Use JSON Schema defaults in synthetic test get_diff - #1670
Open
Steve Lee (SteveL-MSFT) wants to merge 4 commits into
Open
Use JSON Schema defaults in synthetic test get_diff#1670Steve Lee (SteveL-MSFT) wants to merge 4 commits into
Steve Lee (SteveL-MSFT) wants to merge 4 commits into
Conversation
Update get_diff() to accept an optional JSON Schema parameter via the new get_diff_with_schema() function. When a property exists in the expected (desired) state but is missing from the actual state, the function now checks the schema for a 'default' value for that property. If the expected value matches the schema default, it is not reported as differing. This improves synthetic test accuracy for resources that don't return properties whose values match the schema-defined defaults. - Add get_diff_with_schema() with optional schema parameter - Keep get_diff() as a convenience wrapper (no schema) - Update invoke_synthetic_test to retrieve and pass the resource schema - Update DscResource synthetic test path for adapted resources - Add get_schema_default() helper to extract defaults from JSON Schema - Add Test/SchemaDefault test resource and dsctest subcommand - Add Rust unit tests for schema default comparison logic - Add Pester integration tests for end-to-end validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds schema-aware diffing for synthetic dsc resource test (when a resource lacks a native test operation), so missing properties in get output don’t produce false diffs when the desired value matches the JSON Schema default.
Changes:
- Introduces
get_diff_with_schema(expected, actual, schema)and a helper to read per-property schema defaults whenactualomits a key. - Updates synthetic test paths (command + adapted resources) to retrieve the resource schema and pass it into diffing.
- Adds new Rust + Pester tests, including a
Test/SchemaDefaultresource that omits defaulted fields fromgetoutput.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/dsctest/src/schema_default.rs | Adds a dsctest input struct for the new schema-default test resource. |
| tools/dsctest/src/main.rs | Adds schema-default subcommand and exposes its JSON schema via dsctest schema. |
| tools/dsctest/src/args.rs | Wires new clap subcommand and schema enum variant. |
| tools/dsctest/dsctest.dsc.manifests.json | Adds Test/SchemaDefault manifest with embedded schema defaults. |
| lib/dsc-lib/src/dscresources/dscresource.rs | Adds schema-aware diffing and unit tests for default handling. |
| lib/dsc-lib/src/dscresources/command_resource.rs | Passes resource schema into synthetic test diffing. |
| dsc/tests/dsc_schema_default.tests.ps1 | Adds end-to-end tests verifying schema defaults are honored in synthetic tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ation - Change get_diff_with_schema from pub to pub(crate) since it is only used within the dsc-lib crate - Read schema from RESOURCE_SCHEMAS cache directly (returns Value) instead of round-tripping through get_schema -> String -> from_str. Only calls get_schema to populate the cache on a miss. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Steve Lee (SteveL-MSFT)
requested review from
Mikey Lombardi (He/Him) (michaeltlombardi) and
Tess Gauthier (tgauth)
August 11, 2026 22:08
Add tests verifying that unspecifiedRulesAction set to the schema default
value 'ignore' is no longer reported as drift in synthetic test. Non-default
values ('disable', 'remove') are still correctly flagged.
Tests require elevation to create/remove firewall rules and are skipped
when not running as Administrator.
Fixes #1666
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
😁 Code Coverage ReportChanged Code Coverage90% (90%+ coverage)
🔵 Full Codebase Coverage82% (good)
|
…available Move -Skip to Describe block and check for Get-NetFirewallRule cmdlet availability in BeforeDiscovery. This prevents BeforeAll/AfterAll from running on CI runners without the NetSecurity module. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
When a DSC resource does not implement the
testoperation, the engine performs a synthetic test by callinggetand comparing expected vs actual state usingget_diff(). Previously, if a property existed in the expected (desired) state but was missing from the actual (get) output, it was always reported as differing -- even if the resource simply omits properties whose values match the schema-defined default.This causes false positives in synthetic test results. The most impactful case is
Microsoft.Windows/FirewallRuleListwhereunspecifiedRulesActionis a write-only instruction thatgetnever returns. Setting it to"ignore"(the documented default) permanently reports drift, making the property unusable for compliance reporting.Approach
get_diff_with_schema(expected, actual, schema)which accepts an optional JSON Schema. When a property is inexpectedbut absent fromactual, the function looks up the schema'sdefaultvalue for that property. If the expected value matches the default, it is not flagged as a diff.get_diff(expected, actual)remains as a convenience wrapper (passesNonefor the schema), so all non-synthetic-test call sites are unaffected.RESOURCE_SCHEMAScache (avoiding redundant serialization), with a fallback toget_schema()to populate the cache on a miss.Test coverage
Test/SchemaDefaultresource.unspecifiedRulesAction: ignoreno longer causes false drift, while non-default values (disable,remove) are still correctly reported.dsc_resource_test.tests.ps1tests still pass with no regressions.Fixes #1666