Skip to content

Warn when bundle run_as may lack file/resource access - #7313

Open
lennartkats-db wants to merge 4 commits into
mainfrom
lennart/warn-bundle-runas-file-access
Open

Warn when bundle run_as may lack file/resource access#7313
lennartkats-db wants to merge 4 commits into
mainfrom
lennart/warn-bundle-runas-file-access

Conversation

@lennartkats-db

@lennartkats-db lennartkats-db commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

Warn when a bundle's top-level run_as identity may lack access to deployed files or resources, including before a job is added. Suggest top-level CAN_VIEW, or folder-level CAN_READ for source-linked and Shared files. Top-level permissions also apply to bundle resources, including clusters (CAN_VIEW maps to CAN_ATTACH_TO).

$ databricks bundle deploy
Warning: run_as identity "sp_test" is not in bundle top-level permissions
  in databricks.yml:5:3

Add a top-level permission so this identity can access deployed files and resources:
  permissions:
    - service_principal_name: sp_test
      level: CAN_VIEW

Why

Access to a job or pipeline does not necessarily grant its run_as identity access to referenced files or resources such as clusters.

Tests

  • go test ./bundle/phases ./bundle/permissions -count=1
  • go test ./acceptance -run 'TestAccept/bundle/run_as' -count=1

@lennartkats-db
lennartkats-db requested review from a team as code owners November 3, 2026 13:27
@github-actions github-actions Bot added the DABs DABs related issues label Nov 3, 2026
@lennartkats-db lennartkats-db changed the title [draft] Warn when bundle run_as may lack file access [draft] Warn when bundle run_as may lack file/resource access Nov 3, 2026
@lennartkats-db lennartkats-db changed the title [draft] Warn when bundle run_as may lack file/resource access Warn when bundle run_as may lack file/resource access Nov 3, 2026
@github-actions

github-actions Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Commit: 7f060af26 | Workflow run

Regression test report

Selected 12 changed tests (limit=20, 0 not selected)

21 tests: regression=19 unreleased=0 coverage=2 failing=0
test branch main (21db1be) latest (v1.24.0)
TestAccept/bundle/migrate/command/runas/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/allowed/regular_user/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/allowed/regular_user/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/allowed/service_principal/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/allowed/service_principal/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/dashboard_embed/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/dashboard_embed/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/empty_override/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/empty_override/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/empty_run_as_dict/DMS= ✅ ✅ ✅
TestAccept/bundle/run_as/empty_run_as_dict/DMS=true ✅ ✅ ✅
TestAccept/bundle/run_as/pipelines/regular_user/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/pipelines/regular_user/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/pipelines/service_principal/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/pipelines/service_principal/DMS=true ✅ ❌ ❌
TestAccept/bundle/run_as/pipelines_legacy/DMS= ✅ ❌ ❌
TestAccept/bundle/run_as/pipelines_legacy/DMS=true ✅ ❌ ❌
TestAccept/bundle/telemetry/deploy-experimental/DMS= ✅ ❌ ❌
TestAccept/bundle/telemetry/deploy-run-as/DMS= ✅ ❌ ❌
TestAccept/bundle/migrate/command/runas/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/migrate/command/runas/output.txt
        +++ /tmp/TestAcceptbundlemigratecommandrunasDMS=2244358282/002/output.txt
        @@ -4,14 +4,6 @@
         >>> print_requests.py //pipelines
         
         >>> print_state.py
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -29,14 +21,6 @@
         >>> [CLI] pipelines get [UUID]
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle deployment migrate
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -61,14 +45,6 @@
         >>> print_state.py
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -84,14 +60,6 @@
         Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle plan -o json
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -106,14 +74,6 @@
         
         
         >>> DATABRICKS_BUNDLE_ENGINE= [CLI] bundle destroy --auto-approve
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:22:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/output.txt
        +++ /tmp/TestAcceptbundlerun_asDMS=1494242340/002/output.txt
        @@ -8,14 +8,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_user_run_as
        -Warning: run_as identity "user_base" is not in bundle top-level permissions
        -  in databricks.yml:39:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: user_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"user_name":"user_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}
        @@ -24,14 +16,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_sp_run_as
        -Warning: run_as identity "sp_base" is not in bundle top-level permissions
        -  in databricks.yml:43:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: sp_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"service_principal_name":"sp_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/output.txt
        +++ /tmp/TestAcceptbundlerun_asDMS=true3033185274/002/output.txt
        @@ -8,14 +8,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_user_run_as
        -Warning: run_as identity "user_base" is not in bundle top-level permissions
        -  in databricks.yml:39:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: user_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"user_name":"user_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}
        @@ -24,14 +16,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_sp_run_as
        -Warning: run_as identity "sp_base" is not in bundle top-level permissions
        -  in databricks.yml:43:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: sp_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"service_principal_name":"sp_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}
        
