Check plan before migration (#4088)

denik · web-flow · commit a9ba5c080150 · 2025-12-08T14:09:32.000Z
## Why
Since we ask to do the deploy before the migration, running plan ensures
people don't forget to do that.
diff --git a/NEXT_CHANGELOG.md b/NEXT_CHANGELOG.md
@@ -7,6 +7,7 @@
 ### CLI
 
 ### Bundles
+* `bundle deployment migrate` will now run a plan before migration to check if deployment was done ([#4088](https://github.com/databricks/cli/pull/4088))
 
 ### Dependency updates
 
diff --git a/acceptance/bundle/help/bundle-deployment-migrate/output.txt b/acceptance/bundle/help/bundle-deployment-migrate/output.txt
@@ -14,7 +14,8 @@ Usage:
   databricks bundle deployment migrate [flags]
 
 Flags:
-  -h, --help   help for migrate
+  -h, --help          help for migrate
+      --noplancheck   Skip running bundle plan before migration.
 
 Global Flags:
       --debug            enable debug logging
diff --git a/acceptance/bundle/migrate/basic/output.txt b/acceptance/bundle/migrate/basic/output.txt
@@ -11,9 +11,11 @@ Updating deployment state...
 Deployment complete!
 
 >>> [CLI] bundle deployment migrate
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Plan: 0 to add, 0 to change, 0 to delete, 3 unchanged
 Migrated 3 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/dev/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/acceptance/bundle/migrate/dashboards/output.txt b/acceptance/bundle/migrate/dashboards/output.txt
@@ -6,9 +6,11 @@ Updating deployment state...
 Deployment complete!
 
 >>> [CLI] bundle deployment migrate
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Plan: 0 to add, 0 to change, 0 to delete, 1 unchanged
 Migrated 1 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/acceptance/bundle/migrate/default-python/output.txt b/acceptance/bundle/migrate/default-python/output.txt
@@ -22,11 +22,20 @@ Deployment complete!
 
 >>> print_state.py
 
->>> [CLI] bundle deployment migrate
+>>> musterr [CLI] bundle deployment migrate
+Building python_artifact...
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Building python_artifact...
+update jobs.sample_job
+
+Plan: 0 to add, 1 to change, 0 to delete, 1 unchanged
+Error: 'databricks bundle plan' shows actions planned, aborting migration. Please run 'databricks bundle deploy' first to ensure your bundle is up to date, If actions persist after deploy, skip plan check with --noplancheck option
+
+>>> [CLI] bundle deployment migrate --noplancheck
 Building python_artifact...
 Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/my_default_python/.databricks/bundle/dev/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/acceptance/bundle/migrate/default-python/script b/acceptance/bundle/migrate/default-python/script
@@ -3,7 +3,10 @@ cd my_default_python
 
 trace DATABRICKS_BUNDLE_ENGINE=terraform $CLI bundle deploy
 trace print_state.py > ../out.state_original.json
-trace $CLI bundle deployment migrate
+
+trace musterr $CLI bundle deployment migrate
+trace $CLI bundle deployment migrate --noplancheck
+
 trace print_state.py > ../out.state_after_migration.json
 trace jq '.. | .libraries? | select(.)' ../out.state_after_migration.json
 
diff --git a/acceptance/bundle/migrate/grants/output.txt b/acceptance/bundle/migrate/grants/output.txt
@@ -6,9 +6,11 @@ Updating deployment state...
 Deployment complete!
 
 >>> [CLI] bundle deployment migrate
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Plan: 0 to add, 0 to change, 0 to delete, 6 unchanged
 Migrated 6 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/acceptance/bundle/migrate/permissions/output.txt b/acceptance/bundle/migrate/permissions/output.txt
@@ -6,9 +6,11 @@ Updating deployment state...
 Deployment complete!
 
 >>> [CLI] bundle deployment migrate
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Plan: 0 to add, 0 to change, 0 to delete, 4 unchanged
 Migrated 4 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/default/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/acceptance/bundle/migrate/runas/output.txt b/acceptance/bundle/migrate/runas/output.txt
@@ -81,9 +81,23 @@ Consider using a adding a top-level permissions section such as the following:
 See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
   in databricks.yml:5:3
 
+Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:
+Recommendation: permissions section should explicitly include the current deployment identity '[USERNAME]' or one of its groups
+If it is not included, CAN_MANAGE permissions are only applied if the present identity is used to deploy.
+
+Consider using a adding a top-level permissions section such as the following:
+
+  permissions:
+    - user_name: [USERNAME]
+      level: CAN_MANAGE
+
+See https://docs.databricks.com/dev-tools/bundles/permissions.html to learn more about permission configuration.
+  in databricks.yml:5:3
+
+Plan: 0 to add, 0 to change, 0 to delete, 2 unchanged
 Migrated 2 resources to direct engine state file: [TEST_TMP_DIR]/.databricks/bundle/production/resources.json
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan", there should be no actions planned.
 
