-
Notifications
You must be signed in to change notification settings - Fork 64
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into add-privacy-notice
- Loading branch information
Showing
55 changed files
with
2,279 additions
and
275 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 0c86ea6dbd9a730c24ff0d4e509603e476955ac5 | ||
| cf9c61453990df0f9453670f2fe68e1b128647a2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| name: integration | ||
|
|
||
| on: | ||
|
|
||
| pull_request: | ||
| types: [opened, synchronize] | ||
|
|
||
| merge_group: | ||
|
|
||
|
|
||
| jobs: | ||
| trigger-tests: | ||
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| environment: "test-trigger-is" | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Generate GitHub App Token | ||
| id: generate-token | ||
| uses: actions/create-github-app-token@v1 | ||
| with: | ||
| app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }} | ||
| private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }} | ||
| owner: ${{ secrets.ORG_NAME }} | ||
| repositories: ${{secrets.REPO_NAME}} | ||
|
|
||
| - name: Trigger Workflow in Another Repo | ||
| env: | ||
| GH_TOKEN: ${{ steps.generate-token.outputs.token }} | ||
| run: | | ||
| gh workflow run cli-isolated-pr.yml -R ${{ secrets.ORG_NAME }}/${{secrets.REPO_NAME}} \ | ||
| --ref main \ | ||
| -f pull_request_number=${{ github.event.pull_request.number }} \ | ||
| -f commit_sha=${{ github.event.pull_request.head.sha }} | ||
| # Statuses and checks apply to specific commits (by hash). | ||
| # Enforcement of required checks is done both at the PR level and the merge queue level. | ||
| # In case of multiple commits in a single PR, the hash of the squashed commit | ||
| # will not match the one for the latest (approved) commit in the PR. | ||
| # We auto approve the check for the merge queue for two reasons: | ||
| # * Queue times out due to duration of tests. | ||
| # * Avoid running integration tests twice, since it was already run at the tip of the branch before squashing. | ||
| auto-approve: | ||
| if: github.event_name == 'merge_group' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Mark Check | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| shell: bash | ||
| run: | | ||
| gh api -X POST -H "Accept: application/vnd.github+json" \ | ||
| -H "X-GitHub-Api-Version: 2022-11-28" \ | ||
| /repos/${{ github.repository }}/statuses/${{ github.sha }} \ | ||
| -f 'state=success' \ | ||
| -f 'context=Integration Tests Check' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -699,6 +699,9 @@ func TestTranslatePathJobEnvironments(t *testing.T) { | |
| "../dist/env2.whl", | ||
| "simplejson", | ||
| "/Workspace/Users/[email protected]/test.whl", | ||
| "--extra-index-url https://name:[email protected]/api/v4/projects/9876/packages/pypi/simple foobar", | ||
| "foobar --extra-index-url https://name:[email protected]/api/v4/projects/9876/packages/pypi/simple", | ||
| "https://[email protected]/packages/pypi/simple", | ||
| }, | ||
| }, | ||
| }, | ||
|
|
@@ -719,6 +722,9 @@ func TestTranslatePathJobEnvironments(t *testing.T) { | |
| assert.Equal(t, strings.Join([]string{".", "dist", "env2.whl"}, string(os.PathSeparator)), b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[1]) | ||
| assert.Equal(t, "simplejson", b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[2]) | ||
| assert.Equal(t, "/Workspace/Users/[email protected]/test.whl", b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[3]) | ||
| assert.Equal(t, "--extra-index-url https://name:[email protected]/api/v4/projects/9876/packages/pypi/simple foobar", b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[4]) | ||
| assert.Equal(t, "foobar --extra-index-url https://name:[email protected]/api/v4/projects/9876/packages/pypi/simple", b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[5]) | ||
| assert.Equal(t, "https://[email protected]/packages/pypi/simple", b.Config.Resources.Jobs["job"].JobSettings.Environments[0].Spec.Dependencies[6]) | ||
| } | ||