FAIL

latest (v1.24.0):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/output.txt
        +++ /tmp/TestAcceptbundlerun_asDMS=true340484887/002/output.txt
        @@ -8,14 +8,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_user_run_as
        -Warning: run_as identity "user_base" is not in bundle top-level permissions
        -  in databricks.yml:39:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: user_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"user_name":"user_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}
        @@ -24,14 +16,6 @@
         pipelines.pipeline_two: {"service_principal_name":"sp_override"}
         
         >>> [CLI] bundle validate -o json -t with_sp_run_as
        -Warning: run_as identity "sp_base" is not in bundle top-level permissions
        -  in databricks.yml:43:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: sp_base
        -      level: CAN_VIEW
        -
         jobs.job_one: {"service_principal_name":"sp_base"}
         jobs.job_three: {"user_name":"user_override"}
         jobs.job_two: {"service_principal_name":"sp_override"}
TestAccept/bundle/run_as/allowed/regular_user/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/allowed/regular_user/output.txt
        +++ /tmp/TestAcceptbundlerun_asallowedregular_userDMS=2695749895/002/output.txt
        @@ -1,14 +1,6 @@
         
         >>> [CLI] bundle validate -o json
        -Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
        -  in databricks.yml:5:3
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: my_service_principal
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "service_principal_name": "my_service_principal"
        @@ -46,15 +37,7 @@
         }
         
         >>> [CLI] bundle validate -o json -t development
        -Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: my_user_name
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "user_name": "my_user_name"

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/allowed/regular_user/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/allowed/regular_user/output.txt
        +++ /tmp/TestAcceptbundlerun_asallowedregular_userDMS=true3506811869/002/output.txt
        @@ -1,14 +1,6 @@
         
         >>> [CLI] bundle validate -o json
        -Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
        -  in databricks.yml:5:3
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: my_service_principal
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "service_principal_name": "my_service_principal"
        @@ -46,15 +37,7 @@
         }
         
         >>> [CLI] bundle validate -o json -t development
        -Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: my_user_name
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "user_name": "my_user_name"

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/allowed/service_principal/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/allowed/service_principal/output.txt
        +++ /tmp/TestAcceptbundlerun_asallowedservice_principalDMS=39048400/002/output.txt
        @@ -1,14 +1,6 @@
         
         >>> [CLI] bundle validate -o json
        -Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
        -  in databricks.yml:5:3
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: my_service_principal
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "service_principal_name": "my_service_principal"
        @@ -46,15 +37,7 @@
         }
         
         >>> [CLI] bundle validate -o json -t development
        -Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: my_user_name
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "user_name": "my_user_name"

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/allowed/service_principal/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/allowed/service_principal/output.txt
        +++ /tmp/TestAcceptbundlerun_asallowedservice_principalDMS=true3684329915/002/output.txt
        @@ -1,14 +1,6 @@
         
         >>> [CLI] bundle validate -o json
        -Warning: run_as identity "my_service_principal" is not in bundle top-level permissions
        -  in databricks.yml:5:3
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: my_service_principal
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "service_principal_name": "my_service_principal"
        @@ -46,15 +37,7 @@
         }
         
         >>> [CLI] bundle validate -o json -t development
        -Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: my_user_name
        -      level: CAN_VIEW
        -
        -
         >>> jq .run_as
         {
           "user_name": "my_user_name"

