Validate required/unit-constrained UC fields early in bundle validate

[radakam]

Changes

bundle validate (and therefore plan/deploy) now fails early with a clear, actionable error for three UC fields that the SDK models as optional but the backend requires:

• sql_warehouses.*.name — errors with sql_warehouse name is required.
• grants[*].principal — errors with grant principal is required, on every securable that supports grants (catalogs, schemas, volumes, external_locations, registered_models, vector_search_indexes).
• catalogs/schemas.*.custom_max_retention_hours — errors when out of range: the field is in hours but the backend only accepts 0 or 168–720 (7–30 days), e.g. custom_max_retention_hours must be 0 or between 168 and 720 hours (7 to 30 days), got 7.

Implemented in the existing validate:required mutator (runs in phases.Initialize(), covering validate/plan/deploy), following the existing dashboard bespoke-validation precedent.

Why

These fields were modeled as loosely-typed/optional (json:"...,omitempty"), so bundle validate and bundle plan passed but the deploy was rejected by the backend with late, low-context 400s (e.g. Invalid PermissionsChange — at least one of 'principal' or 'principal_id' must be set, or recovery period must be 0 or between 7 and 30 days). Discovered via fuzz testing; affects both the Terraform and direct engines. Failing early with a message that names the offending field is much more actionable.

Tests

• New acceptance tests under acceptance/bundle/validate/:
  • sql_warehouse_required_name/ (both engines)
  • grants_required_principal/ (direct-only; verifies a missing principal errors while a valid grant passes)
  • retention_hours_range/ (direct-only; verifies out-of-range values on catalogs and schemas error while in-range values pass)
• Refreshed the empty_resources golden files that now surface the sql_warehouse name is required error.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 81814b5

Run: 28870933374

	Env	🔄​flaky	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux		4	4	230	1067	4:59
💚​	aws windows		4	4	232	1065	6:15
💚​	aws-ucws linux		4	4	314	985	6:24
💚​	aws-ucws windows		4	4	316	983	6:03
💚​	azure linux		4	4	230	1066	5:08
💚​	azure windows		4	4	232	1064	6:00
💚​	azure-ucws linux		4	4	316	982	6:38
🔄​	azure-ucws windows	2	4	4	316	980	6:49
💚​	gcp linux		4	4	229	1068	4:54
💚​	gcp windows		4	4	231	1066	5:46

10 interesting tests: 4 RECOVERED, 4 SKIP, 2 flaky

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🔄​	TestWorkspaceFilesExtensions_ExportFormatIsPreserved	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p
🔄​	TestWorkspaceFilesExtensions_ExportFormatIsPreserved/jupyter_r	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R

Top 10 slowest tests (at least 2 minutes):

duration	env	testname
5:24	azure-ucws windows	TestAccept
5:22	aws windows	TestAccept
5:03	gcp windows	TestAccept
5:03	azure windows	TestAccept
5:02	aws-ucws windows	TestAccept
2:58	azure linux	TestAccept
2:55	aws linux	TestAccept
2:54	azure-ucws linux	TestAccept
2:54	gcp linux	TestAccept
2:48	aws-ucws linux	TestAccept

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

17 files changed
Suggested: @denik
Also eligible: @janniklasrose, @pietern, @anton-107, @shreyas-goenka, @andrewnester, @lennartkats-db

/bundle/ - needs approval

Files: bundle/config/validate/required.go
Suggested: @denik
Also eligible: @janniklasrose, @pietern, @anton-107, @shreyas-goenka, @andrewnester, @lennartkats-db

General files (require maintainer)

Files: NEXT_CHANGELOG.md
Based on git history:

• @denik -- recent work in ./, acceptance/bundle/validate/empty_resources/with_permissions/, acceptance/bundle/validate/empty_resources/empty_dict/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose) can approve all areas.
See OWNERS for ownership rules.}