Remove duplicate enum values for jsonschema.json

NEXT_CHANGELOG.md

@@ -11,6 +11,7 @@
 ### Bundles
 
 * Fix permissions added to a job or pipeline by a Python (PyDABs) mutator failing to deploy with "must have exactly one owner"; the deploying identity is now set as owner, matching resources whose permissions are declared in YAML ([#5821](https://github.com/databricks/cli/pull/5821)).
+* Remove duplicate enum values for jsonschema.json ([#5839](https://github.com/databricks/cli/pull/5839)).
 
 ### Dependency updates
 

bundle/internal/schema/annotations.yml

@@ -847,11 +847,6 @@ resources:
                   "$type":
                     "description": |-
                       SSE algorithm to use for encrypting S3 objects
-                    "enum":
-                      - |-
-                        AWS_SSE_KMS
-                      - |-
-                        AWS_SSE_S3
         "grants":
           "description": |-
             The Unity Catalog privileges to grant to principals on this securable.

bundle/schema/embed_test.go

@@ -2,6 +2,7 @@ package schema_test
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/databricks/cli/bundle/schema"
@@ -64,3 +65,44 @@ func TestJsonSchema(t *testing.T) {
 	assert.Contains(t, providers.OneOf[0].Enum, "gitHubEnterprise")
 	assert.Contains(t, providers.OneOf[0].Enum, "bitbucketServer")
 }
+
+// JSON Schema requires enum values to be unique; strict validators (e.g. OPA)
+// reject the whole schema otherwise. Duplicates slip in when an enum is
+// hand-authored in annotations.yml for a field cli.json also defines, since the
+// annotation merge concatenates the two sequences. Guard the whole schema.
+func TestJsonSchemaEnumsAreUnique(t *testing.T) {
+	var s any
+	err := json.Unmarshal(schema.Bytes, &s)
+	require.NoError(t, err)
+
+	assert.Empty(t, duplicateEnumPaths(s, ""))
+}
+
+func duplicateEnumPaths(v any, path string) []string {
+	var duplicates []string
+	switch v := v.(type) {
+	case map[string]any:
+		if enum, ok := v["enum"].([]any); ok {
+			seen := map[string]struct{}{}
+			for _, item := range enum {
+				key := fmt.Sprintf("%v", item)
+				if _, ok := seen[key]; ok {
+					duplicates = append(duplicates, path)
+					break
+				}
+				seen[key] = struct{}{}
+			}
+		}
+		for key, value := range v {
+			if path != "" {
+				key = path + "/" + key
+			}
+			duplicates = append(duplicates, duplicateEnumPaths(value, key)...)
+		}
+	case []any:
+		for i, value := range v {
+			duplicates = append(duplicates, duplicateEnumPaths(value, fmt.Sprintf("%s[%d]", path, i))...)
+		}
+	}
+	return duplicates
+}