Merge origin/main into remove-mcp-transport.

Resolve PR merge conflicts while keeping the experimental/aitools removals from this branch.

Author: arsenyinfo

.golangci.yaml

@@ -44,6 +44,8 @@ linters:
           msg: Use cmdio.IsPromptSupported(ctx) to check for a TTY.
         - pattern: 'os\.UserHomeDir'
           msg: Use env.UserHomeDir(ctx) from libs/env instead.
+        - pattern: 'os\.Getenv'
+          msg: Use env.Get(ctx) from the libs/env package instead of os.Getenv.
       analyze-types: true
     copyloopvar:
       check-alias: true
@@ -121,6 +123,10 @@ linters:
       - path: bundle/direct/dresources/.*_test.go
         linters:
           - exhaustruct
+      - text: "Use env\\.Get"
+        path: "_test\\.go$"
+        linters:
+          - forbidigo
       # TODO: remove these exceptions by moving the dependency out of experimental/.
       - path: cmd/apps/init.go
         linters:

NEXT_CHANGELOG.md

@@ -6,6 +6,7 @@
 
 ### Bundles
 * Modify grants to use SDK types ([#4666](https://github.com/databricks/cli/pull/4666))
+* Modify permissions to use SDK types where available. This makes DABs validate permission levels, producing a warning on the unknown ones ([#4686](https://github.com/databricks/cli/pull/4686))
 
 ### Dependency updates
 * Bump databricks-sdk-go from v0.112.0 to v0.119.0 ([#4631](https://github.com/databricks/cli/pull/4631), [#4695](https://github.com/databricks/cli/pull/4695))