 The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
 
diff --git a/cmd/bundle/deployment/migrate.go b/cmd/bundle/deployment/migrate.go
@@ -1,9 +1,12 @@
 package deployment
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"os"
+	"os/exec"
+	"strings"
 
 	"github.com/databricks/cli/bundle/deploy/terraform"
 	"github.com/databricks/cli/bundle/direct"
@@ -19,6 +22,59 @@ import (
 
 const backupSuffix = ".backup"
 
+// runPlanCheck runs bundle plan and checks if there are any actions planned.
+// Returns error if plan fails or if there are actions planned.
+func runPlanCheck(cmd *cobra.Command, target string) error {
+	ctx := cmd.Context()
+
+	executable, err := os.Executable()
+	if err != nil {
+		return fmt.Errorf("failed to get executable path: %w", err)
+	}
+
+	args := []string{"bundle", "plan"}
+	targetArgs := ""
+	if target != "" {
+		targetArgs = " -t " + target
+		args = append(args, "-t", target)
+	}
+
+	planCmd := exec.CommandContext(ctx, executable, args...)
+	var stdout bytes.Buffer
+	planCmd.Stdout = &stdout
+	planCmd.Stderr = cmd.ErrOrStderr()
+
+	// Use the engine encoded in the state
+	planCmd.Env = append(os.Environ(), "DATABRICKS_BUNDLE_ENGINE=terraform")
+
+	err = planCmd.Run()
+
+	// Output the plan stdout as is
+	output := stdout.String()
+	fmt.Fprint(cmd.OutOrStdout(), output)
+
+	if err != nil {
+		var exitErr *exec.ExitError
+		msg := ""
+		if errors.As(err, &exitErr) {
+			msg = fmt.Sprintf("exit code %d", exitErr.ExitCode())
+		} else {
+			msg = err.Error()
+		}
+		return fmt.Errorf("bundle plan failed with %s, aborting migration. To proceed with migration anyway, re-run the command with --noplancheck option", msg)
+	}
+
+	if !strings.Contains(output, "Plan:") {
+		return fmt.Errorf("cannot parse 'databricks bundle plan%s' output, aborting migration. Skip plan check with --noplancheck option", targetArgs)
+	}
+
+	if !strings.Contains(output, "Plan: 0 to add, 0 to change, 0 to delete") {
+		return fmt.Errorf("'databricks bundle plan%s' shows actions planned, aborting migration. Please run 'databricks bundle deploy%s' first to ensure your bundle is up to date, If actions persist after deploy, skip plan check with --noplancheck option", targetArgs, targetArgs)
+	}
+
+	return nil
+}
+
 func newMigrateCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "migrate",
@@ -36,7 +92,20 @@ WARNING: Both direct deployment engine and this command are experimental and not
 		Args: root.NoArgs,
 	}
 
+	var noPlanCheck bool
+	cmd.Flags().BoolVar(&noPlanCheck, "noplancheck", false, "Skip running bundle plan before migration.")
+
 	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		// Get the target if it was explicitly passed
+		target := ""
+		if flag := cmd.Flag("target"); flag != nil && flag.Changed {
+			target = flag.Value.String()
+		}
+		targetArgs := ""
+		if target != "" {
+			targetArgs += " -t " + target
+		}
+
 		opts := utils.ProcessOptions{
 			SkipEngineEnvVar: true,
 			AlwaysPull:       true,
@@ -82,6 +151,14 @@ To start using direct engine, deploy with DATABRICKS_BUNDLE_ENGINE=direct env va
 			return fmt.Errorf("state file %s already exists", localPath)
 		}
 
+		// Run plan check unless --noplancheck is set
+		if !noPlanCheck {
+			fmt.Fprintf(cmd.OutOrStdout(), "Note: Migration should be done after a full deploy. Running plan now to verify that deployment was done:\n")
+			if err = runPlanCheck(cmd, target); err != nil {
+				return err
+			}
+		}
+
 		etags := map[string]string{}
 
 		state := make(map[string]dstate.ResourceEntry)
@@ -155,12 +232,12 @@ To start using direct engine, deploy with DATABRICKS_BUNDLE_ENGINE=direct env va
 
 		cmdio.LogString(ctx, fmt.Sprintf(`Migrated %d resources to direct engine state file: %s
 
-Validate the migration by running "bundle plan", there should be no actions planned.
+Validate the migration by running "databricks bundle plan%s", there should be no actions planned.
 
-The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy".
+The state file is not synchronized to the workspace yet. To do that and finalize the migration, run "bundle deploy%s".
 
 To undo the migration, remove %s and rename %s to %s
-`, len(deploymentBundle.StateDB.Data.State), localPath, localPath, localTerraformBackupPath, localTerraformPath))
+`, len(deploymentBundle.StateDB.Data.State), localPath, targetArgs, targetArgs, localPath, localTerraformBackupPath, localTerraformPath))
 		return nil
 	}
 
diff --git a/cmd/bundle/plan.go b/cmd/bundle/plan.go
@@ -107,6 +107,7 @@ It is useful for previewing changes before running 'bundle deploy'.`,
 				}
 				fmt.Fprintln(out)
 			}
+			// Note, this string should not be changed, "bundle deployment migrate" depends on this format:
 			fmt.Fprintf(out, "Plan: %d to add, %d to change, %d to delete, %d unchanged\n", createCount, updateCount, deleteCount, unchangedCount)
 		case flags.OutputJSON:
 			buf, err := json.MarshalIndent(plan, "", "  ")
