Ignore write-only properties in schema-aware diffs by SteveL-MSFT · Pull Request #1674 · PowerShell/DSC

Steve Lee (SteveL-MSFT) · 2026-08-13T19:18:58Z

Properties used only as resource instructions may not be returned by a resource, which caused schema-aware comparisons to report false differences.

This change makes get_diff_with_schema() skip properties marked writeOnly: true in the resource schema. The Windows Firewall resource now marks unspecifiedRulesAction as write-only, and unit and resource tests cover differing, omitted, and explicitly non-write-only properties.

Fix #1668

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR reduces false-positive schema-aware differences when resources intentionally do not return “instruction-only” properties by making get_diff_with_schema() ignore schema properties marked writeOnly: true. It also updates the Windows Firewall resource schema and tests to reflect that unspecifiedRulesAction is write-only and should not affect desired-state comparisons.

Changes:

Update get_diff_with_schema() to skip properties whose JSON Schema sets writeOnly: true, and add unit tests for write-only behavior.
Mark unspecifiedRulesAction as writeOnly in the Windows Firewall resource schema.
Adjust Windows Firewall resource tests to assert non-default unspecifiedRulesAction values do not cause diffs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
resources/windows_firewall/windows_firewall.dsc.resource.json	Marks `unspecifiedRulesAction` as `writeOnly` so it’s excluded from schema-aware diffing.
resources/windows_firewall/tests/windows_firewall_schema_default.tests.ps1	Updates resource tests to assert `unspecifiedRulesAction` does not affect `inDesiredState`/diff output.
lib/dsc-lib/src/dscresources/dscresource.rs	Implements write-only skipping in schema-aware diffs and adds unit tests for the behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-08-13T19:39:36Z

😁 Code Coverage Report

Changed Code Coverage

94% (90%+ coverage)

Metric	Value
Changed lines analyzed	74
Lines covered by tests	70
Coverage percentage	94%

🔵 Full Codebase Coverage

82% (good)

Metric	Value
Total executable lines	18820
Lines covered by tests	15500
Coverage percentage	82%

Changed code coverage measures only Rust lines added/modified in this PR.
Full codebase coverage measures all instrumented Rust lines across the project.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Mikey Lombardi (He/Him) (michaeltlombardi) · 2026-08-14T15:00:04Z


+/// Returns whether a property's JSON Schema sets `writeOnly` to `true`, directly or
+/// through a local JSON Pointer reference.
+fn is_schema_write_only(schema: Option<&Value>, property_name: &str) -> bool {


Initially, I was going to recommend implementing this would be easier in the dsc-lib-jsonschema crate, but thinking about this a bit more, I think the ergonomics and simplicity will mostly improve when we implement the in-memory schema registry and retriever, when we can call deference() to get the full property definition for verification.

Steve Lee (SteveL-MSFT) · 2026-08-14T20:24:19Z

Copilot resolve the merge conflicts in this pull request

Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com>

Copilot · 2026-08-14T20:30:42Z

Copilot resolve the merge conflicts in this pull request

Resolved the conflicts by merging main in ed4531b6; e3f76e92 also ensures the replacement unspecifiedRules write-only instruction is not returned from set operations.

* Use JSON Schema defaults in synthetic test get_diff (#1670) * Use JSON Schema defaults in synthetic test get_diff Update get_diff() to accept an optional JSON Schema parameter via the new get_diff_with_schema() function. When a property exists in the expected (desired) state but is missing from the actual state, the function now checks the schema for a 'default' value for that property. If the expected value matches the schema default, it is not reported as differing. This improves synthetic test accuracy for resources that don't return properties whose values match the schema-defined defaults. - Add get_diff_with_schema() with optional schema parameter - Keep get_diff() as a convenience wrapper (no schema) - Update invoke_synthetic_test to retrieve and pass the resource schema - Update DscResource synthetic test path for adapted resources - Add get_schema_default() helper to extract defaults from JSON Schema - Add Test/SchemaDefault test resource and dsctest subcommand - Add Rust unit tests for schema default comparison logic - Add Pester integration tests for end-to-end validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address PR feedback: restrict visibility and avoid redundant serialization - Change get_diff_with_schema from pub to pub(crate) since it is only used within the dsc-lib crate - Read schema from RESOURCE_SCHEMAS cache directly (returns Value) instead of round-tripping through get_schema -> String -> from_str. Only calls get_schema to populate the cache on a miss. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add FirewallRuleList Pester tests for schema default fix (#1666) Add tests verifying that unspecifiedRulesAction set to the schema default value 'ignore' is no longer reported as drift in synthetic test. Non-default values ('disable', 'remove') are still correctly flagged. Tests require elevation to create/remove firewall rules and are skipped when not running as Administrator. Fixes #1666 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix CI: skip firewall schema default tests when NetSecurity module unavailable Move -Skip to Describe block and check for Get-NetFirewallRule cmdlet availability in BeforeDiscovery. This prevents BeforeAll/AfterAll from running on CI runners without the NetSecurity module. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com> --------- Co-authored-by: Steve Lee (POWERSHELL HE/HIM) (from Dev Box) <slee@ntdev.microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com> * Add scoped unspecified firewall rule handling and allow empty rules (#1671) * Add scoped unspecified firewall rules Replace unspecifiedRulesAction with the scoped unspecifiedRules object and allow empty rule lists for authoritative reconciliation. Add Rust and Pester coverage for direction and profile filtering. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address firewall scope review feedback Reject empty unspecified rule profile filters in the schema and runtime, and localize the VariantClear warning. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix platform-specific changed coverage Merge coverage from every platform when measuring changed Rust code while retaining Linux-only data for the full-codebase metric. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix cross-platform coverage reporting Correct the PowerShell coverage artifact predicate and initialize firewall Pester skip conditions before Describe discovery so elevated Windows CI executes the suites. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Guard firewall tests on NetSecurity Skip firewall set and what-if suites when any cmdlet required for setup or cleanup is unavailable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Reduce firewall formatting churn Keep the scoped unspecified-rule implementation focused on semantic changes so changed-line coverage measures the feature rather than unrelated rustfmt reflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Minimize changed firewall coverage lines Keep changed expressions in the existing compact style so line coverage is not diluted by formatting-only line splits. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Steve Lee (POWERSHELL HE/HIM) (from Dev Box) <slee@ntdev.microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Ignore write-only properties in schema-aware diffs (#1674) * Ignore write-only properties in schema diffs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Resolve local refs for write-only properties Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Omit write-only firewall instructions from set output Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com> --------- Co-authored-by: Steve Lee (POWERSHELL HE/HIM) (from Dev Box) <slee@ntdev.microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com> --------- Co-authored-by: Steve Lee (POWERSHELL HE/HIM) (from Dev Box) <slee@ntdev.microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com>

