bundle validate --strict rejects CREATE_SECRET/CREATE_FEATURE, privileges the Grants API already accepts

[wallace-bradley]

Summary

databricks bundle validate --strict fails on a resources.schemas.*.grants[].privileges (also resources.catalogs.*, resources.secrets.*, etc.) entry containing CREATE_SECRET or CREATE_FEATURE, even though both are real Unity Catalog privileges that the Grants REST API already accepts and applies.

Repro

resources:
  schemas:
    my_schema:
      catalog_name: my_catalog
      name: my_schema
      grants:
        - principal: someone@example.com
          privileges:
            - USE_SCHEMA
            - CREATE_SECRET

$ databricks bundle validate --strict --target dev
Warning: invalid value "CREATE_SECRET" for enum field. Valid values are [ACCESS ALL_PRIVILEGES APPLY_TAG BROWSE CREATE CREATE_CATALOG CREATE_CLEAN_ROOM CREATE_CONNECTION CREATE_EXTERNAL_LOCATION CREATE_EXTERNAL_TABLE CREATE_EXTERNAL_VOLUME CREATE_FOREIGN_CATALOG CREATE_FOREIGN_SECURABLE CREATE_FUNCTION CREATE_MANAGED_STORAGE CREATE_MATERIALIZED_VIEW CREATE_MODEL CREATE_PROVIDER CREATE_RECIPIENT CREATE_SCHEMA CREATE_SERVICE_CREDENTIAL CREATE_SHARE CREATE_STORAGE_CREDENTIAL CREATE_TABLE CREATE_VIEW CREATE_VOLUME EXECUTE EXECUTE_CLEAN_ROOM_TASK EXTERNAL_USE_LOCATION EXTERNAL_USE_SCHEMA MANAGE MANAGE_ALLOWLIST MODIFY MODIFY_CLEAN_ROOM READ_FILES READ_METADATA READ_PRIVATE_FILES READ_VOLUME REFRESH SELECT SET_SHARE_PERMISSION USAGE USE_CATALOG USE_CONNECTION USE_MARKETPLACE_ASSETS USE_PROVIDER USE_RECIPIENT USE_SCHEMA USE_SHARE WRITE_FILES WRITE_PRIVATE_FILES WRITE_VOLUME]
  at resources.schemas.my_schema.grants[0].privileges[1]

Error: 1 warning found. Warnings are not allowed in strict mode

Reproduced on CLI v1.17.0 (latest release as of 2026-09-21).

Why this is a bug, not a config mistake

CREATE_SECRET (and READ_SECRET/WRITE_SECRET/REFERENCE_SECRET) are documented Unity Catalog privileges for the Unity Catalog secrets feature, grantable at the catalog or schema level. I confirmed directly against the real Grants API that it's accepted and applied:

$ databricks grants update schema my_catalog.my_schema --json '{
  "changes": [{"principal": "someone@example.com", "add": ["CREATE_SECRET", "CREATE_FEATURE"]}]
}'
{
  "privilege_assignments": [
    {"principal": "someone@example.com", "privileges": ["CREATE_FEATURE", "CREATE_SECRET"]}
  ]
}

So the CLI's enum-validation warning (and its --strict promotion to a hard failure) has no way to be satisfied - there is no CLI version today whose local Privilege enum recognizes these values, but the platform they validate against already does.

Root cause (as far as I can trace it)

• bundle/internal/validation/generated/enum_fields.go is autogenerated (bundle/internal/validation/enum.go + main.go, run via go run ./bundle/internal/validation) by reflecting over every field whose type exposes a Values() []T method - for grants, that's catalog.Privilege in databricks-sdk-go (service/catalog/model.go).
• catalog.Privilege's const list and Values()/Set() methods don't include CREATE_SECRET/CREATE_FEATURE (or the other secret-related privileges) as of databricks-sdk-go v0.178.0 (bundled in cli v1.17.0). That release only added ExternalUseLocation.
• Since enum_fields.go is generated, not hand-maintained, this can't be fixed with a cli-only PR - it needs the missing values added to catalog.Privilege in databricks-sdk-go first, then a dependency bump + regeneration here.

Impact

Any bundle that grants CREATE_SECRET/CREATE_FEATURE (or presumably the sibling secret privileges) fails bundle validate --strict, and by extension any CI pipeline that runs it in strict mode, with no way to satisfy the check short of dropping --strict entirely for that bundle/target - which then also stops catching genuine typos/unsupported values in the same config.

Ask

Add CREATE_SECRET, READ_SECRET, WRITE_SECRET, REFERENCE_SECRET, and the feature-table equivalents (CREATE_FEATURE, and presumably READ_FEATURE) to catalog.Privilege in databricks-sdk-go, so a cli dependency bump picks them up.