acceptance/bundle/refschema/out.fields.txt

@@ -38,10 +38,10 @@ resources.alerts.*.lifecycle_state	sql.AlertLifecycleState	ALL
 resources.alerts.*.modified_status	string	INPUT
 resources.alerts.*.owner_user_name	string	ALL
 resources.alerts.*.parent_path	string	ALL
-resources.alerts.*.permissions	[]resources.AlertPermission	INPUT
-resources.alerts.*.permissions[*]	resources.AlertPermission	INPUT
+resources.alerts.*.permissions	[]resources.Permission	INPUT
+resources.alerts.*.permissions[*]	resources.Permission	INPUT
 resources.alerts.*.permissions[*].group_name	string	INPUT
-resources.alerts.*.permissions[*].level	resources.AlertPermissionLevel	INPUT
+resources.alerts.*.permissions[*].level	iam.PermissionLevel	INPUT
 resources.alerts.*.permissions[*].service_principal_name	string	INPUT
 resources.alerts.*.permissions[*].user_name	string	INPUT
 resources.alerts.*.query_text	string	ALL
@@ -166,7 +166,7 @@ resources.apps.*.pending_deployment.update_time	string	ALL
 resources.apps.*.permissions	[]resources.AppPermission	INPUT
 resources.apps.*.permissions[*]	resources.AppPermission	INPUT
 resources.apps.*.permissions[*].group_name	string	INPUT
-resources.apps.*.permissions[*].level	resources.AppPermissionLevel	INPUT
+resources.apps.*.permissions[*].level	apps.AppPermissionLevel	INPUT
 resources.apps.*.permissions[*].service_principal_name	string	INPUT
 resources.apps.*.permissions[*].user_name	string	INPUT
 resources.apps.*.resources	[]apps.AppResource	ALL
@@ -403,7 +403,7 @@ resources.clusters.*.num_workers	int	ALL
 resources.clusters.*.permissions	[]resources.ClusterPermission	INPUT
 resources.clusters.*.permissions[*]	resources.ClusterPermission	INPUT
 resources.clusters.*.permissions[*].group_name	string	INPUT
-resources.clusters.*.permissions[*].level	resources.ClusterPermissionLevel	INPUT
+resources.clusters.*.permissions[*].level	compute.ClusterPermissionLevel	INPUT
 resources.clusters.*.permissions[*].service_principal_name	string	INPUT
 resources.clusters.*.permissions[*].user_name	string	INPUT
 resources.clusters.*.policy_id	string	ALL
@@ -567,10 +567,10 @@ resources.dashboards.*.lifecycle_state	dashboards.LifecycleState	ALL
 resources.dashboards.*.modified_status	string	INPUT
 resources.dashboards.*.parent_path	string	ALL
 resources.dashboards.*.path	string	ALL
-resources.dashboards.*.permissions	[]resources.DashboardPermission	INPUT
-resources.dashboards.*.permissions[*]	resources.DashboardPermission	INPUT
+resources.dashboards.*.permissions	[]resources.Permission	INPUT
+resources.dashboards.*.permissions[*]	resources.Permission	INPUT
 resources.dashboards.*.permissions[*].group_name	string	INPUT
-resources.dashboards.*.permissions[*].level	resources.DashboardPermissionLevel	INPUT
+resources.dashboards.*.permissions[*].level	iam.PermissionLevel	INPUT
 resources.dashboards.*.permissions[*].service_principal_name	string	INPUT
 resources.dashboards.*.permissions[*].user_name	string	INPUT
 resources.dashboards.*.published	bool	REMOTE	STATE
@@ -634,10 +634,10 @@ resources.database_instances.*.parent_instance_ref.effective_lsn	string	ALL
 resources.database_instances.*.parent_instance_ref.lsn	string	ALL
 resources.database_instances.*.parent_instance_ref.name	string	ALL
 resources.database_instances.*.parent_instance_ref.uid	string	ALL
-resources.database_instances.*.permissions	[]resources.DatabaseInstancePermission	INPUT
-resources.database_instances.*.permissions[*]	resources.DatabaseInstancePermission	INPUT
+resources.database_instances.*.permissions	[]resources.Permission	INPUT
+resources.database_instances.*.permissions[*]	resources.Permission	INPUT
 resources.database_instances.*.permissions[*].group_name	string	INPUT
-resources.database_instances.*.permissions[*].level	resources.DatabaseInstancePermissionLevel	INPUT
+resources.database_instances.*.permissions[*].level	iam.PermissionLevel	INPUT
 resources.database_instances.*.permissions[*].service_principal_name	string	INPUT
 resources.database_instances.*.permissions[*].user_name	string	INPUT
 resources.database_instances.*.pg_version	string	ALL
@@ -669,7 +669,7 @@ resources.experiments.*.name	string	ALL
 resources.experiments.*.permissions	[]resources.MlflowExperimentPermission	INPUT
 resources.experiments.*.permissions[*]	resources.MlflowExperimentPermission	INPUT
 resources.experiments.*.permissions[*].group_name	string	INPUT
-resources.experiments.*.permissions[*].level	resources.MlflowExperimentPermissionLevel	INPUT
+resources.experiments.*.permissions[*].level	ml.ExperimentPermissionLevel	INPUT
