Allow resource permissions to override root and target defaults by lennartkats-db · Pull Request #7291 · databricks/cli

lennartkats-db · 2026-11-02T16:09:04Z

Changes

Remove overlap warnings when resource permissions and bundle or target permissions name the same principal. This lets the layered configuration in the issue pass bundle validate --strict while retaining the resource permission. The rule covers supported resources, users, groups, and service principals, including resolved complex variables. Effective resource permissions are unchanged.

Correct the cluster policy and secret scope schema descriptions to match which resources inherit bundle or target permissions.

Why

In #7032, a group has CAN_VIEW on a target and CAN_MANAGE_RUN on a job. Validation kept the job permission but emitted a warning, which made strict validation fail. The same resource-over-default rule applies to bundle-level permissions.

Tests

./task generate-schema passed after the documentation correction.
go test ./bundle/config/mutator/resourcemutator ./bundle/internal/schema ./bundle/config -count=1 passed with Go 1.27.4.
The CI regression report passed all four changed acceptance cases on the prior PR head. Each case fails on main, confirming that the warning regression is detected for both DMS settings.
Local acceptance setup could not start because the configured Go proxy returned 403 module is blocked for github.com/BurntSushi/[email protected].

eng-dev-ecosystem-bot · 2026-11-02T16:38:01Z

✅ Integration test report

Commit: e5e4408

Run: 43637624449

	Env	💚RECOVERED	✅pass	🙈skip	Time
💚	aws linux-2core-8gb	1	270	17	3:29
💚	aws-windows-latest-4core-16gb	1	272	15	3:24
💚	azure linux-2core-8gb	1	269	17	3:25
💚	azure-windows-latest-4core-16gb	1	271	15	3:16
💚	gcp linux-2core-8gb	1	270	17	3:30
💚	gcp-windows-latest-4core-16gb	1	272	15	3:35

	Test Name	aws linux-2core-8gb	aws-windows-latest-4core-16gb	azure linux-2core-8gb	azure-windows-latest-4core-16gb	gcp linux-2core-8gb	gcp-windows-latest-4core-16gb
💚	TestAccept	💚R	💚R	💚R	💚R	💚R	💚R

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:29	gcp-windows-latest-4core-16gb	TestAccept
3:20	aws-windows-latest-4core-16gb	TestAccept
3:14	azure-windows-latest-4core-16gb	TestAccept

github-actions · 2026-11-06T10:46:32Z

Commit: e5e44085b | Workflow run

Regression test report

Selected 2 changed tests (limit=20, 0 not selected)

4 tests: regression=4 unreleased=0 coverage=0 failing=0

test	branch	main (`2699068`)	latest (v1.26.0)
TestAccept/bundle/validate/permissions_overlap/DMS=	✅	❌	❌
TestAccept/bundle/validate/permissions_overlap/DMS=true	✅	❌	❌
TestAccept/bundle/validate/permissions_target/DMS=	✅	❌	❌
TestAccept/bundle/validate/permissions_target/DMS=true	✅	❌	❌

TestAccept/bundle/validate/permissions_overlap/DMS=: branch ✅ | main (2699068) ❌ | latest (v1.26.0) ❌

main (2699068):

acceptance_test.go:1374: Diff:
        --- bundle/validate/permissions_overlap/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_overlapDMS=2024822943/002/output.txt
        @@ -1,5 +1,7 @@
         
         >>> [CLI] bundle validate -o json
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -44,6 +46,8 @@
         }
         
         >>> [CLI] bundle validate --strict
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -62,4 +66,7 @@
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
         
        -Found 1 recommendation
        +Found 1 warning and 1 recommendation
        +Error: 1 warning was found. Warnings are treated as errors in strict mode
        +
        +Exit code: 1
        
    acceptance_test.go:1164: Test produced unexpected files:
        .databricks/.gitignore

latest (v1.26.0): same output as main (2699068)

TestAccept/bundle/validate/permissions_overlap/DMS=true: branch ✅ | main (2699068) ❌ | latest (v1.26.0) ❌

main (2699068):

acceptance_test.go:1374: Diff:
        --- bundle/validate/permissions_overlap/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_overlapDMS=true2382108080/002/output.txt
        @@ -1,5 +1,7 @@
         
         >>> [CLI] bundle validate -o json
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -44,6 +46,8 @@
         }
         
         >>> [CLI] bundle validate --strict
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -62,4 +66,7 @@
           User: [USERNAME]
           Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
         
        -Found 1 recommendation
        +Found 1 warning and 1 recommendation
        +Error: 1 warning was found. Warnings are treated as errors in strict mode
        +
        +Exit code: 1
        
    acceptance_test.go:1164: Test produced unexpected files:
        .databricks/.gitignore
FAIL

latest (v1.26.0): same output as main (2699068)

