -1229,12 +1127,6 @@
         resources.jobs.*.triggers[*].file_arrival.min_time_between_triggers_seconds	int	ALL
         resources.jobs.*.triggers[*].file_arrival.url	string	ALL
         resources.jobs.*.triggers[*].file_arrival.wait_after_last_change_seconds	int	ALL
        -resources.jobs.*.triggers[*].job_completion	*jobs.JobCompletionTriggerConfiguration	ALL
        -resources.jobs.*.triggers[*].job_completion.if_status	jobs.JobCompletionTriggerConfigurationIfStatus	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs	[]jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*]	jobs.JobCompletionTriggerConfigurationMonitoredJob	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*].job_id	string	ALL
        -resources.jobs.*.triggers[*].job_completion.jobs[*].workspace_id	string	ALL
         resources.jobs.*.triggers[*].model	*jobs.ModelTriggerConfiguration	ALL
         resources.jobs.*.triggers[*].model.aliases	[]string	ALL
         resources.jobs.*.triggers[*].model.aliases[*]	string	ALL
TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1342
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1083
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nError: Variable used for secret value must be marked as sensitive\n  at resources.secrets.secret2.value\n  in databricks.yml:22:14\n\nThe variable \"other_secret_value\" used for the secret \"secret2\" must be marked as sensitive.\nThis bundle marks variables as sensitive, so only those are redacted in the output of \"bundle validate -o json\". Add \"sensitive: true\" to the variable definition.\n\n\nExit code: 1\n"
        	            	actual  : "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nWarning: unknown field: sensitive\n  at variables.secret_value\n  in databricks.yml:7:5\n\nError: no value assigned to required variable secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using \"--var\", the BUNDLE_VAR_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json\n\ncontains error: 'Add \"sensitive: true\"' not found in the output.\ncontains error: 'Variable used for secret value must be marked as sensitive' not found in the output.\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -3,9 +3,10 @@
        	            	 >>> [CLI] bundle deploy
        	            	-Error: Variable used for secret value must be marked as sensitive
        	            	-  at resources.secrets.secret2.value
        	            	-  in databricks.yml:22:14
        	            	+Warning: unknown field: sensitive
        	            	+  at variables.secret_value
        	            	+  in databricks.yml:7:5
        	            	 
        	            	-The variable "other_secret_value" used for the secret "secret2" must be marked as sensitive.
        	            	-This bundle marks variables as sensitive, so only those are redacted in the output of "bundle validate -o json". Add "sensitive: true" to the variable definition.
        	            	+Error: no value assigned to required variable secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using "--var", the BUNDLE_VAR_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json
        	            	 
        	            	+contains error: 'Add "sensitive: true"' not found in the output.
        	            	+contains error: 'Variable used for secret value must be marked as sensitive' not found in the output.
        	            	 
        	Test:       	TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=
        	Messages:   	bundle/resources/secrets/validate-not-sensitive/output.txt vs /tmp/TestAcceptbundleresourcessecretsvalidate-not-sensitiveDMS=57892083/002/output.txt
FAIL

latest (v1.23.0):

acceptance_test.go:1342: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1342
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1083
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nError: Variable used for secret value must be marked as sensitive\n  at resources.secrets.secret2.value\n  in databricks.yml:22:14\n\nThe variable \"other_secret_value\" used for the secret \"secret2\" must be marked as sensitive.\nThis bundle marks variables as sensitive, so only those are redacted in the output of \"bundle validate -o json\". Add \"sensitive: true\" to the variable definition.\n\n\nExit code: 1\n"
        	            	actual  : "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nWarning: unknown field: sensitive\n  at variables.secret_value\n  in databricks.yml:7:5\n\nError: no value assigned to required variable secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using \"--var\", the BUNDLE_VAR_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json\n\ncontains error: 'Add \"sensitive: true\"' not found in the output.\ncontains error: 'Variable used for secret value must be marked as sensitive' not found in the output.\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -3,9 +3,10 @@
        	            	 >>> [CLI] bundle deploy
        	            	-Error: Variable used for secret value must be marked as sensitive
        	            	-  at resources.secrets.secret2.value
        	            	-  in databricks.yml:22:14
        	            	+Warning: unknown field: sensitive
        	            	+  at variables.secret_value
        	            	+  in databricks.yml:7:5
        	            	 
        	            	-The variable "other_secret_value" used for the secret "secret2" must be marked as sensitive.
        	            	-This bundle marks variables as sensitive, so only those are redacted in the output of "bundle validate -o json". Add "sensitive: true" to the variable definition.
        	            	+Error: no value assigned to required variable secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using "--var", the BUNDLE_VAR_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json
        	            	 
        	            	+contains error: 'Add "sensitive: true"' not found in the output.
        	            	+contains error: 'Variable used for secret value must be marked as sensitive' not found in the output.
        	            	 
