Skip to content

fix: Validate --registry-schemas types against their schema again - #4763

Merged
kddejong merged 1 commit into
aws-cloudformation:mainfrom
sayaksatpathi:fix/registry-schemas-property-validation
Oct 21, 2026
Merged

kddejong merged 1 commit into
aws-cloudformation:mainfrom
sayaksatpathi:fix/registry-schemas-property-validation

Conversation

@sayaksatpathi

Copy link
Copy Markdown
Contributor

Issue #, if available: Fixes #4762

Description of changes:

Since 1.43.0 (#4319, hash-based schema storage), get_resource_schemas_by_regions only yields a schema when the type is in a region's provider mapping. Types loaded with --registry-schemas are never in that mapping, so every region is skipped and the rules that use it (Properties for E3002/E3003/E3012, GetAtt for E1010, GetAttFormat and RefFormat) get no schema for those types. E3006 still passes because get_resource_types includes the registry types, so the template looks valid.

This looks registry types up first, before the type is normalized, which is the order get_resource_schema already uses (so a registry ::MODULE type keeps its own schema), and groups all requested regions under the one registry schema.

With the reproduction from the issue, cfn-lint --registry-schemas schemas -- example.yaml now reports:

E3002 Additional properties are not allowed ('RandomCrap' was unexpected)
example.yaml:7:7

E3003 'Name' is a required property
example.yaml:10:5

E3012 'not-an-int' is not of type 'integer'
example.yaml:11:7

E1010 'Nope' is not one of [] in ['us-east-1']
example.yaml:16:7

On main it reports nothing and exits 0.

Tests:

  • TestManagerGetResourceSchemasByRegions (test/unit/module/schema/test_manager.py): a registry type, a registry ::MODULE type, a registry type removed with --override-spec, and an unknown type.
  • TestLintRegistrySchemas (test/unit/module/test_api.py): lints through lint() with registry_schemas and asserts E1010, E3002 and E3003, and checks that the existing good/schema_resource.yaml fixture has no findings.
  • The new registry tests fail on main and pass with this change. pytest test/ passes (2951 unit, 27 integration), and ruff, isort, mypy and bandit are clean.

I used Claude Code (AI) to help investigate and write this change, and reviewed and tested it before submitting.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

🤖 Generated with Claude Code

Copilot AI balanced review requested due to automatic review settings October 15, 2026 20:05

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@sayaksatpathi

Copy link
Copy Markdown
Contributor Author

Hi maintainers, could someone please triage this PR and review the proposed fix when available?

The change addresses the regression where types supplied through --registry-schemas are recognized but their properties are not validated. I've included regression tests covering registry schemas and reported that the full test suite and static checks pass locally.

I also noticed that GitHub currently shows no check runs for this commit. Could you advise whether CI needs to be triggered or configured for this PR?

Thanks for your time.

Since 1.43.0, get_resource_schemas_by_regions only yields schemas for
types found in a region's provider mapping. Types loaded with
--registry-schemas are never in that mapping, so every region was
skipped and E3002/E3003/E3012 (Properties), E1010 (GetAtt), GetAttFormat
and RefFormat received no schema for them. E3006 still passed because
get_resource_types includes the registry types.

Look up registry types first, before the type is normalized, the same
way get_resource_schema does, and group all requested regions under the
one registry schema.

Fixes aws-cloudformation#4762

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@kddejong
kddejong force-pushed the fix/registry-schemas-property-validation branch from 5ab26a3 to 78f5999 Compare October 21, 2026 18:12
@codecov

codecov Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.67%. Comparing base (7e4b262) to head (78f5999).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4763   +/-   ##
=======================================
  Coverage   94.66%   94.67%           
=======================================
  Files         439      439           
  Lines       15963    15967    +4     
  Branches     3091     3093    +2     
=======================================
+ Hits        15112    15116    +4     
  Misses        468      468           
  Partials      383      383           
Flag Coverage Δ
unittests 94.67% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kddejong
kddejong merged commit 92d2186 into aws-cloudformation:main Oct 21, 2026
24 of 40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

--registry-schemas types receive no property validation since 1.43.0

3 participants