TestAccept/bundle/validate/permissions_target/DMS=: branch ✅ | main (2699068) ❌ | latest (v1.26.0) ❌

main (2699068):

acceptance_test.go:1374: Diff:
        --- bundle/validate/permissions_target/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_targetDMS=1845295370/002/output.txt
        @@ -1,113 +1,29 @@
         
         >>> [CLI] bundle validate --strict -t literal -o json
        -Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
        -If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -Consider using a adding a top-level permissions section such as the following:
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
         
        -  permissions:
        -    - user_name: [USERNAME]
        -      level: CAN_MANAGE
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
         
        -See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:9:14
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  }
        -}
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
         
        ->>> [CLI] bundle validate --strict -t complex -o json
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for '[email protected]' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for '[email protected]' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -118,99 +29,8 @@
               level: CAN_MANAGE
         
         See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:43:18
        +  in databricks.yml:9:14
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
... (43 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.26.0): same output as main (2699068)

TestAccept/bundle/validate/permissions_target/DMS=true: branch ✅ | main (2699068) ❌ | latest (v1.26.0) ❌

main (2699068):

acceptance_test.go:1374: Diff:
        --- bundle/validate/permissions_target/output.txt
        +++ /tmp/TestAcceptbundlevalidatepermissions_targetDMS=true3029423467/002/output.txt
        @@ -1,113 +1,29 @@
         
         >>> [CLI] bundle validate --strict -t literal -o json
        -Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
        -If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -Consider using a adding a top-level permissions section such as the following:
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
         
        -  permissions:
        -    - user_name: [USERNAME]
        -      level: CAN_MANAGE
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
         
        -See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:9:14
        +Warning: 'jobs' already has permissions set for 'developers' group
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  }
        -}
        +Warning: 'jobs' already has permissions set for '[email protected]' user name
         
        ->>> [CLI] bundle validate --strict -t complex -o json
        +Warning: 'jobs' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for '[email protected]' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
        +Warning: 'pipelines' already has permissions set for 'developers' group
        +
        +Warning: 'pipelines' already has permissions set for '[email protected]' user name
        +
        +Warning: 'pipelines' already has permissions set for 'reader-sp' service principal name
        +
         Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
         If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
         
        @@ -118,99 +29,8 @@
               level: CAN_MANAGE
         
         See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
        -  in databricks.yml:43:18
        +  in databricks.yml:9:14
         
        -{
        -  "jobs": {
        -    "root_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ],
        -    "target_job": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_MANAGE_RUN"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "user_name": "[email protected]"
        -      },
        -      {
        -        "level": "CAN_MANAGE_RUN",
        -        "service_principal_name": "reader-sp"
        -      },
        -      {
        -        "group_name": "inherited",
        -        "level": "CAN_VIEW"
        -      },
        -      {
        -        "level": "IS_OWNER",
        -        "user_name": "[USERNAME]"
        -      }
        -    ]
        -  },
        -  "pipelines": {
        -    "root_pipeline": [
        -      {
        -        "group_name": "developers",
        -        "level": "CAN_RUN"
        -      },
        -      {
        -        "level": "CAN_RUN",
        -        "user_name": "[email protected]"
        -      },
... (43 more lines truncated, raise DATABRICKS_CLI_TEST_MAX_LOG to see more)

latest (v1.26.0): same output as main (2699068)

Sankalp-Mittal

🤖 AI review (Claude Fable 5.2 + Claude Opus 5.5, cross-verified). Only points the reviewers agreed on are posted.

Sankalp-Mittal · 2026-11-14T18:48:06Z

            The permissions to apply to this resource.
          "markdown_description": |-
-            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. A principal cannot be set in both a resource's `permissions` and the top-level `permissions` mapping.
+            A Sequence of permissions to apply to this resource, where each item grants a permission `level` to a single `user_name`, `group_name`, or `service_principal_name`. For the same principal, resource permissions take precedence over top-level or target permissions.


cluster_policies isn't in levelsMap, so top-level permissions never reach it and there is nothing to take precedence over; secret_scopes is, but lacks the sentence. Can you drop it here and add it there?

I removed the precedence sentence from cluster_policies and added it to secret_scopes, then regenerated the bundle schema. cluster_policies is skipped by ApplyBundlePermissions; secret_scopes receives the defaults. The schema and permission unit tests pass.

-- Isaac

Fixed: cluster_policies.permissions in bundle/internal/schema/annotations.yml:528-534 no longer has the precedence sentence. secret_scopes.permissions (line 1976) now has it, and the regenerated bundle/schema/jsonschema.json matches.

_{🤖 review-factory reply (Claude Opus 5.5)}

Sankalp-Mittal · 2026-11-14T18:48:06Z

@@ -0,0 +1 @@
+* Allow resource permissions to override bundle and target defaults without overlap warnings for all supported resources and principal types. ([#7291](https://github.com/databricks/cli/pull/7291))


nit: Effective permissions don't change here; only the warning goes away. Could this say that bundle validate no longer warns when a resource and the top-level or target permissions name the same principal?

