bundle validate --strict rejects CREATE_SECRET/CREATE_FEATURE, privileges the Grants API already accepts

Start with bundle/internal/validation/generated/enum_fields.go and the generator in bundle/internal/validation/enum.go and main.go, then inspect catalog.Privilege in databricks-sdk-go. Confirm the missing secret and feature privilege values are added upstream, bump the CLI dependency, regenerate the enum fields, and verify strict bundle validation accepts the privileges.

Summary

databricks bundle validate --strict fails on a resources.schemas.*.grants[].privileges (also resources.catalogs.*, resources.secrets.*, etc.) entry containing CREATE_SECRET or CREATE_FEATURE, even though both are real Unity Catalog privileges that the Grants REST API already accepts and applies.

Repro

resources:
  schemas:
    my_schema:
      catalog_name: my_catalog
      name: my_schema
      grants:
        - principal: someone@example.com
          privileges:
            - USE_SCHEMA
            - CREATE_SECRET

$ databricks bundle validate --strict --target dev
Warning: invalid value "CREATE_SECRET" for enum field. Valid values are [ACCESS ALL_PRIVILEGES APPLY_TAG BROWSE CREATE CREATE_CATALOG CREATE_CLEAN_ROOM CREATE_CONNECTION CREATE_EXTERNAL_LOCATION CREATE_EXTERNAL_TABLE CREATE_EXTERNAL_VOLUME CREATE_FOREIGN_CATALOG CREATE_FOREIGN_SECURABLE CREATE_FUNCTION CREATE_MANAGED_STORAGE CREATE_MATERIALIZED_VIEW CREATE_MODEL CREATE_PROVIDER CREATE_RECIPIENT CREATE_SCHEMA CREATE_SERVICE_CREDENTIAL CREATE_SHARE CREATE_STORAGE_CREDENTIAL CREATE_TABLE CREATE_VIEW CREATE_VOLUME EXECUTE EXECUTE_CLEAN_ROOM_TASK EXTERNAL_USE_LOCATION EXTERNAL_USE_SCHEMA MANAGE MANAGE_ALLOWLIST MODIFY MODIFY_CLEAN_ROOM READ_FILES READ_METADATA READ_PRIVATE_FILES READ_VOLUME REFRESH SELECT SET_SHARE_PERMISSION USAGE USE_CATALOG USE_CONNECTION USE_MARKETPLACE_ASSETS USE_PROVIDER USE_RECIPIENT USE_SCHEMA USE_SHARE WRITE_FILES WRITE_PRIVATE_FILES WRITE_VOLUME]
  at resources.schemas.my_schema.grants[0].privileges[1]

Error: 1 warning found. Warnings are not allowed in strict mode

Reproduced on CLI v1.17.0 (latest release as of 2026-09-21).

Why this is a bug, not a config mistake

CREATE_SECRET (and READ_SECRET/WRITE_SECRET/REFERENCE_SECRET) are documented Unity Catalog privileges for the Unity Catalog secrets feature, grantable at the catalog or schema level. I confirmed directly against the real Grants API that it's accepted and applied:

$ databricks grants update schema my_catalog.my_schema --json '{
  "changes": [{"principal": "someone@example.com", "add": ["CREATE_SECRET", "CREATE_FEATURE"]}]
}'
{
  "privilege_assignments": [
    {"principal": "someone@example.com", "privileges": ["CREATE_FEATURE", "CREATE_SECRET"]}
  ]
}

So the CLI's enum-validation warning (and its --strict promotion to a hard failure) has no way to be satisfied - there is no CLI version today whose local Privilege enum recognizes these values, but the platform they validate against already does.

Root cause (as far as I can trace it)

• bundle/internal/validation/generated/enum_fields.go is autogenerated (bundle/internal/validation/enum.go + main.go, run via go run ./bundle/internal/validation) by reflecting over every field whose type exposes a Values() []T method - for grants, that's catalog.Privilege in databricks-sdk-go (service/catalog/model.go).
• catalog.Privilege's const list and Values()/Set() methods don't include CREATE_SECRET/CREATE_FEATURE (or the other secret-related privileges) as of databricks-sdk-go v0.178.0 (bundled in cli v1.17.0). That release only added ExternalUseLocation.
• Since enum_fields.go is generated, not hand-maintained, this can't be fixed with a cli-only PR - it needs the missing values added to catalog.Privilege in databricks-sdk-go first, then a dependency bump + regeneration here.

Impact

Any bundle that grants CREATE_SECRET/CREATE_FEATURE (or presumably the sibling secret privileges) fails bundle validate --strict, and by extension any CI pipeline that runs it in strict mode, with no way to satisfy the check short of dropping --strict entirely for that bundle/target - which then also stops catching genuine typos/unsupported values in the same config.

Ask

Add CREATE_SECRET, READ_SECRET, WRITE_SECRET, REFERENCE_SECRET, and the feature-table equivalents (CREATE_FEATURE, and presumably READ_FEATURE) to catalog.Privilege in databricks-sdk-go, so a cli dependency bump picks them up.