fix(cli): validate transform expressions without environment

pront · pront · commit fd1b169cdf92 · 2026-06-18T08:48:38.000-04:00
diff --git a/lib/vector-vrl/enrichment/src/tables.rs b/lib/vector-vrl/enrichment/src/tables.rs
@@ -139,6 +139,31 @@ impl TableRegistry {
         }
     }
 
+    /// Load compile-only table placeholders into the registry.
+    ///
+    /// These placeholders are useful when compiling VRL in contexts that must
+    /// not load external enrichment table data. Compilation only needs table
+    /// names and index registration; runtime lookups still fail against these
+    /// placeholders.
+    pub fn load_compile_time_table_ids<I, S>(&self, table_ids: I)
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<String>,
+    {
+        let tables = table_ids
+            .into_iter()
+            .map(|table_id| {
+                let table_id = table_id.into();
+                (
+                    table_id.clone(),
+                    Box::new(CompileTimeTable::new(table_id)) as Box<dyn Table + Send + Sync>,
+                )
+            })
+            .collect();
+
+        self.load(tables);
+    }
+
     /// Adds an index to the given Enrichment Table.
     ///
     /// If we are in the reading stage, this function will error.
@@ -204,6 +229,68 @@ impl std::fmt::Debug for TableRegistry {
     }
 }
 
+#[derive(Clone, Debug)]
+struct CompileTimeTable {
+    name: String,
+    indexes: Vec<(Case, Vec<String>)>,
+}
+
+impl CompileTimeTable {
+    fn new(name: String) -> Self {
+        Self {
+            name,
+            indexes: Vec::new(),
+        }
+    }
+
+    fn lookup_error(&self) -> Error {
+        Error::TableNotLoaded {
+            table: self.name.clone(),
+        }
+    }
+}
+
+impl Table for CompileTimeTable {
+    fn find_table_row<'a>(
+        &self,
+        _case: Case,
+        _condition: &'a [Condition<'a>],
+        _select: Option<&[String]>,
+        _wildcard: Option<&Value>,
+        _index: Option<IndexHandle>,
+    ) -> Result<ObjectMap, Error> {
+        Err(self.lookup_error())
+    }
+
+    fn find_table_rows<'a>(
+        &self,
+        _case: Case,
+        _condition: &'a [Condition<'a>],
+        _select: Option<&[String]>,
+        _wildcard: Option<&Value>,
+        _index: Option<IndexHandle>,
+    ) -> Result<Vec<ObjectMap>, Error> {
+        Err(self.lookup_error())
+    }
+
+    fn add_index(&mut self, case: Case, fields: &[&str]) -> Result<IndexHandle, Error> {
+        let handle = IndexHandle(self.indexes.len());
+        self.indexes.push((
+            case,
+            fields.iter().map(|field| (*field).to_owned()).collect(),
+        ));
+        Ok(handle)
+    }
+
+    fn index_fields(&self) -> Vec<(Case, Vec<String>)> {
+        self.indexes.clone()
+    }
+
+    fn needs_reload(&self) -> bool {
+        false
+    }
+}
+
 /// Provides read only access to the enrichment tables via the
 /// `vrl::EnrichmentTableSearch` trait. Cloning this object is designed to be
 /// cheap. The underlying data will be shared by all clones.
diff --git a/src/conditions/mod.rs b/src/conditions/mod.rs
@@ -210,6 +210,14 @@ impl AnyCondition {
             AnyCondition::Map(m) => m.build(enrichment_tables, metrics_storage),
         }
     }
+
+    pub fn validate(
+        &self,
+        enrichment_tables: &vector_lib::enrichment::TableRegistry,
+        metrics_storage: &MetricsStorage,
+    ) -> crate::Result<()> {
+        self.build(enrichment_tables, metrics_storage).map(|_| ())
+    }
 }
 