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/dashboard_embed/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1345
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1086
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n>>> errcode [CLI] bundle validate --var embed=false\nWarning: run_as identity \"sp-name\" is not in bundle top-level permissions\n  in databricks.yml:5:3\n\nAdd a top-level permission so this identity can access deployed files and resources:\n  permissions:\n    - service_principal_name: sp-name\n      level: CAN_VIEW\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 warning\n\n>>> errcode [CLI] bundle validate --var embed=true\nError: dashboards with embed_credentials set to true do not support a setting a run_as user that is different from the owner.\nCurrent identity: [USERNAME]. Run as identity: sp-name.\nSee https://docs.databricks.com/dev-tools/bundles/run-as.html to learn more about the run_as property.\n  in databricks.yml:14:7\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 error\n\nExit code: 1\n"
        	            	actual  : "\n>>> errcode [CLI] bundle validate --var embed=false\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nValidation OK!\n\n>>> errcode [CLI] bundle validate --var embed=true\nError: dashboards with embed_credentials set to true do not support a setting a run_as user that is different from the owner.\nCurrent identity: [USERNAME]. Run as identity: sp-name.\nSee https://docs.databricks.com/dev-tools/bundles/run-as.html to learn more about the run_as property.\n  in databricks.yml:14:7\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 error\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -2,10 +2,2 @@
        	            	 >>> errcode [CLI] bundle validate --var embed=false
        	            	-Warning: run_as identity "sp-name" is not in bundle top-level permissions
        	            	-  in databricks.yml:5:3
        	            	-
        	            	-Add a top-level permission so this identity can access deployed files and resources:
        	            	-  permissions:
        	            	-    - service_principal_name: sp-name
        	            	-      level: CAN_VIEW
        	            	-
        	            	 Name: dashboard_embed
        	            	@@ -16,3 +8,3 @@
        	            	 
        	            	-Found 1 warning
        	            	+Validation OK!
        	            	 
        	Test:       	TestAccept/bundle/run_as/dashboard_embed/DMS=
        	Messages:   	bundle/run_as/dashboard_embed/output.txt vs /tmp/TestAcceptbundlerun_asdashboard_embedDMS=2920446469/002/output.txt

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/dashboard_embed/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1345
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1086
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "\n>>> errcode [CLI] bundle validate --var embed=false\nWarning: run_as identity \"sp-name\" is not in bundle top-level permissions\n  in databricks.yml:5:3\n\nAdd a top-level permission so this identity can access deployed files and resources:\n  permissions:\n    - service_principal_name: sp-name\n      level: CAN_VIEW\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 warning\n\n>>> errcode [CLI] bundle validate --var embed=true\nError: dashboards with embed_credentials set to true do not support a setting a run_as user that is different from the owner.\nCurrent identity: [USERNAME]. Run as identity: sp-name.\nSee https://docs.databricks.com/dev-tools/bundles/run-as.html to learn more about the run_as property.\n  in databricks.yml:14:7\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 error\n\nExit code: 1\n"
        	            	actual  : "\n>>> errcode [CLI] bundle validate --var embed=false\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nValidation OK!\n\n>>> errcode [CLI] bundle validate --var embed=true\nError: dashboards with embed_credentials set to true do not support a setting a run_as user that is different from the owner.\nCurrent identity: [USERNAME]. Run as identity: sp-name.\nSee https://docs.databricks.com/dev-tools/bundles/run-as.html to learn more about the run_as property.\n  in databricks.yml:14:7\n\nName: dashboard_embed\nTarget: default\nWorkspace:\n  User: [USERNAME]\n  Path: /Workspace/Users/[USERNAME]/.bundle/dashboard_embed/default\n\nFound 1 error\n\nExit code: 1\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -2,10 +2,2 @@
        	            	 >>> errcode [CLI] bundle validate --var embed=false
        	            	-Warning: run_as identity "sp-name" is not in bundle top-level permissions
        	            	-  in databricks.yml:5:3
        	            	-
        	            	-Add a top-level permission so this identity can access deployed files and resources:
        	            	-  permissions:
        	            	-    - service_principal_name: sp-name
        	            	-      level: CAN_VIEW
        	            	-
        	            	 Name: dashboard_embed
        	            	@@ -16,3 +8,3 @@
        	            	 
        	            	-Found 1 warning
        	            	+Validation OK!
        	            	 