I changed the release note to say bundle validate no longer warns when resource and top-level or target permissions name the same principal. Effective permissions are unchanged. The focused permission tests pass.

-- Isaac

Fixed: .nextchanges/bundles/7291.md now says bundle validate no longer warns when resource permissions and top-level or target permissions name the same principal.

_{🤖 review-factory reply (Claude Opus 5.5)}

Sankalp-Mittal

🤖 AI review (Claude Fable 5.2 + Claude Opus 5.5, cross-verified). Only points the reviewers agreed on are posted.

Sankalp-Mittal · 2026-11-14T20:05:26Z

 	}
 }
+
+func TestDuplicatePermissionsInOneSection(t *testing.T) {


nit: TestDuplicatePermissionsInOneSection never has a resource and a default naming the same principal, so it never reaches the isPermissionOverlap branch. Is it left over from 7cff8d1, and can it go?

I removed TestDuplicatePermissionsInOneSection and its unused import in e5e4408. It tested duplicates within one section, while the retained TestResourcePermissionsOverrideDefaultsWithoutWarning exercises the resource/default overlap. The focused Go package tests pass.

-- Isaac

Fixed: e5e4408 deletes TestDuplicatePermissionsInOneSection and the now-unused iam import. The resource/default overlap is still covered by TestResourcePermissionsOverrideDefaultsWithoutWarning (apply_bundle_permissions_test.go:227).

_{🤖 review-factory reply (Claude Opus 5.5)}

Sankalp-Mittal

🤖 AI review (Claude Opus 5.5 + Claude Fable 5.2, cross-verified). Only points the reviewers agreed on are posted.

No issues found.

[factory] Fix qualified DABs behavior

48d7c4c

lennartkats-db added DABs DABs related issues software-factory PR produced by the software factories task labels Nov 2, 2026

lennartkats-db added software-factory PR produced by the software factories task and removed software-factory PR produced by the software factories task labels Nov 3, 2026

lennartkats-db changed the title ~~[draft] Fix bundle/config/mutator/resourcemutator/apply_bundle_permissions.go~~ [draft] Allow job permissions to override target group permissions without warnings Nov 4, 2026

lennartkats-db marked this pull request as ready for review November 4, 2026 19:21

lennartkats-db requested review from a team as code owners November 4, 2026 19:21

lennartkats-db requested review from Sankalp-Mittal and renaudhartert-db November 4, 2026 19:21

lennartkats-db marked this pull request as draft November 4, 2026 19:21

lennartkats-db marked this pull request as ready for review November 4, 2026 21:59

Fix target permission overlap handling across resource types

0cc8036

lennartkats-db changed the title ~~[draft] Allow job permissions to override target group permissions without warnings~~ [draft] Allow resource permissions to override target defaults Nov 6, 2026

Keep target permission provenance in bundle runtime state

7cff8d1

lennartkats-db changed the title ~~[draft] Allow resource permissions to override target defaults~~ Allow resource permissions to override target defaults Nov 6, 2026

lennartkats-db changed the title ~~Allow resource permissions to override target defaults~~ [draft] Allow resource permissions to override target defaults Nov 6, 2026

Keep target selection in the existing mutator

8040c72

lennartkats-db added the ai-auto PRs made by AI loops & factories, label Nov 11, 2026

Allow resource permissions to override root and target defaults

a3c76e9

lennartkats-db changed the title ~~[draft] Allow resource permissions to override target defaults~~ [draft] Allow resource permissions to override root and target defaults Nov 11, 2026

lennartkats-db changed the title ~~[draft] Allow resource permissions to override root and target defaults~~ Allow resource permissions to override root and target defaults Nov 13, 2026

lennartkats-db requested a review from shreyas-goenka November 13, 2026 08:38

Merge main and retain permission override descriptions

b40d708

lennartkats-db requested a review from andrewnester November 13, 2026 15:22

lennartkats-db added the automerge label Nov 13, 2026

Sankalp-Mittal reviewed Nov 14, 2026

View reviewed changes

lennartkats-db added 2 commits November 14, 2026 19:07

Clarify permission overlap docs and release note

2ff445e

Regenerate Python secret scope permission docs

3c3305f

Sankalp-Mittal reviewed Nov 14, 2026

View reviewed changes

Remove unrelated duplicate permission test

e5e4408

Sankalp-Mittal reviewed Nov 14, 2026

View reviewed changes

		@@ -0,0 +1 @@
		* Allow resource permissions to override bundle and target defaults without overlap warnings for all supported resources and principal types. ([#7291](https://github.com/databricks/cli/pull/7291))

Conversation

lennartkats-db commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Why

Tests

Uh oh!

eng-dev-ecosystem-bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Integration test report

Uh oh!

github-actions Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression test report

Uh oh!

Sankalp-Mittal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sankalp-Mittal left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Sankalp-Mittal left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lennartkats-db commented Nov 2, 2026 •

edited

Loading

eng-dev-ecosystem-bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 6, 2026 •

edited

Loading