|
|
||
| func TestTranslatePathWithComplexVariables(t *testing.T) { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| package validate | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "path" | ||
| "strings" | ||
|
|
||
| "github.com/databricks/cli/bundle" | ||
| "github.com/databricks/cli/bundle/libraries" | ||
| "github.com/databricks/cli/bundle/permissions" | ||
| "github.com/databricks/cli/libs/diag" | ||
| "github.com/databricks/databricks-sdk-go/apierr" | ||
| "github.com/databricks/databricks-sdk-go/service/workspace" | ||
| "golang.org/x/sync/errgroup" | ||
| ) | ||
|
|
||
| type folderPermissions struct { | ||
| } | ||
|
|
||
| // Apply implements bundle.ReadOnlyMutator. | ||
| func (f *folderPermissions) Apply(ctx context.Context, b bundle.ReadOnlyBundle) diag.Diagnostics { | ||
| if len(b.Config().Permissions) == 0 { | ||
| return nil | ||
| } | ||
|
|
||
| rootPath := b.Config().Workspace.RootPath | ||
| paths := []string{} | ||
| if !libraries.IsVolumesPath(rootPath) && !libraries.IsWorkspaceSharedPath(rootPath) { | ||
| paths = append(paths, rootPath) | ||
| } | ||
|
|
||
| if !strings.HasSuffix(rootPath, "/") { | ||
| rootPath += "/" | ||
| } | ||
|
|
||
| for _, p := range []string{ | ||
| b.Config().Workspace.ArtifactPath, | ||
| b.Config().Workspace.FilePath, | ||
| b.Config().Workspace.StatePath, | ||
| b.Config().Workspace.ResourcePath, | ||
| } { | ||
| if libraries.IsWorkspaceSharedPath(p) || libraries.IsVolumesPath(p) { | ||
| continue | ||
| } | ||
|
|
||
| if strings.HasPrefix(p, rootPath) { | ||
| continue | ||
| } | ||
|
|
||
| paths = append(paths, p) | ||
| } | ||
|
|
||
| var diags diag.Diagnostics | ||
| g, ctx := errgroup.WithContext(ctx) | ||
| results := make([]diag.Diagnostics, len(paths)) | ||
| for i, p := range paths { | ||
| g.Go(func() error { | ||
| results[i] = checkFolderPermission(ctx, b, p) | ||
| return nil | ||
| }) | ||
| } | ||
|
|
||
| if err := g.Wait(); err != nil { | ||
| return diag.FromErr(err) | ||
| } | ||
|
|
||
| for _, r := range results { | ||
| diags = diags.Extend(r) | ||
| } | ||
|
|
||
| return diags | ||
| } | ||
|
|
||
| func checkFolderPermission(ctx context.Context, b bundle.ReadOnlyBundle, folderPath string) diag.Diagnostics { | ||
| w := b.WorkspaceClient().Workspace | ||
| obj, err := getClosestExistingObject(ctx, w, folderPath) | ||
| if err != nil { | ||
| return diag.FromErr(err) | ||
| } | ||
|
|
||
| objPermissions, err := w.GetPermissions(ctx, workspace.GetWorkspaceObjectPermissionsRequest{ | ||
| WorkspaceObjectId: fmt.Sprint(obj.ObjectId), | ||
| WorkspaceObjectType: "directories", | ||
| }) | ||
| if err != nil { | ||
| return diag.FromErr(err) | ||
| } | ||
|
|
||
| p := permissions.ObjectAclToResourcePermissions(folderPath, objPermissions.AccessControlList) | ||
| return p.Compare(b.Config().Permissions) | ||
| } | ||
|
|
||
| func getClosestExistingObject(ctx context.Context, w workspace.WorkspaceInterface, folderPath string) (*workspace.ObjectInfo, error) { | ||
| for { | ||
| obj, err := w.GetStatusByPath(ctx, folderPath) | ||
| if err == nil { | ||
| return obj, nil | ||
| } | ||
|
|
||
| if !apierr.IsMissing(err) { | ||
| return nil, err | ||
| } | ||
|
|
||
| parent := path.Dir(folderPath) | ||
| // If the parent is the same as the current folder, then we have reached the root | ||
| if folderPath == parent { | ||
| break | ||
| } | ||
|
|
||
| folderPath = parent | ||
| } | ||
|
|
||
| return nil, fmt.Errorf("folder %s and its parent folders do not exist", folderPath) | ||
| } | ||
|
|
||
| // Name implements bundle.ReadOnlyMutator. | ||
| func (f *folderPermissions) Name() string { | ||
| return "validate:folder_permissions" | ||
| } | ||
|
|
||
| // ValidateFolderPermissions validates that permissions for the folders in Workspace file system matches | ||
| // the permissions in the top-level permissions section of the bundle. | ||
| func ValidateFolderPermissions() bundle.ReadOnlyMutator { | ||
| return &folderPermissions{} | ||
| } |
Oops, something went wrong.