Add sensitive_fields to resources.yml - #6192
Merged
Merged
Conversation
andrewnester
enabled auto-merge
August 6, 2026 14:54
denik
reviewed
Aug 6, 2026
denik
reviewed
Aug 7, 2026
Collaborator
Integration test reportCommit: c0794e6
8 interesting tests: 4 RECOVERED, 3 SKIP, 1 flaky
Top 11 slowest tests (at least 2 minutes):
|
denik
reviewed
Aug 10, 2026
andrewnester
changed the title
sensitive_fields to resources.yml
denik
reviewed
Aug 11, 2026
| return v, nil | ||
| } | ||
|
|
||
| const sensitiveRedactedMarker = "[redacted]" |
Contributor
There was a problem hiding this comment.
One possible idea: instead of using "[redacted]", use "[redacted_uniquekey]" and keep map of unique key to secret. Then this uniquekey propagates all the way to resource where we can do search and replace post serialization.
denik
reviewed
Aug 12, 2026
denik
reviewed
Aug 12, 2026
denik
approved these changes
Aug 12, 2026
denik
left a comment
denik
left a comment
Contributor
There was a problem hiding this comment.
Do any tests record bits of resources.json that show that redaction happened here?
Contributor
Author
hejcman-enverus
pushed a commit
to hejcman-enverus/databricks_cli
that referenced
this pull request
Sep 3, 2026
## Changes Remove the `bundle:"sensitive"` tag and everything that read it: `dyn.secretString`, `NewSensitiveValue`, `Value.IsSensitive`/`MarkSensitive`, `convert.SensitiveFieldNames`, the redaction branches in `jsonsaver`/`yamlsaver`, sensitivity propagation in `dynvar.Resolve`, and `structwalk.RedactSensitiveFields`. Every hunk restores the pre-databricks#5896 shape. ## Why The tag has no declarations left in the tree — only test fixtures declaring it to exercise the machinery that read it. | PR | Merged | Effect on `bundle:"sensitive"` | |---|---|---| | [databricks#5896](databricks#5896) | 2026-07-22 | Added the tag and the machinery reading it | | [databricks#6179](databricks#6179) | 2026-08-05 | Unwired `RedactSensitiveFields` — its reflection deep-clone dropped unexported fields, corrupting every `duration.Duration` in direct-engine state to `0s` | | [databricks#5861](databricks#5861) | 2026-08-06 | Added the only production declaration: `SecretState.SecretValue` | | [databricks#6192](databricks#6192) | 2026-08-12 | Replaced the tag with `sensitive_fields:` in `resources.yml`, deleting that last declaration | These are no-ops rather than behaviour changes: `dyn` sensitivity had a single producer (`info.Sensitive[k]` in `FromTyped`, fed by the tag), so `IsSensitive()` could never return true, and in `structdiff` `fieldName == "-" && !bundleTag.Sensitive()` reduces to `fieldName == "-"`. No golden file referenced `<redacted value>`. The live `sensitive_fields:` mechanism (`bundle/direct/redact.go`, `dresources/redact_config.go`) is untouched. ## Tests Existing tests; the ones covering only the removed machinery are deleted. No changelog fragment — pure internal removal, nothing user-visible. _This PR was written by Claude Code._
janniklasrose
pushed a commit
that referenced
this pull request
Sep 15, 2026
## Changes Add sensitive_fields to resources.yml As a result it allows us to use Value field from SDK struct as is and do a proper drift detected ## Why The effective_value returned from the API after DoRead (with include_value=true) was not being used in the drift comparison, causing a false "update" action on every second plan. Now we do not unset the fields and redact them instead which makes drift detection reliable. ## Tests Drift test pass <!-- If your PR needs to be included in the release notes for next release, add a changelog fragment: create .nextchanges/<section>/<name>.md with a one-line description (e.g. .nextchanges/cli/quickstart.md). See .nextchanges/README.md. -->
janniklasrose
pushed a commit
that referenced
this pull request
Sep 15, 2026
## Changes Remove the `bundle:"sensitive"` tag and everything that read it: `dyn.secretString`, `NewSensitiveValue`, `Value.IsSensitive`/`MarkSensitive`, `convert.SensitiveFieldNames`, the redaction branches in `jsonsaver`/`yamlsaver`, sensitivity propagation in `dynvar.Resolve`, and `structwalk.RedactSensitiveFields`. Every hunk restores the pre-#5896 shape. ## Why The tag has no declarations left in the tree — only test fixtures declaring it to exercise the machinery that read it. | PR | Merged | Effect on `bundle:"sensitive"` | |---|---|---| | [#5896](#5896) | 2026-07-22 | Added the tag and the machinery reading it | | [#6179](#6179) | 2026-08-05 | Unwired `RedactSensitiveFields` — its reflection deep-clone dropped unexported fields, corrupting every `duration.Duration` in direct-engine state to `0s` | | [#5861](#5861) | 2026-08-06 | Added the only production declaration: `SecretState.SecretValue` | | [#6192](#6192) | 2026-08-12 | Replaced the tag with `sensitive_fields:` in `resources.yml`, deleting that last declaration | These are no-ops rather than behaviour changes: `dyn` sensitivity had a single producer (`info.Sensitive[k]` in `FromTyped`, fed by the tag), so `IsSensitive()` could never return true, and in `structdiff` `fieldName == "-" && !bundleTag.Sensitive()` reduces to `fieldName == "-"`. No golden file referenced `<redacted value>`. The live `sensitive_fields:` mechanism (`bundle/direct/redact.go`, `dresources/redact_config.go`) is untouched. ## Tests Existing tests; the ones covering only the removed machinery are deleted. No changelog fragment — pure internal removal, nothing user-visible. _This PR was written by Claude Code._
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add sensitive_fields to resources.yml
As a result it allows us to use Value field from SDK struct as is and do a proper drift detected
Why
The effective_value returned from the API after DoRead (with include_value=true) was not being used in the drift comparison, causing a false "update" action on every second plan.
Now we do not unset the fields and redact them instead which makes drift detection reliable.
Tests
Drift test pass