 impl From<ConditionConfig> for AnyCondition {
diff --git a/src/config/transform.rs b/src/config/transform.rs
@@ -162,6 +162,12 @@ pub struct TransformContext {
     /// (e.g. `aws_ec2_metadata`, `throttle`) clone this and pass it to [`crate::cpu_time::spawn_timed`] so
     /// their CPU is attributed to the component alongside the main transform task.
     pub cpu_ns: Option<Counter>,
+
+    /// Whether transform construction should skip checks that require the running environment.
+    ///
+    /// This is set by `vector validate --no-environment` when it builds transforms to validate
+    /// configuration that is normally checked in `build`.
+    pub skip_environment_checks: bool,
 }
 
 impl Default for TransformContext {
@@ -176,6 +182,7 @@ impl Default for TransformContext {
             schema: SchemaOptions::default(),
             extra_context: Default::default(),
             cpu_ns: None,
+            skip_environment_checks: false,
         }
     }
 }
@@ -228,14 +235,6 @@ pub trait TransformConfig: DynClone + NamedComponent + core::fmt::Debug + Send +
     /// returned.
     async fn build(&self, globals: &TransformContext) -> crate::Result<Transform>;
 
-    /// Whether `build` requires environment-dependent setup.
-    ///
-    /// This is used by `vector validate --no-environment` to skip transforms that intentionally do
-    /// network or runtime initialization as part of `build`.
-    fn build_requires_environment(&self) -> bool {
-        false
-    }
-
     /// Gets the input configuration for this transform.
     fn input(&self) -> Input;
 
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
@@ -540,6 +540,7 @@ impl<'a> Builder<'a> {
             } else {
                 None
             },
+            skip_environment_checks: false,
         };
 
         let node = TransformNode::from_parts(key.clone(), &context, transform, &input_definitions);
diff --git a/src/transforms/aws_ec2_metadata.rs b/src/transforms/aws_ec2_metadata.rs
@@ -229,12 +229,14 @@ impl TransformConfig for Ec2Metadata {
             tags,
         );
 
-        // If initial metadata is not required, log and proceed. Otherwise return error.
-        if let Err(error) = client.refresh_metadata().await {
-            if required {
-                return Err(error);
-            } else {
-                emit!(AwsEc2MetadataRefreshError { error });
+        if !context.skip_environment_checks {
+            // If initial metadata is not required, log and proceed. Otherwise return error.
+            if let Err(error) = client.refresh_metadata().await {
+                if required {
+                    return Err(error);
+                } else {
+                    emit!(AwsEc2MetadataRefreshError { error });
+                }
             }
         }
 
@@ -254,13 +256,6 @@ impl TransformConfig for Ec2Metadata {
         Ok(Transform::event_task(Ec2MetadataTransform { state }))
     }
 
-    fn build_requires_environment(&self) -> bool {
-        // `build` performs network initialization and starts the refresh task, so
-        // `validate --no-environment` must skip this transform until #25162 is resolved:
-        // https://github.com/vectordotdev/vector/issues/25162
-        true
-    }
-
     fn input(&self) -> Input {
         Input::new(DataType::Metric | DataType::Log)
     }
diff --git a/src/validate.rs b/src/validate.rs
@@ -5,6 +5,7 @@ use std::{collections::HashMap, fmt, fs::remove_dir_all, path::PathBuf};
 use clap::Parser;
 use colored::*;
 use exitcode::ExitCode;
+use vector_vrl_metrics::MetricsStorage;
 
 use crate::{
     config::{self, Config, ConfigDiff, TransformContext, loading::ConfigBuilderLoader},
@@ -119,7 +120,7 @@ pub async fn validate(opts: &Opts, color: bool) -> ExitCode {
     };
 
     if opts.no_environment {
-        validated &= validate_transforms_no_environment(opts, &config, &mut fmt).await;
+        validated &= validate_transforms_no_environment(&config, &mut fmt).await;
     } else if let Some(tmp_directory) = create_tmp_directory(&mut config, &mut fmt) {
         validated &= validate_environment(opts, &config, &mut fmt).await;
         remove_tmp_directory(tmp_directory);
@@ -181,43 +182,60 @@ pub fn validate_config(opts: &Opts, fmt: &mut Formatter) -> Option<Config> {
     Some(config)
 }
 
