fix(cube-cli): never print a validation failure with nothing to act on

Review of the paired PR. All three are the same shape: the response contract
lives in cubedevinc/cubejs-enterprise and this command ships separately, so an
entry that doesn't match what it expects still has to print as something. A
blank line is the one output `validate` must never produce — printing the
errors IS the command.

- `format_error` renders a bare-string entry as itself and a half-filled
  object as whichever half it has, falling back to the entry's own JSON rather
  than the empty string `output::field` would give for both lookups.
- A response without `branchName` no longer yields "Data model on  is valid":
  it falls back to the branch the caller asked for, or a generic label for
  `--dev-mode`, where the personal `dev-…` name only exists server-side.
- `valid: false` with no errors said "failed to compile:" and then listed
  nothing, followed by "has 0 compilation error(s)". It now says the model
  could not be validated, which points at the runtime — where the answer is.
  Still fails closed: a report this command can't read is not evidence the
  model compiles.

Adds a `validate` row to the README's command table, and unit tests for the
new pure functions.

Author: claude

rust/cube-cli/README.md

@@ -130,6 +130,7 @@ Every endpoint of the Console Server public API is covered:
 |---|---|
 | `deployments` | list, get, create (`--bootstrap` scaffolds + builds a serving deployment), update (`--release-channel`, `--release-channel-version`), settings, versions, delete, token, advance-step, reset-step |
 | `regions` | list available deployment regions |
+| `validate` | compile a deployment's data model and report the compiler's errors; exits non-zero so it gates CI. `--branch` picks a branch, `--dev-mode` your active dev-mode working copy; neither validates the deploy branch |
 | `logs` | tail deployment pod logs (`--pod`, `-c/--container`; defaults to the Cube API container) |
 | `github` (`gh`) | status, installations, repos, branches, connect (import a repo into a deployment + first build) |
 | `data-model` (`dm`) | list, get, put, delete, rename files; branches, create-branch, enable-branch, disable-branch, dev-mode, exit-dev-mode, commit, pull. File writes only land on a **dev-mode branch**: `dev-mode <branch>` forks a personal `dev-…` branch and prints its name — pass that via `--branch` (or omit `--branch` to use your active dev-mode branch); puts to any other branch are rejected by the API. `enable-branch` / `disable-branch` toggle whether a shared branch's staging environment stays always active (vs. only while viewed in the UI); `branches` reports it as `ENABLED` and `environments list --type staging` lists the enabled ones |

rust/cube-cli/src/commands/validate.rs

@@ -27,13 +27,46 @@ pub struct Args {
 
 /// Render one compilation error as `<file>: <message>`, or just the message
 /// when the compiler didn't attribute it to a file.
+///
+/// The endpoint reports each error as `{ fileName?, message }`, but the CLI and
+/// the server ship from separate repos on separate cadences, so an entry that
+/// doesn't match that shape still has to print as something: a blank line is
+/// the one output this command must never produce — printing the errors IS the
+/// command. So a bare string renders as itself, a half-filled object renders as
+/// whichever half it has, and anything else falls back to its own JSON.
 fn format_error(error: &Value) -> String {
+    if let Value::String(message) = error {
+        return message.clone();
+    }
+
     let message = output::field(error, "message");
     let file = output::field(error, "fileName");
-    if file.is_empty() {
-        message
-    } else {
-        format!("{file}: {message}")
+
+    match (file.is_empty(), message.is_empty()) {
+        (false, false) => format!("{file}: {message}"),
+        (true, false) => message,
+        (false, true) => file,
+        (true, true) => error.to_string(),
+    }
+}
+
+/// What to call the validated branch in user-facing output.
+///
+/// The server echoes the branch it resolved, which is the only source for the
+/// `--dev-mode` case (the personal `dev-…` name is server-side). A
+/// differently-versioned one that doesn't echo it must not turn every message
+/// into "on  is valid" — fall back to what the caller asked for, and to a
+/// generic label when the caller named nothing either.
+fn branch_label(res: &Value, args: &Args) -> String {
+    let echoed = output::field(res, "branchName");
+    if !echoed.is_empty() {
+        return echoed;
+    }
+
+    match (&args.branch, args.dev_mode) {
+        (Some(branch), _) => branch.clone(),
+        (None, true) => "the dev-mode branch".to_string(),
+        (None, false) => "the deploy branch".to_string(),
     }
 }
 
