Skip to content

Add validate_schema parameter for strict field validation#1

Merged
richardwooding merged 1 commit into
mainfrom
feat/validate-schema
Feb 27, 2026
Merged

Add validate_schema parameter for strict field validation#1
richardwooding merged 1 commit into
mainfrom
feat/validate-schema

Conversation

@richardwooding
Copy link
Copy Markdown
Contributor

Summary

  • Add validate_schema: bool = False parameter to convert(), convert_parameterized(), and analyze()
  • When enabled, raises InvalidSchemaError for unrecognized table or field references in table.field expressions, catching typos and references to nonexistent fields
  • Skips validation for comprehension variables, bare identifiers, and nested JSON keys beyond the first field
  • Export InvalidSchemaError from pycel2sql public API
  • Document the feature in README.md and CLAUDE.md

Test plan

  • 19 new tests in tests/test_validate_schema.py covering config, field access, JSON, comprehensions, bare idents, and all three public API functions
  • All 607 unit tests pass
  • Ruff linting clean
  • mypy shows only pre-existing lark type errors

🤖 Generated with Claude Code

When validate_schema=True, convert()/convert_parameterized()/analyze()
raise InvalidSchemaError for unrecognized table or field references in
table.field expressions. This catches typos and references to nonexistent
fields that would otherwise silently produce incorrect SQL.

Validation skips comprehension variables, bare identifiers, and nested
JSON keys beyond the first field. Requires schemas to be provided.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@richardwooding richardwooding merged commit 7197f63 into main Feb 27, 2026
4 checks passed
richardwooding added a commit that referenced this pull request Apr 28, 2026
CodeQL flagged three instances of `actions/missing-workflow-permissions`
(alerts #1, #2, #3) on .github/workflows/ci.yml — one per job (lint,
unit-tests, integration-tests). Without an explicit permissions block,
the default GITHUB_TOKEN gets the repo-wide write permission set.

All three jobs only need to read code (checkout, install deps, run
ruff/mypy/pytest, upload artifacts to the run's own artifact storage).
A workflow-level `permissions: contents: read` covers all three jobs and
resolves all three alerts in one block.

The release workflow continues to specify its own write permissions
(contents: write for the GitHub Release, id-token: write for PyPI OIDC).
When release.yml calls ci.yml via workflow_call, ci.yml's permissions
block scopes what ci.yml's jobs can do — the caller's permissions
don't propagate down — so this change does not affect release publishing.

Co-authored-by: Richard Wooding <richardwooding@Richards-Virtual-Machine.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant