Add fn::validate for opt-in schema validation

[nyobe]

Adds a new built-in function fn::validate that takes a value and validate it according to a json schema. If the value conforms to the schema, it's passed through unchanged. If there is a validation error, check will fail with a diagnostic indicating the problem.

Referencing a schema using an implicit import gives the user a light weight way to apply their own validations to their config. For example, a schema might require that an Owner tag be present in pulumiConfig aws:defaultTags:

# schema/awsProvider
values:
  type: object
  properties:
    aws:defaultTags:
      type: object
      properties:
        tags:
          additionalProperties:
            type: string
          # Require Owner tag to be set
          properties:
            Owner:
              type: string
          required: ["Owner"]
      required: ["tags"]
    required: ["aws:defaultTags"]

Then, using fn::validate, you can ensure that your config conforms to the schema:

# default/example
values:
  pulumiConfig:
    fn::conform:
      schema: ${environments.schema.awsProvider}
      value:
        aws:defaultTags:
          tags:
            Owner: Claire

We might consider allowing fn::validate at the top level, so a schema can define the expected shape of the overall environment. I'll explore this in a followup.

[borisschlosser]

Can you guide me how to use the feature exactly? Users can define an own schema environments right? Are there any edge cases which need to be considered (like mixing schema and non-schema content in one environment)?

[tehsis]

Can you guide me how to use the feature exactly? Users can define an own schema environments right? Are there any edge cases which need to be considered (like mixing schema and non-schema content in one environment)?

On how to use it, I've wrote some docs around it http://www-testing-pulumi-docs-origin-pr-17337-78e223f9.s3-website.us-west-2.amazonaws.com/docs/esc/environments/syntax/builtin-functions/fn-conform/

[nyobe]

there shouldn't be edge cases, schemas are valid json. they might pollute the environment with information you don't care about, so I recommend using inline imports to references.