        	Test:       	TestAccept/bundle/run_as/dashboard_embed/DMS=true
        	Messages:   	bundle/run_as/dashboard_embed/output.txt vs /tmp/TestAcceptbundlerun_asdashboard_embedDMS=true2532510222/002/output.txt

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/empty_override/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1345
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1086
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "Warning: run_as identity \"my_user_name\" is not in bundle top-level permissions\n  in databricks.yml:5:3\n\nAdd a top-level permission so this identity can access deployed files and resources:\n  permissions:\n    - user_name: my_user_name\n      level: CAN_VIEW\n\n        \"run_as\": {\n  \"run_as\": {\n"
        	            	actual  : "        \"run_as\": {\n  \"run_as\": {\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -1,9 +1 @@
        	            	-Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        	            	-  in databricks.yml:5:3
        	            	-
        	            	-Add a top-level permission so this identity can access deployed files and resources:
        	            	-  permissions:
        	            	-    - user_name: my_user_name
        	            	-      level: CAN_VIEW
        	            	-
        	            	         "run_as": {
        	Test:       	TestAccept/bundle/run_as/empty_override/DMS=
        	Messages:   	bundle/run_as/empty_override/output.txt vs /tmp/TestAcceptbundlerun_asempty_overrideDMS=1415569694/002/output.txt

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/empty_override/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: 
        	Error Trace:	/home/runner/work/cli/cli/libs/testdiff/testdiff.go:22
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1345
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:1086
        	            				/home/runner/work/cli/cli/acceptance/acceptance_test.go:660
        	Error:      	Not equal: 
        	            	expected: "Warning: run_as identity \"my_user_name\" is not in bundle top-level permissions\n  in databricks.yml:5:3\n\nAdd a top-level permission so this identity can access deployed files and resources:\n  permissions:\n    - user_name: my_user_name\n      level: CAN_VIEW\n\n        \"run_as\": {\n  \"run_as\": {\n"
        	            	actual  : "        \"run_as\": {\n  \"run_as\": {\n"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -1,9 +1 @@
        	            	-Warning: run_as identity "my_user_name" is not in bundle top-level permissions
        	            	-  in databricks.yml:5:3
        	            	-
        	            	-Add a top-level permission so this identity can access deployed files and resources:
        	            	-  permissions:
        	            	-    - user_name: my_user_name
        	            	-      level: CAN_VIEW
        	            	-
        	            	         "run_as": {
        	Test:       	TestAccept/bundle/run_as/empty_override/DMS=true
        	Messages:   	bundle/run_as/empty_override/output.txt vs /tmp/TestAcceptbundlerun_asempty_overrideDMS=true3227407576/002/output.txt

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/pipelines/regular_user/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/pipelines/regular_user/output.txt
        +++ /tmp/TestAcceptbundlerun_aspipelinesregular_userDMS=4027463190/002/output.txt
        @@ -25,53 +25,21 @@
         \nProcessing target: t_user_name_different
         
         >>> [CLI] bundle validate -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_user_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -80,53 +34,21 @@
         \nProcessing target: t_service_principal_name
         
         >>> [CLI] bundle validate -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -135,53 +43,21 @@
         \nProcessing target: t_service_principal_name_different
         
         >>> [CLI] bundle validate -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions

latest (v1.24.0): same output as main (21db1be)

TestAccept/bundle/run_as/pipelines/regular_user/DMS=true: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/pipelines/regular_user/output.txt
        +++ /tmp/TestAcceptbundlerun_aspipelinesregular_userDMS=true2008861013/002/output.txt
        @@ -25,53 +25,21 @@
         \nProcessing target: t_user_name_different
         
         >>> [CLI] bundle validate -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_user_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -80,53 +34,21 @@
         \nProcessing target: t_service_principal_name
         
         >>> [CLI] bundle validate -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -135,53 +43,21 @@
         \nProcessing target: t_service_principal_name_different
         
         >>> [CLI] bundle validate -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions

latest (v1.24.0):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/pipelines/regular_user/output.txt
        +++ /tmp/TestAcceptbundlerun_aspipelinesregular_userDMS=true3317610333/002/output.txt
        @@ -25,53 +25,21 @@
         \nProcessing target: t_user_name_different
         
         >>> [CLI] bundle validate -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_user_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -80,53 +34,21 @@
         \nProcessing target: t_service_principal_name
         
         >>> [CLI] bundle validate -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:10:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - service_principal_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -135,53 +43,21 @@
         \nProcessing target: t_service_principal_name_different
         
