fix(lint): accept configs the platform accepts, and reject web build egress

[pjcdawkins]

Fixes cases where upsun lint and editors using the schema reject configs that the platform accepts with the Upsun settings, reported on upsun/meta#220. Each was checked against the platform's validation, by validating one config per schema property set to null, and one per object with a .-prefixed key added.

• null: explicit null on optional fields is treated as unset. It is now allowed on the 90+ properties where the platform allows it (e.g. web.size, location passthru and root, operation timeout, egress port, route id/primary, HSTS options, task egress). Some differ by site: mounts: null is accepted on web and workers (no override) but not on the application, so null is added where the property is used rather than in the shared definition.
• .-prefixed keys (YAML anchors, notes) are ignored in every mapping with fixed keys, and in the applications, services and routes sections. They are now allowed there via patternProperties, except in stack, which the platform checks itself, and dropped when merging and decoding. They are still rejected where the platform reads them as names (e.g. a cron or mount named .note) and directly under tasks. A schema test checks that every closed object allows them.
• request_buffering.max_request_size accepts an integer (bytes).
• dynamic_compression is accepted on locations and rules.
• required: [applications] is dropped. Files in .upsun/ are merged and editors validate each file on its own, so routes.yaml beside config.yaml was rejected. No Go check replaces it: a project without applications (e.g. only redirect routes) is valid, and routes to missing applications are already reported.
• container_profile accepts any name, as profiles are defined per project. The four standard profiles are listed in examples, so editors still suggest them.

Also:

• web.egress.build is rejected, as on workers: build-phase egress is only read from the application. worker_egress is renamed container_egress and used for both. This replaces the warning added in fix(lint): accept per-container overrides and fix invalid schema defaults #234. The platform accepts this override and ignores it, so this is stricter than the platform.
• Each $ref with sibling keywords is moved into allOf (or anyOf with null), as draft-07 ignores keywords beside $ref, so the "Overrides the application's value for this container." descriptions were never shown. A schema test checks this.
• gojsonschema's "Must validate at least one schema (anyOf)" error is omitted when the errors of the closest branch are reported for the same field, which the null alternatives would otherwise add to many errors.

These will be synced to resources/validation/upsun.json in upsun/meta.

🤖 Generated with Claude Code

[upsun-dispatch]

Warning

Changes suggested — 🟡 1 warning · 🔵 1 minor point

🔍 Full review · 8 files reviewed

Verification

• DecodeConfig drops .-prefixed entries only from top-level sections other than tasks, so .note under tasks still reaches the Go checks and fails, as the new test expects.
• mergeConfigFiles skips .-prefixed section names before the duplicate check. Two files can each define .base without a duplicate-key error, and no sources entry is created for it.
• CheckContent returns early on schema errors, so crons: {.note: x} never reaches DecodeConfig's struct decode, where a string would fail to decode into the cron struct.
• With the {type: null} alternatives, an invalid value still reports the error from the real branch (e.g. egress.runtime: Expected: object), and the anyOf error is suppressed. I checked this by running it on sample configs.

This PR adds TestLint_PlatformLenience, new cases in TestLint_ContainerFeatures, TestMergeConfigFiles_DotPrefixedNames and the schema-wide TestSchemaKeywords. They run in CI via make test-go in .github/workflows/ci.yml. No test covers the error output for an invalid container_profile override, which is where the extra allOf message shows up.

Review details

• Commit: a2a2071
• Model: claude-opus-5-5

---

Review 1 of 10 for this pull request · View the full run