-async fn validate_transforms_no_environment(
-    opts: &Opts,
-    config: &Config,
-    fmt: &mut Formatter,
-) -> bool {
+async fn validate_transforms_no_environment(config: &Config, fmt: &mut Formatter) -> bool {
+    let enrichment_tables = vector_lib::enrichment::TableRegistry::default();
+    enrichment_tables.load_compile_time_table_ids(
+        config
+            .enrichment_tables()
+            .map(|(key, _table)| key.to_string()),
+    );
+
+    let metrics_storage = MetricsStorage::default();
     let mut definition_cache = HashMap::new();
-    let mut warnings = Vec::new();
     let mut errors = Vec::new();
 
     for (key, transform) in config.transforms() {
-        if transform.inner.build_requires_environment() {
-            warnings.push(format!(
-                "Transform \"{key}\" skipped build validation because it requires environment-dependent setup."
-            ));
-            continue;
-        }
-
-        let merged_schema_definition = topology::schema::input_definitions(
+        let input_definitions = topology::schema::input_definitions(
             &transform.inputs,
             config,
-            Default::default(),
+            enrichment_tables.clone(),
             &mut definition_cache,
         )
-        .map(|input_definitions| {
-            input_definitions
-                .into_iter()
-                .map(|(_, definition)| definition)
-                .reduce(Definition::merge)
-                .unwrap_or_else(Definition::any)
-        })
-        .unwrap_or_else(|_| Definition::any());
+        .unwrap_or_default();
+
+        let merged_schema_definition = input_definitions
+            .iter()
+            .map(|(_, definition)| definition.clone())
+            .reduce(Definition::merge)
+            .unwrap_or_else(Definition::any);
+
+        let schema_definitions = transform
+            .inner
+            .outputs(
+                &TransformContext {
+                    enrichment_tables: enrichment_tables.clone(),
+                    metrics_storage: metrics_storage.clone(),
+                    schema: config.schema,
+                    ..Default::default()
+                },
+                &input_definitions,
+            )
+            .into_iter()
+            .map(|output| {
+                let definitions = output.schema_definitions(config.schema.enabled);
+                (output.port, definitions)
+            })
+            .collect();
 
         let context = TransformContext {
             key: Some(key.clone()),
             globals: config.global.clone(),
+            enrichment_tables: enrichment_tables.clone(),
+            metrics_storage: metrics_storage.clone(),
+            schema_definitions,
             merged_schema_definition,
             schema: config.schema,
+            skip_environment_checks: true,
             ..Default::default()
         };
 
@@ -226,16 +244,9 @@ async fn validate_transforms_no_environment(
         }
     }
 
-    if !warnings.is_empty() {
-        fmt.title("Transform warnings");
-        fmt.sub_warning(&warnings);
-    }
-
-    if errors.is_empty() && warnings.is_empty() {
+    if errors.is_empty() {
         fmt.success("Transform configuration");
         true
-    } else if errors.is_empty() {
-        !opts.deny_warnings
     } else {
         fmt.title("Transform errors");
         fmt.sub_error(errors);
diff --git a/tests/integration/cli.rs b/tests/integration/cli.rs

Original file line number	Diff line number	Diff line change
`@@ -210,6 +210,14 @@ impl AnyCondition {`
`210`	`210`	`AnyCondition::Map(m) => m.build(enrichment_tables, metrics_storage),`
`211`	`211`	`}`
`212`	`212`	`}`
	`213`	`+`
	`214`	`+ pub fn validate(`
	`215`	`+ &self,`
	`216`	`+ enrichment_tables: &vector_lib::enrichment::TableRegistry,`
	`217`	`+ metrics_storage: &MetricsStorage,`
	`218`	`+ ) -> crate::Result<()> {`
	`219`	`+ self.build(enrichment_tables, metrics_storage).map(\|_\| ())`
	`220`	`+ }`
`213`	`221`	`}`
`214`	`222`
`215`	`223`	`impl From<ConditionConfig> for AnyCondition {`