fix(cli): validate transform expressions without environment

Author: pront

lib/vector-vrl/enrichment/src/tables.rs

@@ -139,6 +139,31 @@ impl TableRegistry {
         }
     }
 
+    /// Load compile-only table placeholders into the registry.
+    ///
+    /// These placeholders are useful when compiling VRL in contexts that must
+    /// not load external enrichment table data. Compilation only needs table
+    /// names and index registration; runtime lookups still fail against these
+    /// placeholders.
+    pub fn load_compile_time_table_ids<I, S>(&self, table_ids: I)
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<String>,
+    {
+        let tables = table_ids
+            .into_iter()
+            .map(|table_id| {
+                let table_id = table_id.into();
+                (
+                    table_id.clone(),
+                    Box::new(CompileTimeTable::new(table_id)) as Box<dyn Table + Send + Sync>,
+                )
+            })
+            .collect();
+
+        self.load(tables);
+    }
+
     /// Adds an index to the given Enrichment Table.
     ///
     /// If we are in the reading stage, this function will error.
@@ -204,6 +229,68 @@ impl std::fmt::Debug for TableRegistry {
     }
 }
 
+#[derive(Clone, Debug)]
+struct CompileTimeTable {
+    name: String,
+    indexes: Vec<(Case, Vec<String>)>,
+}
+
+impl CompileTimeTable {
+    fn new(name: String) -> Self {
+        Self {
+            name,
+            indexes: Vec::new(),
+        }
+    }
+
+    fn lookup_error(&self) -> Error {
+        Error::TableNotLoaded {
+            table: self.name.clone(),
+        }
+    }
+}
+
+impl Table for CompileTimeTable {
+    fn find_table_row<'a>(
+        &self,
+        _case: Case,
+        _condition: &'a [Condition<'a>],
+        _select: Option<&[String]>,
+        _wildcard: Option<&Value>,
+        _index: Option<IndexHandle>,
+    ) -> Result<ObjectMap, Error> {
+        Err(self.lookup_error())
+    }
+
+    fn find_table_rows<'a>(
+        &self,
+        _case: Case,
+        _condition: &'a [Condition<'a>],
+        _select: Option<&[String]>,
+        _wildcard: Option<&Value>,
+        _index: Option<IndexHandle>,
+    ) -> Result<Vec<ObjectMap>, Error> {
+        Err(self.lookup_error())
+    }
+
+    fn add_index(&mut self, case: Case, fields: &[&str]) -> Result<IndexHandle, Error> {
+        let handle = IndexHandle(self.indexes.len());
+        self.indexes.push((
+            case,
+            fields.iter().map(|field| (*field).to_owned()).collect(),
+        ));
+        Ok(handle)
+    }
+
+    fn index_fields(&self) -> Vec<(Case, Vec<String>)> {
+        self.indexes.clone()
+    }
+
+    fn needs_reload(&self) -> bool {
+        false
+    }
+}
+
 /// Provides read only access to the enrichment tables via the
 /// `vrl::EnrichmentTableSearch` trait. Cloning this object is designed to be
 /// cheap. The underlying data will be shared by all clones.

src/conditions/mod.rs

@@ -210,6 +210,14 @@ impl AnyCondition {
             AnyCondition::Map(m) => m.build(enrichment_tables, metrics_storage),
         }
     }
+
+    pub fn validate(
+        &self,
+        enrichment_tables: &vector_lib::enrichment::TableRegistry,
+        metrics_storage: &MetricsStorage,
+    ) -> crate::Result<()> {
+        self.build(enrichment_tables, metrics_storage).map(|_| ())
+    }
 }
 
 impl From<ConditionConfig> for AnyCondition {

src/config/sink.rs

@@ -247,6 +247,15 @@ pub trait SinkConfig: DynClone + NamedComponent + core::fmt::Debug + Send + Sync
     /// returned.
     async fn build(&self, cx: SinkContext) -> crate::Result<(VectorSink, Healthcheck)>;
 
+    /// Validates sink configuration without requiring access to the running environment.
+    ///
+    /// This is used by `vector validate --no-environment` for component-local checks that do not
+    /// need to build the sink runtime, read files, resolve credentials, contact external services,
+    /// or otherwise depend on host state.
+    fn validate_no_environment(&self) -> crate::Result<()> {
+        Ok(())
+    }
+
     /// Gets the input configuration for this sink.
     fn input(&self) -> Input;
 

src/config/source.rs

@@ -94,6 +94,15 @@ pub trait SourceConfig: DynClone + NamedComponent + core::fmt::Debug + Send + Sy
     /// returned.
     async fn build(&self, cx: SourceContext) -> crate::Result<Source>;
 
