Repository navigation
refactor: remove the dead E6004 outputs name rule - #4983
Merged
Merged
Conversation
E6004 has no match and no validate method -- it is a docstring and five class attributes, so it never fires. The Outputs name rule is expressed as patternProperties plus additionalProperties: false in data/schemas/other/outputs/configuration.json, so a bad output name fails on the additionalProperties keyword and is reported by E6001. The pattern keyword appears nowhere in that schema, so the "pattern": "E6004" entry in the Outputs configuration rule_set can never be reached and --ignore-checks E6004 has no effect. The discrimination E6004 implies exists nowhere else in the codebase. No section separates a bad logical ID from a nested unknown property -- each reports its own section rule: Resources bad logical id -> E3001 nested unknown attr -> E3001 Parameters bad logical id -> E2001 nested unknown prop -> E2001 Mappings bad logical id -> E7001 Outputs bad logical id -> E6001 Outputs is also the only section whose rule_set maps pattern to a name rule at all. Resources and Mappings have no pattern entry, and Parameters maps pattern to E2003, which is AllowedPattern validation and does fire. Validation is already correct, so this removes the dead rule and leaves every reported finding unchanged. Users suppressing E6004 can drop the suppression; it was never doing anything. Fixes aws-cloudformation#4877
kddejong
marked this pull request as ready for review
November 2, 2026 23:55
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4983 +/- ##
==========================================
- Coverage 94.74% 94.73% -0.01%
==========================================
Files 442 441 -1
Lines 16145 16138 -7
Branches 3138 3138
==========================================
- Hits 15296 15289 -7
Misses 469 469
Partials 380 380
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4877. Supersedes #4912, which fixed this by making E6004 fire; this removes it instead.
Problem
E6004(src/cfnlint/rules/outputs/Pattern.py, "Outputs have appropriate names") has nomatchand novalidatemethod — it is a docstring and five class attributes. It never fires.rules/outputs/Configuration.pymaps"pattern": "E6004"in itsrule_set, but that mapping keys offerr.validator, and the Outputs name rule is expressed aspatternPropertiesplusadditionalProperties: falseindata/schemas/other/outputs/configuration.json. Thepatternkeyword appears nowhere in that schema, soerr.validator == "pattern"can never occur there. A bad output name fails onadditionalPropertiesand is reported by E6001, and--ignore-checks E6004does nothing.Measured on
upstream/main:Why remove rather than wire it up
The discrimination E6004 implies — separating a bad logical ID from a nested unknown property — exists nowhere else in the codebase. Measured on
upstream/main:E3001E3001E2001E2001E7001E6001E6001No section separates the two; each reports its own section rule. Outputs is also the only section whose
rule_setmapspatternto a name rule at all — Resources and Mappings have nopatternentry, and Parameters mapspatterntoE2003, which isAllowedPatternvalidation and genuinely fires.So E6004 assumes a design this codebase does not have. Validation is already correct; only the dead rule is wrong.
Its docstring is also wrong — "Check if Outputs strings are less than the max length" on a rule named "Outputs have appropriate names" — which is further evidence nobody has touched it.
The change
src/cfnlint/rules/outputs/Pattern.py."pattern": "E6004"fromself.rule_setinsrc/cfnlint/rules/outputs/Configuration.py. Every other entry is untouched — in particular"propertyNames": "E6011"and"maxLength": "E6011", which carry the working 255-character length check.docs/rules.md: drop the E6004 row and decrement the headline count 334 → 333 (the generator computes it aslen(sorted_rules) + 3,maintenance.py:63; runningcfn-lint --update-documentationon this branch produces 333).No test, snapshot,
.cfnlintrcor fixture referenced E6004 — it had no test coverage at all.grep -rn E6004 src/ test/ docs/ scripts/returns zero hits after the change.Verification
No user-visible validation changes. Before/after on
upstream/mainvs this branch, identical in every case:My_OutputE6001...does not match any of the regexes: '^[a-zA-Z0-9]+$'at5:3:5:12E6001Additional properties are not allowed ('Bogus' was unexpected)at7:5:7:10ExportE6001, same message, at12:7:12:12E6011... is longer than 255at5:3:5:259Outputsas a listE6003[{'Value': 'foo'}] is not of type 'object'ValueE6002'Value' is a required propertyE6010'Outputs' has more than 200 properties--list-rulesno longer lists E6004 and the diff against main is exactly that one rule's two lines (it prints id+shortdesc then description, 662 → 660).-i E6004now behaves like any unrecognised rule ID: the CLI accepts it silently with no warning or error — confirmed identical to-i E9999999on main.Good-fixture sweep, run by hand because
test/integration/test_good_templates.pyis a curated ~20-template list and does not sweep the directory:Noise floor established first by running main against itself three times: byte-identical, 0 differing lines (
E3019/E3043, which render Python sets into their messages, do not appear in these fixtures). Against that floor, main vs this branch is byte-identical for both yaml and json, and an order-insensitive check (rule-ID plusfile:linemultiset) also matches.Full suite, compared as failure sets rather than counts:
Failure sets are identical. All 6 are pre-existing and caused by missing optional dependencies in the local environment (
pydot,junit-xml,sarif), not by this change. The pass count is unchanged at 3346, confirming no test was removed.pre-commit run --all-filespasses (ruff, ruff-format, isort, bandit, mypy, AST/JSON/YAML checks).Backwards compatibility
A user suppressing E6004 via
ignore_checkswas suppressing nothing, so the suppression can simply be dropped — it will not start reporting anything new. Users who wanted to suppress the output-name check needE6001, which is where the finding has always come from.