Ignore write-only properties in schema diffs

a9a9299

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings August 13, 2026 19:18

Copilot started reviewing on behalf of Steve Lee (SteveL-MSFT) August 13, 2026 19:19 View session

Steve Lee (SteveL-MSFT) added this to the 3.3-Approved milestone Aug 13, 2026

Steve Lee (SteveL-MSFT) added the Backport-Needed label Aug 13, 2026

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Comment thread lib/dsc-lib/src/dscresources/dscresource.rs

Resolve local refs for write-only properties

2ced2fe

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Steve Lee (SteveL-MSFT) requested review from Mikey Lombardi (He/Him) (michaeltlombardi) and Tess Gauthier (tgauth) August 13, 2026 21:00

Mikey Lombardi (He/Him) (michaeltlombardi) reviewed Aug 14, 2026

View reviewed changes

Comment thread lib/dsc-lib/src/dscresources/dscresource.rs

Copilot started work on behalf of Steve Lee (SteveL-MSFT) August 14, 2026 20:24 View session

Copilot AI and others added 2 commits August 14, 2026 20:26

Merge main into write-only schema diff branch

ed4531b

Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com>

Omit write-only firewall instructions from set output

e3f76e9

Co-authored-by: SteveL-MSFT <11859881+SteveL-MSFT@users.noreply.github.com>

Copilot finished work on behalf of Steve Lee (SteveL-MSFT) August 14, 2026 20:31

Mikey Lombardi (He/Him) (michaeltlombardi) approved these changes Aug 17, 2026

View reviewed changes

Mikey Lombardi (He/Him) (michaeltlombardi) added this pull request to the merge queue Aug 17, 2026

Merged via the queue into main with commit 0b7a852 Aug 17, 2026
24 checks passed

Mikey Lombardi (He/Him) (michaeltlombardi) deleted the stevel-msft-ignore-instructed-schema-diffs branch August 17, 2026 18:29

Steve Lee (SteveL-MSFT) mentioned this pull request Aug 17, 2026

Backport fixes for 3.3-rc.2 #1679

Merged

Steve Lee (SteveL-MSFT) added Backport-Done and removed Backport-Needed labels Aug 18, 2026

Boaz Raz (boaz-raz) mentioned this pull request Aug 18, 2026

Microsoft.Windows/FirewallRuleList: unspecifiedRulesAction is always reported as drift, so test and set never converge #1666

Closed

Navigation Menu

Uh oh!

Ignore write-only properties in schema-aware diffs - #1674

Ignore write-only properties in schema-aware diffs#1674
Mikey Lombardi (He/Him) (michaeltlombardi) merged 4 commits into
mainfrom
stevel-msft-ignore-instructed-schema-diffs

Steve Lee (SteveL-MSFT) commented Aug 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) Aug 14, 2026

Uh oh!

Uh oh!

Steve Lee (SteveL-MSFT) commented Aug 14, 2026

Uh oh!

Copilot AI commented Aug 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Steve Lee (SteveL-MSFT) commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

😁 Code Coverage Report

Changed Code Coverage

🔵 Full Codebase Coverage

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Steve Lee (SteveL-MSFT) commented Aug 14, 2026

Uh oh!

Copilot AI commented Aug 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Steve Lee (SteveL-MSFT) commented Aug 13, 2026 •

edited

Loading

github-actions Bot commented Aug 13, 2026 •

edited

Loading