+    /// Validates source configuration without requiring access to the running environment.
+    ///
+    /// This is used by `vector validate --no-environment` for component-local checks that do not
+    /// need to build the source runtime, bind sockets, read files, contact external services, or
+    /// otherwise depend on host state.
+    fn validate_no_environment(&self) -> crate::Result<()> {
+        Ok(())
+    }
+
     /// Gets the list of outputs exposed by this source.
     fn outputs(&self, global_log_namespace: LogNamespace) -> Vec<SourceOutput>;
 

src/config/transform.rs

@@ -228,12 +228,14 @@ pub trait TransformConfig: DynClone + NamedComponent + core::fmt::Debug + Send +
     /// returned.
     async fn build(&self, globals: &TransformContext) -> crate::Result<Transform>;
 
-    /// Whether `build` requires environment-dependent setup.
+    /// Validates transform configuration without requiring access to the running environment.
     ///
-    /// This is used by `vector validate --no-environment` to skip transforms that intentionally do
-    /// network or runtime initialization as part of `build`.
-    fn build_requires_environment(&self) -> bool {
-        false
+    /// This is used by `vector validate --no-environment` for component-local checks that do not
+    /// need to build the transform runtime, spawn tasks, contact external services, execute user
+    /// code, or otherwise depend on host state. Transforms that compile VRL programs or conditions
+    /// in `build` should compile them here as well.
+    fn validate_no_environment(&self, _context: &TransformContext) -> crate::Result<()> {
+        Ok(())
     }
 
     /// Gets the input configuration for this transform.

src/transforms/aws_ec2_metadata.rs

@@ -254,13 +254,6 @@ impl TransformConfig for Ec2Metadata {
         Ok(Transform::event_task(Ec2MetadataTransform { state }))
     }
 
-    fn build_requires_environment(&self) -> bool {
-        // `build` performs network initialization and starts the refresh task, so
-        // `validate --no-environment` must skip this transform until #25162 is resolved:
-        // https://github.com/vectordotdev/vector/issues/25162
-        true
-    }
-
     fn input(&self) -> Input {
         Input::new(DataType::Metric | DataType::Log)
     }

src/transforms/delay.rs

@@ -91,6 +91,13 @@ impl TransformConfig for DelayConfig {
         Ok(Transform::event_task(Delay::new(self, context)?))
     }
 
+    fn validate_no_environment(&self, context: &TransformContext) -> crate::Result<()> {
+        if let Some(condition) = &self.condition {
+            condition.validate(&context.enrichment_tables, &context.metrics_storage)?;
+        }
+        Ok(())
+    }
+
     fn input(&self) -> Input {
         Input::all()
     }

src/transforms/exclusive_route/config.rs

@@ -97,6 +97,15 @@ impl TransformConfig for ExclusiveRouteConfig {
         Ok(Transform::synchronous(route))
     }
 
+    fn validate_no_environment(&self, context: &TransformContext) -> crate::Result<()> {
+        for route in &self.routes {
+            route
+                .condition
+                .validate(&context.enrichment_tables, &context.metrics_storage)?;
+        }
+        Ok(())
+    }
+
     fn input(&self) -> Input {
         Input::all()
     }

src/transforms/filter.rs

@@ -50,6 +50,11 @@ impl TransformConfig for FilterConfig {
         )?)))
     }
 
+    fn validate_no_environment(&self, context: &TransformContext) -> crate::Result<()> {
+        self.condition
+            .validate(&context.enrichment_tables, &context.metrics_storage)
+    }
+
     fn input(&self) -> Input {
         Input::all()
     }

src/transforms/reduce/config.rs

@@ -123,6 +123,13 @@ impl TransformConfig for ReduceConfig {
             .map(Transform::event_task)
     }
 
+    fn validate_no_environment(&self, context: &TransformContext) -> crate::Result<()> {
+        for condition in self.ends_when.iter().chain(self.starts_when.iter()) {
+            condition.validate(&context.enrichment_tables, &context.metrics_storage)?;
+        }
+        Ok(())
+    }
+
     fn input(&self) -> Input {
         Input::log()
     }