 resources.experiments.*.permissions[*].service_principal_name	string	INPUT
 resources.experiments.*.permissions[*].user_name	string	INPUT
 resources.experiments.*.tags	[]ml.ExperimentTag	ALL
@@ -932,7 +932,7 @@ resources.jobs.*.performance_target	jobs.PerformanceTarget	ALL
 resources.jobs.*.permissions	[]resources.JobPermission	INPUT
 resources.jobs.*.permissions[*]	resources.JobPermission	INPUT
 resources.jobs.*.permissions[*].group_name	string	INPUT
-resources.jobs.*.permissions[*].level	resources.JobPermissionLevel	INPUT
+resources.jobs.*.permissions[*].level	jobs.JobPermissionLevel	INPUT
 resources.jobs.*.permissions[*].service_principal_name	string	INPUT
 resources.jobs.*.permissions[*].user_name	string	INPUT
 resources.jobs.*.queue	*jobs.QueueSettings	ALL
@@ -2109,7 +2109,7 @@ resources.model_serving_endpoints.*.name	string	INPUT	STATE
 resources.model_serving_endpoints.*.permissions	[]resources.ModelServingEndpointPermission	INPUT
 resources.model_serving_endpoints.*.permissions[*]	resources.ModelServingEndpointPermission	INPUT
 resources.model_serving_endpoints.*.permissions[*].group_name	string	INPUT
-resources.model_serving_endpoints.*.permissions[*].level	resources.ModelServingEndpointPermissionLevel	INPUT
+resources.model_serving_endpoints.*.permissions[*].level	serving.ServingEndpointPermissionLevel	INPUT
 resources.model_serving_endpoints.*.permissions[*].service_principal_name	string	INPUT
 resources.model_serving_endpoints.*.permissions[*].user_name	string	INPUT
 resources.model_serving_endpoints.*.rate_limits	[]serving.RateLimit	INPUT	STATE
@@ -2160,7 +2160,7 @@ resources.models.*.permission_level	ml.PermissionLevel	REMOTE
 resources.models.*.permissions	[]resources.MlflowModelPermission	INPUT
 resources.models.*.permissions[*]	resources.MlflowModelPermission	INPUT
 resources.models.*.permissions[*].group_name	string	INPUT
-resources.models.*.permissions[*].level	resources.MlflowModelPermissionLevel	INPUT
+resources.models.*.permissions[*].level	ml.RegisteredModelPermissionLevel	INPUT
 resources.models.*.permissions[*].service_principal_name	string	INPUT
 resources.models.*.permissions[*].user_name	string	INPUT
 resources.models.*.tags	[]ml.ModelTag	ALL
@@ -2485,7 +2485,7 @@ resources.pipelines.*.notifications[*].email_recipients[*]	string	ALL
 resources.pipelines.*.permissions	[]resources.PipelinePermission	INPUT
 resources.pipelines.*.permissions[*]	resources.PipelinePermission	INPUT
 resources.pipelines.*.permissions[*].group_name	string	INPUT
-resources.pipelines.*.permissions[*].level	resources.PipelinePermissionLevel	INPUT
+resources.pipelines.*.permissions[*].level	pipelines.PipelinePermissionLevel	INPUT
 resources.pipelines.*.permissions[*].service_principal_name	string	INPUT
 resources.pipelines.*.permissions[*].user_name	string	INPUT
 resources.pipelines.*.photon	bool	ALL
@@ -2640,10 +2640,10 @@ resources.postgres_projects.*.lifecycle	resources.Lifecycle	INPUT
 resources.postgres_projects.*.lifecycle.prevent_destroy	bool	INPUT
 resources.postgres_projects.*.modified_status	string	INPUT
 resources.postgres_projects.*.name	string	REMOTE
-resources.postgres_projects.*.permissions	[]resources.DatabaseProjectPermission	INPUT
-resources.postgres_projects.*.permissions[*]	resources.DatabaseProjectPermission	INPUT
+resources.postgres_projects.*.permissions	[]resources.Permission	INPUT
+resources.postgres_projects.*.permissions[*]	resources.Permission	INPUT
 resources.postgres_projects.*.permissions[*].group_name	string	INPUT
-resources.postgres_projects.*.permissions[*].level	resources.DatabaseProjectPermissionLevel	INPUT
+resources.postgres_projects.*.permissions[*].level	iam.PermissionLevel	INPUT
 resources.postgres_projects.*.permissions[*].service_principal_name	string	INPUT
 resources.postgres_projects.*.permissions[*].user_name	string	INPUT
 resources.postgres_projects.*.pg_version	int	INPUT	STATE
@@ -2890,7 +2890,7 @@ resources.sql_warehouses.*.odbc_params.protocol	string	REMOTE
 resources.sql_warehouses.*.permissions	[]resources.SqlWarehousePermission	INPUT
 resources.sql_warehouses.*.permissions[*]	resources.SqlWarehousePermission	INPUT
 resources.sql_warehouses.*.permissions[*].group_name	string	INPUT
-resources.sql_warehouses.*.permissions[*].level	resources.SqlWarehousePermissionLevel	INPUT
+resources.sql_warehouses.*.permissions[*].level	sql.WarehousePermissionLevel	INPUT
 resources.sql_warehouses.*.permissions[*].service_principal_name	string	INPUT
 resources.sql_warehouses.*.permissions[*].user_name	string	INPUT
 resources.sql_warehouses.*.spot_instance_policy	sql.SpotInstancePolicy	ALL