        	Test:       	TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=
        	Messages:   	bundle/resources/secrets/validate-not-sensitive/output.txt vs /tmp/TestAcceptbundleresourcessecretsvalidate-not-sensitiveDMS=3806147341/002/output.txt
TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=true: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1342
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1083
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nError: Variable used for secret value must be marked as sensitive\n  at resources.secrets.secret2.value\n  in databricks.yml:22:14\n\nThe variable \"other_secret_value\" used for the secret \"secret2\" must be marked as sensitive.\nThis bundle marks variables as sensitive, so only those are redacted in the output of \"bundle validate -o json\". Add \"sensitive: true\" to the variable definition.\n\n\nExit code: 1\n"
        	            	actual  : "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nWarning: unknown field: sensitive\n  at variables.secret_value\n  in databricks.yml:7:5\n\nError: no value assigned to required variable other_secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using \"--var\", the BUNDLE_VAR_other_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json\n\ncontains error: 'Add \"sensitive: true\"' not found in the output.\ncontains error: 'Variable used for secret value must be marked as sensitive' not found in the output.\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -3,9 +3,10 @@
        	            	 >>> [CLI] bundle deploy
        	            	-Error: Variable used for secret value must be marked as sensitive
        	            	-  at resources.secrets.secret2.value
        	            	-  in databricks.yml:22:14
        	            	+Warning: unknown field: sensitive
        	            	+  at variables.secret_value
        	            	+  in databricks.yml:7:5
        	            	 
        	            	-The variable "other_secret_value" used for the secret "secret2" must be marked as sensitive.
        	            	-This bundle marks variables as sensitive, so only those are redacted in the output of "bundle validate -o json". Add "sensitive: true" to the variable definition.
        	            	+Error: no value assigned to required variable other_secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using "--var", the BUNDLE_VAR_other_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json
        	            	 
        	            	+contains error: 'Add "sensitive: true"' not found in the output.
        	            	+contains error: 'Variable used for secret value must be marked as sensitive' not found in the output.
        	            	 
        	Test:       	TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=true
        	Messages:   	bundle/resources/secrets/validate-not-sensitive/output.txt vs /tmp/TestAcceptbundleresourcessecretsvalidate-not-sensitiveDMS=t925828478/002/output.txt

latest (v1.23.0):

acceptance_test.go:1342: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1342
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1083
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nError: Variable used for secret value must be marked as sensitive\n  at resources.secrets.secret2.value\n  in databricks.yml:22:14\n\nThe variable \"other_secret_value\" used for the secret \"secret2\" must be marked as sensitive.\nThis bundle marks variables as sensitive, so only those are redacted in the output of \"bundle validate -o json\". Add \"sensitive: true\" to the variable definition.\n\n\nExit code: 1\n"
        	            	actual  : "\n=== Deploy should fail when a secret uses a variable that is not marked sensitive while other variables are\n>>> [CLI] bundle deploy\nWarning: unknown field: sensitive\n  at variables.secret_value\n  in databricks.yml:7:5\n\nError: no value assigned to required variable other_secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using \"--var\", the BUNDLE_VAR_other_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json\n\ncontains error: 'Add \"sensitive: true\"' not found in the output.\ncontains error: 'Variable used for secret value must be marked as sensitive' not found in the output.\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -3,9 +3,10 @@
        	            	 >>> [CLI] bundle deploy
        	            	-Error: Variable used for secret value must be marked as sensitive
        	            	-  at resources.secrets.secret2.value
        	            	-  in databricks.yml:22:14
        	            	+Warning: unknown field: sensitive
        	            	+  at variables.secret_value
        	            	+  in databricks.yml:7:5
        	            	 
        	            	-The variable "other_secret_value" used for the secret "secret2" must be marked as sensitive.
        	            	-This bundle marks variables as sensitive, so only those are redacted in the output of "bundle validate -o json". Add "sensitive: true" to the variable definition.
        	            	+Error: no value assigned to required variable other_secret_value. Variables are usually assigned in databricks.yml, and they can be overridden using "--var", the BUNDLE_VAR_other_secret_value environment variable, or .databricks/bundle/<target>/variable-overrides.json
        	            	 
        	            	+contains error: 'Add "sensitive: true"' not found in the output.
        	            	+contains error: 'Variable used for secret value must be marked as sensitive' not found in the output.
        	            	 
        	Test:       	TestAccept/bundle/resources/secrets/validate-not-sensitive/DMS=true
        	Messages:   	bundle/resources/secrets/validate-not-sensitive/output.txt vs /tmp/TestAcceptbundleresourcessecretsvalidate-not-sensitiveDMS=t1261502048/002/output.txt
FAIL
TestAccept/bundle/variables/sensitive/DMS=: branch ✅ | main (aae07ca) ❌ | latest (v1.23.0) ❌

main (aae07ca):

acceptance_test.go:1342: Diff:
        --- bundle/variables/sensitive/output.txt
        +++ /tmp/TestAcceptbundlevariablessensitiveDMS=2093084225/002/output.txt
        @@ -2,26 +2,33 @@
         === Only sensitive variables are redacted in validate -o json
         