@@ -55,7 +88,9 @@ pub async fn command(args: Args, ctx: &Ctx) -> Result<()> {
         )
         .await?;
 
-    let branch = output::field(&res, "branchName");
+    let branch = branch_label(&res, &args);
+    // Absent `valid` fails closed: a report this command can't read is not
+    // evidence the model compiles, and the whole point is gating CI on it.
     let valid = res.get("valid").and_then(Value::as_bool).unwrap_or(false);
     let errors = res
         .get("errors")
@@ -71,6 +106,14 @@ pub async fn command(args: Args, ctx: &Ctx) -> Result<()> {
             Some(n) => output::success(&format!("Data model on {branch} is valid ({n} cubes)")),
             None => output::success(&format!("Data model on {branch} is valid")),
         }
+    } else if errors.is_empty() {
+        // A failure the API couldn't itemize. Saying "failed to compile:" here
+        // would promise a list and then print nothing; point at the runtime
+        // instead, which is where the answer actually is.
+        eprintln!(
+            "{} Data model on {branch} could not be validated.",
+            "✗".red()
+        );
     } else {
         // Compilation errors go to stderr so `cube validate --json` stays
         // machine-readable on stdout and a human run stays readable when
@@ -84,6 +127,12 @@ pub async fn command(args: Args, ctx: &Ctx) -> Result<()> {
     if !valid {
         // Non-zero exit is the point of the command in CI, so it holds in
         // --json mode too, where the report above was printed as JSON.
+        if errors.is_empty() {
+            bail!(
+                "data model on {branch} could not be validated \
+                 (the API reported a failure without any compilation errors)"
+            );
+        }
         bail!(
             "data model on {branch} has {} compilation error(s)",
             errors.len()
@@ -112,4 +161,49 @@ mod tests {
             "no sql"
         );
     }
+
+    #[test]
+    fn an_entry_that_is_not_the_expected_object_still_prints_something() {
+        // A blank line is the one output this command must never produce, so
+        // every shape a differently-versioned server could send has to render.
+        assert_eq!(
+            format_error(&json!("Orders cube: no sql")),
+            "Orders cube: no sql"
+        );
+        assert_eq!(
+            format_error(&json!({"fileName": "model/cubes/orders.yml"})),
+            "model/cubes/orders.yml"
+        );
+        assert_eq!(format_error(&json!({"code": 7})), r#"{"code":7}"#);
+        assert_eq!(format_error(&Value::Null), "null");
+    }
+
+    fn args(branch: Option<&str>, dev_mode: bool) -> Args {
+        Args {
+            deployment: 1,
+            branch: branch.map(str::to_string),
+            dev_mode,
+        }
+    }
+
+    #[test]
+    fn the_branch_the_server_echoes_wins() {
+        // The `--dev-mode` name only exists server-side, so the echo is the
+        // only way to report which branch was actually validated.
+        let res = json!({"branchName": "dev-pavel-feature", "valid": true});
+        assert_eq!(branch_label(&res, &args(None, true)), "dev-pavel-feature");
+        assert_eq!(
+            branch_label(&res, &args(Some("feature"), false)),
+            "dev-pavel-feature"
+        );
+    }
+
+    #[test]
+    fn a_response_without_a_branch_never_leaves_a_hole_in_the_message() {
+        // "Data model on  is valid" is the failure this guards against.
+        let res = json!({"valid": true});
+        assert_eq!(branch_label(&res, &args(Some("feature"), false)), "feature");
+        assert_eq!(branch_label(&res, &args(None, true)), "the dev-mode branch");
+        assert_eq!(branch_label(&res, &args(None, false)), "the deploy branch");
+    }
 }