acceptance/internal/prepare_server.go

@@ -64,7 +64,7 @@ func isTruePtr(value *bool) bool {
 }
 
 func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, outputDir string) (*sdkconfig.Config, iam.User) {
-	cloudEnv := os.Getenv("CLOUD_ENV")
+	cloudEnv := env.Get(t.Context(), "CLOUD_ENV")
 	recordRequests := isTruePtr(config.RecordRequests)
 
 	// Use a unique token for each test. This allows us to maintain
@@ -107,7 +107,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 	// use the default shared server.
 	if len(config.Server) == 0 && !recordRequests {
 		cfg := &sdkconfig.Config{
-			Host:  os.Getenv("DATABRICKS_DEFAULT_HOST"),
+			Host:  env.Get(t.Context(), "DATABRICKS_DEFAULT_HOST"),
 			Token: token,
 		}
 

bundle/config/mutator/resourcemutator/apply_bundle_permissions.go

@@ -13,6 +13,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 )
 
 var (
@@ -151,7 +152,7 @@ func (m *bundlePermissions) Apply(ctx context.Context, b *bundle.Bundle) diag.Di
 
 func validatePermissions(b *bundle.Bundle) error {
 	for _, p := range b.Config.Permissions {
-		if !slices.Contains(allowedLevels, p.Level) {
+		if !slices.Contains(allowedLevels, string(p.Level)) {
 			return fmt.Errorf("invalid permission level: %s, allowed values: [%s]", p.Level, strings.Join(allowedLevels, ", "))
 		}
 	}
@@ -172,7 +173,7 @@ func convertPermissions(
 ) []resources.Permission {
 	var permissions []resources.Permission
 	for _, p := range bundlePermissions {
-		level, ok := lm[p.Level]
+		level, ok := lm[string(p.Level)]
 		// If there is no bundle permission level defined in the map, it means
 		// it's not applicable for the resource, therefore skipping
 		if !ok {
@@ -184,7 +185,7 @@ func convertPermissions(
 		}
 
 		permissions = append(permissions, resources.Permission{
-			Level:                level,
+			Level:                iam.PermissionLevel(level),
 			UserName:             p.UserName,
 			GroupName:            p.GroupName,
 			ServicePrincipalName: p.ServicePrincipalName,

bundle/config/mutator/resourcemutator/apply_bundle_permissions_test.go

@@ -132,8 +132,8 @@ func TestApplyBundlePermissions(t *testing.T) {
 	require.Contains(t, b.Config.Resources.ModelServingEndpoints["endpoint_2"].Permissions, resources.ModelServingEndpointPermission{Level: "CAN_QUERY", ServicePrincipalName: "TestServicePrincipal"})
 
 	require.Len(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, 2)
-	require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.DashboardPermission{Level: "CAN_MANAGE", UserName: "TestUser"})
-	require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.DashboardPermission{Level: "CAN_READ", GroupName: "TestGroup"})
+	require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.Permission{Level: "CAN_MANAGE", UserName: "TestUser"})
+	require.Contains(t, b.Config.Resources.Dashboards["dashboard_1"].Permissions, resources.Permission{Level: "CAN_READ", GroupName: "TestGroup"})
 
 	require.Len(t, b.Config.Resources.Apps["app_1"].Permissions, 2)
 	require.Contains(t, b.Config.Resources.Apps["app_1"].Permissions, resources.AppPermission{Level: "CAN_MANAGE", UserName: "TestUser"})

bundle/config/mutator/resourcemutator/run_as.go

@@ -201,7 +201,7 @@ func setPipelineOwnersToRunAsIdentity(b *bundle.Bundle) {
 				(runAs.UserName != "" && p.UserName == runAs.UserName)
 		})
 		pipeline.Permissions = append(pipeline.Permissions, resources.PipelinePermission{
-			Level:                "IS_OWNER",
+			Level:                pipelines.PipelinePermissionLevelIsOwner,
 			ServicePrincipalName: runAs.ServicePrincipalName,
 			UserName:             runAs.UserName,
 		})

bundle/config/resources/alerts.go

@@ -14,7 +14,7 @@ type Alert struct {
 	BaseResource
 	sql.AlertV2 //nolint AlertV2 also defines Id and URL field with the same json tag "id" and "url"
 
-	Permissions []AlertPermission `json:"permissions,omitempty"`
+	Permissions []Permission `json:"permissions,omitempty"`
 
 	// Filepath points to the local .dbalert.json file containing the alert definition.
 	// If specified, any fields that are part of the .dbalert.json file schema will not be allowed in

bundle/config/resources/dashboard.go

@@ -80,7 +80,7 @@ type Dashboard struct {
 	BaseResource
 	DashboardConfig
 
-	Permissions []DashboardPermission `json:"permissions,omitempty"`
+	Permissions []Permission `json:"permissions,omitempty"`
 
 	// FilePath points to the local `.lvdash.json` file containing the dashboard definition.
 	// This is inlined into serialized_dashboard during deployment. The file_path is kept around

bundle/config/resources/database_instance.go

@@ -14,7 +14,7 @@ type DatabaseInstance struct {
 	BaseResource
 	database.DatabaseInstance
 
-	Permissions []DatabaseInstancePermission `json:"permissions,omitempty"`
+	Permissions []Permission `json:"permissions,omitempty"`
 }
 
 func (d *DatabaseInstance) Exists(ctx context.Context, w *databricks.WorkspaceClient, name string) (bool, error) {