Use JSON Schema defaults in synthetic test get_diff by SteveL-MSFT · Pull Request #1670 · PowerShell/DSC

Steve Lee (SteveL-MSFT) · 2026-08-11T21:53:14Z

Motivation

When a DSC resource does not implement the test operation, the engine performs a synthetic test by calling get and comparing expected vs actual state using get_diff(). Previously, if a property existed in the expected (desired) state but was missing from the actual (get) output, it was always reported as differing -- even if the resource simply omits properties whose values match the schema-defined default.

This causes false positives in synthetic test results. The most impactful case is Microsoft.Windows/FirewallRuleList where unspecifiedRulesAction is a write-only instruction that get never returns. Setting it to "ignore" (the documented default) permanently reports drift, making the property unusable for compliance reporting.

Approach

Introduced get_diff_with_schema(expected, actual, schema) which accepts an optional JSON Schema. When a property is in expected but absent from actual, the function looks up the schema's default value for that property. If the expected value matches the default, it is not flagged as a diff.
The existing get_diff(expected, actual) remains as a convenience wrapper (passes None for the schema), so all non-synthetic-test call sites are unaffected.
Both synthetic test paths (command resources and adapted resources) now retrieve the resource schema and pass it to the new function.
Schema is read directly from the RESOURCE_SCHEMAS cache (avoiding redundant serialization), with a fallback to get_schema() to populate the cache on a miss.

Test coverage

Rust unit tests (6 new): Cover matching/mismatching schema defaults for booleans and integers, missing defaults, and the no-schema fallback.
Pester integration tests (7 new): End-to-end validation using a new Test/SchemaDefault resource.
FirewallRuleList Pester tests (4 new): Verify that unspecifiedRulesAction: ignore no longer causes false drift, while non-default values (disable, remove) are still correctly reported.
Verified existing dsc_resource_test.tests.ps1 tests still pass with no regressions.

Fixes #1666

Update get_diff() to accept an optional JSON Schema parameter via the new get_diff_with_schema() function. When a property exists in the expected (desired) state but is missing from the actual state, the function now checks the schema for a 'default' value for that property. If the expected value matches the schema default, it is not reported as differing. This improves synthetic test accuracy for resources that don't return properties whose values match the schema-defined defaults. - Add get_diff_with_schema() with optional schema parameter - Keep get_diff() as a convenience wrapper (no schema) - Update invoke_synthetic_test to retrieve and pass the resource schema - Update DscResource synthetic test path for adapted resources - Add get_schema_default() helper to extract defaults from JSON Schema - Add Test/SchemaDefault test resource and dsctest subcommand - Add Rust unit tests for schema default comparison logic - Add Pester integration tests for end-to-end validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds schema-aware diffing for synthetic dsc resource test (when a resource lacks a native test operation), so missing properties in get output don’t produce false diffs when the desired value matches the JSON Schema default.

Changes:

Introduces get_diff_with_schema(expected, actual, schema) and a helper to read per-property schema defaults when actual omits a key.
Updates synthetic test paths (command + adapted resources) to retrieve the resource schema and pass it into diffing.
Adds new Rust + Pester tests, including a Test/SchemaDefault resource that omits defaulted fields from get output.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/dsctest/src/schema_default.rs	Adds a dsctest input struct for the new schema-default test resource.
tools/dsctest/src/main.rs	Adds `schema-default` subcommand and exposes its JSON schema via `dsctest schema`.
tools/dsctest/src/args.rs	Wires new clap subcommand and schema enum variant.
tools/dsctest/dsctest.dsc.manifests.json	Adds `Test/SchemaDefault` manifest with embedded schema defaults.
lib/dsc-lib/src/dscresources/dscresource.rs	Adds schema-aware diffing and unit tests for default handling.
lib/dsc-lib/src/dscresources/command_resource.rs	Passes resource schema into synthetic test diffing.
dsc/tests/dsc_schema_default.tests.ps1	Adds end-to-end tests verifying schema defaults are honored in synthetic tests.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ation - Change get_diff_with_schema from pub to pub(crate) since it is only used within the dsc-lib crate - Read schema from RESOURCE_SCHEMAS cache directly (returns Value) instead of round-tripping through get_schema -> String -> from_str. Only calls get_schema to populate the cache on a miss. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add tests verifying that unspecifiedRulesAction set to the schema default value 'ignore' is no longer reported as drift in synthetic test. Non-default values ('disable', 'remove') are still correctly flagged. Tests require elevation to create/remove firewall rules and are skipped when not running as Administrator. Fixes #1666 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-11T22:14:24Z

😁 Code Coverage Report

Changed Code Coverage

90% (90%+ coverage)

Metric	Value
Changed lines analyzed	85
Lines covered by tests	77
Coverage percentage	90%

🔵 Full Codebase Coverage

82% (good)

Metric	Value
Total executable lines	18748
Lines covered by tests	15431
Coverage percentage	82%

Changed code coverage measures only Rust lines added/modified in this PR.
Full codebase coverage measures all instrumented Rust lines across the project.

