Validate that resource keys do not contain variable references

NEXT_CHANGELOG.md

@@ -8,6 +8,7 @@
 * JSON output for single objects now uses standard `"key": "value"` spacing (matching list output and `encoding/json` defaults).
 
 ### Bundles
+* Validate that resource keys do not contain variable references ([#5169](https://github.com/databricks/cli/pull/5169))
 * engine/direct: Drop the deployment state entry on a recreate before the follow-up `Create`, so a `Create` failure no longer leaves a broken state with `invalid state: empty id` on the next `bundle plan` ([#5173](https://github.com/databricks/cli/pull/5173)).
 
 ### Dependency updates

acceptance/bundle/variables/variable_in_resource_key/databricks.yml

@@ -0,0 +1,21 @@
+bundle:
+  name: variable-in-resource-key
+
+variables:
+  env:
+    description: The target environment
+    default: dev
+
+resources:
+  jobs:
+    ${var.env}_job:
+      name: my-job
+
+targets:
+  dev:
+    default: true
+    resources:
+      jobs:
+        ${var.env}_job_2:
+          name: my-job
+          ${var.env}: my-job-description

acceptance/bundle/variables/variable_in_resource_key/output.txt

@@ -0,0 +1,14 @@
+Warning: unknown field: ${var.env}
+  at targets.dev.resources.jobs.${var.env}_job_2
+  in databricks.yml:21:11
+
+Error: resource key "${var.env}_job" must not contain variable references
+  at resources.jobs.${var.env}_job
+  in databricks.yml:12:7
+
+Error: resource key "${var.env}_job_2" must not contain variable references
+  at targets.dev.resources.jobs.${var.env}_job_2
+  in databricks.yml:20:11
+
+
+Exit code: 1

acceptance/bundle/variables/variable_in_resource_key/script

@@ -0,0 +1 @@
+$CLI bundle plan

bundle/config/mutator/mutator.go

@@ -28,8 +28,9 @@ func DefaultMutators(ctx context.Context, b *bundle.Bundle) {
 		InitializeVariables(),
 		DefineDefaultTarget(),
 
-		// Note: This mutator must run before the target overrides are merged.
-		// See the mutator for more details.
+		// Note: These mutators must run before the target overrides are merged.
+		// See the mutators for more details.
+		validate.NoVariableReferenceInResourceKey(),
 		validate.UniqueResourceKeys(),
 	)
 }

bundle/config/validate/no_variable_reference_in_resource_key.go

@@ -0,0 +1,56 @@
+package validate
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/databricks/cli/bundle"
+	"github.com/databricks/cli/libs/diag"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/dynvar"
+)
+
+type noVariableReferenceInResourceKey struct{}
+
+// NoVariableReferenceInResourceKey validates that no resource key contains a variable reference.
+// Resource keys are used as identifiers throughout the deployment pipeline and must be static strings.
+func NoVariableReferenceInResourceKey() bundle.Mutator {
+	return &noVariableReferenceInResourceKey{}
+}
+
+func (m *noVariableReferenceInResourceKey) Name() string {
+	return "validate:no_variable_reference_in_resource_key"
+}
+
+func (m *noVariableReferenceInResourceKey) Apply(_ context.Context, b *bundle.Bundle) diag.Diagnostics {
+	var diags diag.Diagnostics
+
+	patterns := []dyn.Pattern{
+		dyn.NewPattern(dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey()),
+		dyn.NewPattern(dyn.Key("targets"), dyn.AnyKey(), dyn.Key("resources"), dyn.AnyKey(), dyn.AnyKey()),
+	}
+
+	for _, pattern := range patterns {
+		_, err := dyn.MapByPattern(
+			b.Config.Value(),
+			pattern,
+			func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
+				key := p[len(p)-1].Key()
+				if dynvar.ContainsVariableReference(key) {
+					diags = append(diags, diag.Diagnostic{
+						Severity:  diag.Error,
+						Summary:   fmt.Sprintf("resource key %q must not contain variable references", key),
+						Locations: v.Locations(),
+						Paths:     []dyn.Path{p},
+					})
+				}
+				return v, nil
+			},
+		)
+		if err != nil {
+			diags = append(diags, diag.FromErr(err)...)
+		}
+	}
+
+	return diags
+}