         >>> [CLI] bundle validate -o json
        +Warning: unknown field: sensitive
        +  at variables.api_credential
        +  in databricks.yml:11:5
        +
        +Warning: unknown field: sensitive
        +  at variables.api_header
        +  in databricks.yml:14:5
        +
        +contains error: 'dummy-credential' was not expected: '"default": "Bearer dummy-credential",'
         {
           "variables": {
             "api_credential": {
               "description": "Credential for the external API, passed via BUNDLE_VAR_api_credential",
        -      "sensitive": true,
               "value": "[redacted]"
             },
             "api_header": {
        -      "default": "[redacted]",
        +      "default": "Bearer dummy-credential",
               "description": "A sensitive variable may reference another sensitive variable",
        -      "sensitive": true,
               "value": "[redacted]"
             },
             "target_catalog": {
               "default": "example_catalog",
        -      "value": "example_catalog"
        +      "value": "[redacted]"
             },
             "target_schema": {
               "default": "example_schema",
        -      "value": "example_schema"
        +      "value": "[redacted]"
             }
           },
           "resources": {
        @@ -36,62 +28,4 @@
           }
         }
         
        -=== Sensitive variable used in non-sensitive resource fields
        -
        ->>> [CLI] bundle validate
        -Error: Sensitive variable "api_credential" is used in a non-sensitive field
        -  at resources.jobs.example_job.tasks[0].notebook_task.base_parameters.token
        -  in databricks.yml:25:22
        -
        -The variable "api_credential" is marked as sensitive, so its value must not appear in plain text.
        -Sensitive variables can only be used as the value of a sensitive resource field (such as resources.secrets.*.value) or in the definition of another variable that is also marked as sensitive.
        -
        -Error: Sensitive variable "api_credential" is used in a non-sensitive field
        -  at resources.secrets.example_secret.comment
        -  in databricks.yml:15:16
        -
        -The variable "api_credential" is marked as sensitive, so its value must not appear in plain text.
        -Sensitive variables can only be used as the value of a sensitive resource field (such as resources.secrets.*.value) or in the definition of another variable that is also marked as sensitive.
        -
        -Name: sensitive-variables
        -Target: default
        -Workspace:
        -  User: [USERNAME]
        -  Path: /Workspace/Users/[USERNAME]/.bundle/sensitive-variables/default
        -
        -Found 2 errors
        -
        -=== Sensitive variable used in the default of a non-sensitive variable
        -
        ->>> [CLI] bundle validate
        -Error: Sensitive variable "api_credential" is used in a non-sensitive field
        -  at variables.api_header.default
        -  in databricks.yml:9:14
        -
        -The variable "api_credential" is marked as sensitive, so its value must not appear in plain text.
        -Sensitive variables can only be used as the value of a sensitive resource field (such as resources.secrets.*.value) or in the definition of another variable that is also marked as sensitive.
        -
        -Name: sensitive-variables
        -Target: default
        -Workspace:
        -  User: [USERNAME]
        -  Path: /Workspace/Users/[USERNAME]/.bundle/sensitive-variables/default
        -
        -Found 1 error
        -
        -=== Sensitive variable passed as the value of a non-sensitive variable
        -
        ->>> [CLI] bundle validate --var target_schema=${var.api_credential}
        -Error: Sensitive variable "api_credential" is used in a non-sensitive field
        -  at variables.target_schema.value
        -
        -The variable "api_credential" is marked as sensitive, so its value must not appear in plain text.
        -Sensitive variables can only be used as the value of a sensitive resource field (such as resources.secrets.*.value) or in the definition of another variable that is also marked as sensitive.
        -
        -Name: sensitive-variables
        -Target: default
        -Workspace:
        -  User: [USERNAME]
        -  Path: /Workspace/Users/[USERNAME]/.bundle/sensitive-variables/default
        -
        -Found 1 error
        +Exit code: 1

latest (v1.23.0): same output as main (aae07ca)

1 more failure details omitted, see the full report in the run.

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Integration test report

Commit: 2a09d2a

Run: 41644587084

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 271 18 8:12
✅​ aws-windows-latest-4core-16gb 273 16 4:53
✅​ azure linux-2core-8gb 270 18 7:59
✅​ azure-windows-latest-4core-16gb 272 16 5:10
✅​ gcp linux-2core-8gb 271 18 7:48
✅​ gcp-windows-latest-4core-16gb 273 16 5:51
Top 6 slowest tests (at least 2 minutes):
duration env testname
4:17 aws linux-2core-8gb TestAccept
4:13 gcp linux-2core-8gb TestAccept
4:10 azure linux-2core-8gb TestAccept
3:04 aws-windows-latest-4core-16gb TestAccept
3:00 gcp-windows-latest-4core-16gb TestAccept
3:00 azure-windows-latest-4core-16gb TestAccept

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renaudhartert-db renaudhartert-db Awaiting requested review from renaudhartert-db renaudhartert-db is a code owner automatically assigned from databricks/eng-deco-cli
@pietern pietern Awaiting requested review from pietern pietern is a code owner automatically assigned from databricks/eng-deco-dabs

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

DABs DABs related issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

UC secrets: supported access to resolved non-secret variables and redaction compatibility

2 participants

@andrewnester @eng-dev-ecosystem-bot