fix: Hard fail if the secret is not a string

acceptance/bundle/resources/secrets/validate-secret-is-string/databricks.yml

@@ -0,0 +1,13 @@
+bundle:
+  name: test-bundle
+
+resources:
+  secrets:
+    secret1:
+      catalog_name: main
+      schema_name: default
+      name: test_secret
+      value:
+        - hello
+        - world
+      comment: "This should fail validation"

acceptance/bundle/resources/secrets/validate-secret-is-string/output.txt

@@ -0,0 +1,14 @@
+
+=== Deploy should fail due to plain text secret value
+>>> [CLI] bundle deploy
+Warning: expected string, found sequence
+  at resources.secrets.secret1.value
+  in databricks.yml:11:9
+
+Error: Secret value must be a string
+  at resources.secrets.secret1.value
+
+The secret value for "secret1" must be a string.
+
+
+Exit code: 1

acceptance/bundle/resources/secrets/validate-secret-is-string/script

@@ -0,0 +1,2 @@
+title "Deploy should fail due to plain text secret value"
+trace $CLI bundle deploy

acceptance/bundle/resources/secrets/validate-secret-is-string/test.toml

@@ -0,0 +1,7 @@
+Cloud = false
+RecordRequests = false
+
+Ignore = [".databricks"]
+
+[EnvMatrix]
+DATABRICKS_BUNDLE_ENGINE = ["direct"]

bundle/config/mutator/validate_secret_value_is_variable.go

@@ -28,6 +28,13 @@ func (v *validateSecretValueIsVariable) Apply(ctx context.Context, b *bundle.Bun
 		p := dyn.NewPath(dyn.Key("resources"), dyn.Key("secrets"), dyn.Key(key), dyn.Key("value"))
 		val, err := dyn.GetByPath(b.Config.Value(), p)
 		if dyn.IsNoSuchKeyError(err) {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     []dyn.Path{p},
+			})
 			continue
 		}
 		if err != nil {
@@ -36,6 +43,13 @@ func (v *validateSecretValueIsVariable) Apply(ctx context.Context, b *bundle.Bun
 
 		valueStr, ok := val.AsString()
 		if !ok {
+			diags = append(diags, diag.Diagnostic{
+				Severity:  diag.Error,
+				Summary:   "Secret value must be a string",
+				Detail:    fmt.Sprintf(`The secret value for "%s" must be a string.`, key),
+				Locations: val.Locations(),
+				Paths:     []dyn.Path{p},
+			})
 			continue
 		}