…available Move -Skip to Describe block and check for Get-NetFirewallRule cmdlet availability in BeforeDiscovery. This prevents BeforeAll/AfterAll from running on CI runners without the NetSecurity module. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Mikey Lombardi (He/Him) (michaeltlombardi)

Overall, this PR looks good to me.

Out of scope but related, we should probably leverage this new comparison with schemas in a follow up PR to handle write-only and read-only properties that differ between actual/expected - write-only properties can never be compared and there's an argument for read-only properties only being compared when they're in both states (because the user is specifically saying "I expect output to be foo").

Mikey Lombardi (He/Him) (michaeltlombardi) · 2026-08-12T17:32:08Z

+/// Looks up the default value for a property from a JSON Schema.
+///
+/// # Arguments
+///
+/// * `schema` - Optional JSON Schema value
+/// * `property_name` - The property name to look up
+///
+/// # Returns
+///
+/// The default value if found in the schema's properties definition, otherwise None
+fn get_schema_default(schema: Option<&Value>, property_name: &str) -> Option<Value> {
+    let schema = schema?;
+    let properties = schema.get("properties")?.as_object()?;
+    let property_schema = properties.get(property_name)?.as_object()?;
+    property_schema.get("default").cloned()
+}


Nit: Out of scope for this PR, but I think this fits better as an extension method in dsc-lib-jsonschema - probably something like the following signature:

pub get_default_property_value( &Self, property_name: &str, ) -> Option<&Value> {}

Agree we can improve this outside of this PR

Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com>

Copilot AI lite review requested due to automatic review settings August 11, 2026 21:53

Copilot started reviewing on behalf of Steve Lee (SteveL-MSFT) August 11, 2026 21:53 View session

Steve Lee (SteveL-MSFT) added this to the 3.3-Approved milestone Aug 11, 2026

Steve Lee (SteveL-MSFT) added the Backport-Needed label Aug 11, 2026

Copilot AI reviewed Aug 11, 2026

View reviewed changes

Comment thread lib/dsc-lib/src/dscresources/dscresource.rs Outdated

Comment thread lib/dsc-lib/src/dscresources/command_resource.rs Outdated

Steve Lee (SteveL-MSFT) requested review from Mikey Lombardi (He/Him) (michaeltlombardi) and Tess Gauthier (tgauth) August 11, 2026 22:08

Mikey Lombardi (He/Him) (michaeltlombardi) approved these changes Aug 12, 2026

View reviewed changes

Apply suggestions from code review

642e0e0

Co-authored-by: Mikey Lombardi (He/Him) <michael.t.lombardi@gmail.com>

Steve Lee (SteveL-MSFT) added this pull request to the merge queue Aug 12, 2026

Merged via the queue into main with commit 79fd2ab Aug 12, 2026
24 checks passed

Steve Lee (SteveL-MSFT) deleted the stevel-msft-synthetic-test-schema-default branch August 12, 2026 23:13

Steve Lee (SteveL-MSFT) mentioned this pull request Aug 17, 2026

Backport fixes for 3.3-rc.2 #1679

Open

Navigation Menu

Uh oh!

Use JSON Schema defaults in synthetic test get_diff - #1670

Use JSON Schema defaults in synthetic test get_diff#1670
Steve Lee (SteveL-MSFT) merged 5 commits into
mainfrom
stevel-msft-synthetic-test-schema-default

Steve Lee (SteveL-MSFT) commented Aug 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) left a comment

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) Aug 12, 2026

Uh oh!

Steve Lee (SteveL-MSFT) Aug 12, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Steve Lee (SteveL-MSFT) commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Approach

Test coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

😁 Code Coverage Report

Changed Code Coverage

🔵 Full Codebase Coverage

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) left a comment

Choose a reason for hiding this comment

Uh oh!

Mikey Lombardi (He/Him) (michaeltlombardi) Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

Steve Lee (SteveL-MSFT) Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Steve Lee (SteveL-MSFT) commented Aug 11, 2026 •

edited

Loading

github-actions Bot commented Aug 11, 2026 •

edited

Loading