         >>> [CLI] bundle validate -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        
FAIL
TestAccept/bundle/run_as/pipelines/service_principal/DMS=: branch ✅ | main (21db1be) ❌ | latest (v1.24.0) ❌

main (21db1be):

acceptance_test.go:1345: Diff:
        --- bundle/run_as/pipelines/service_principal/output.txt
        +++ /tmp/TestAcceptbundlerun_aspipelinesservice_principalDMS=2279636932/002/output.txt
        @@ -2,53 +2,21 @@
         === run_as should succeed in all cases\nProcessing target: t_user_name
         
         >>> [CLI] bundle validate -t t_user_name
        -Warning: run_as identity "tester@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:7:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: tester@databricks.com
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_user_name
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_user_name
        -Warning: run_as identity "tester@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:7:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: tester@databricks.com
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "tester@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:7:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: tester@databricks.com
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_user_name
        -Warning: run_as identity "tester@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:7:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: tester@databricks.com
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -57,53 +11,21 @@
         \nProcessing target: t_user_name_different
         
         >>> [CLI] bundle validate -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_user_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_user_name_different
        -Warning: run_as identity "different@databricks.com" is not in bundle top-level permissions
        -  in databricks.yml:13:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: different@databricks.com
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_user_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions
        @@ -135,53 +43,21 @@
         \nProcessing target: t_service_principal_name_different
         
         >>> [CLI] bundle validate -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Name: run_as
         Target: t_service_principal_name_different
         Workspace:
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different
         
        -Found 1 warning
        +Validation OK!
         
         >>> [CLI] bundle plan -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         create pipelines.nyc_taxi_pipeline
         create pipelines.nyc_taxi_pipeline.permissions
         
         Plan: 2 to add, 0 to change, 0 to delete, 0 unchanged
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
         
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
        -
         >>> [CLI] bundle deploy -t t_service_principal_name_different
        -Warning: run_as identity "[UUID]" is not in bundle top-level permissions
        -  in databricks.yml:16:7
        -
        -Add a top-level permission so this identity can access deployed files and resources:
        -  permissions:
        -    - user_name: [UUID]
        -      level: CAN_VIEW
        -
         Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/run_as/t_service_principal_name_different/files...
         Created pipelines.nyc_taxi_pipeline
         Created pipelines.nyc_taxi_pipeline.permissions

latest (v1.24.0): same output as main (21db1be)

5 more failure details omitted, see the full report in the run.

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

✅ Integration test report

Commit: 7f060af

Run: 42497215514

Env ✅​pass 🙈​skip Time
✅​ aws linux-2core-8gb 271 27 3:51
✅​ aws-windows-latest-4core-16gb 273 25 2:54
✅​ azure linux-2core-8gb 270 27 3:45
✅​ azure-windows-latest-4core-16gb 272 25 2:37
✅​ gcp linux-2core-8gb 271 27 3:45
✅​ gcp-windows-latest-4core-16gb 273 25 2:44
Top 3 slowest tests (at least 2 minutes):
duration env testname
2:49 aws-windows-latest-4core-16gb TestAccept
2:38 gcp-windows-latest-4core-16gb TestAccept
2:33 azure-windows-latest-4core-16gb TestAccept

pietern
pietern reviewed Nov 4, 2026
View reviewed changes
Comment thread bundle/permissions/permission_diagnostics.go Outdated

func (m *permissionDiagnostics) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
diags := runAsAccessDiagnostics(b)
// Only recommend deployment-identity access when top-level permissions are explicit.

@pietern pietern Nov 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment and the conditional below disagree; it recommends deployment identity access without top-level permissions being set. I agree this should only show up when users are using the top-level permissions block. I think this is also why this shows up in the acc test output so much.

@lennartkats-db lennartkats-db Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, yes, the comment is inaccurate, but the behavior should be correct. I fixed the comment.

The goal is that we show the warning for any bundle with run_as and no permission for that run_as. Even for the case where there was no prior permissions section.

@lennartkats-db
lennartkats-db force-pushed the lennart/warn-bundle-runas-file-access branch from cc74d5f to b1f07f6 Compare November 8, 2026 12:28
@lennartkats-db
lennartkats-db force-pushed the lennart/warn-bundle-runas-file-access branch from b1f07f6 to 7f060af Compare November 8, 2026 15:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pietern pietern Awaiting requested review from pietern

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

DABs DABs related issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lennartkats-db @eng-dev-ecosystem-bot @pietern