Allow output_schema to validate non-object action output (int, bool, etc)

[cognifloyd]

This PR turns output_schema into a full jsonschema which provides several benefits.

• validate action output even if it output is a boolean, integer, or other non-object type.
• mask entire output of an action (mark all of an action's output as secret)
• improve secret masking in action output for more object types

We ignore schemas that are not well-formed to avoid throwing errors. But, we now log a warning when a schema is invalid as an invalid schema prevents validation and secret masking from working.

If anyone is using output_schema, they will need to update metadata to keep using ouptut validation and secret masking.

For example, this schema:

    output_schema:
      property1:
        type: bool
      property2:
        type: str

should be updated like this:

    output_schema:
      type: object
      properties:
        property1:
          type: bool
        property2:
          type: str
      additionalProperties: false

---

This builds on #5309 to refactor the output_schema validation and add missing tests.

Ultimately, this is a follow-up for #5250 which added secret-masking to the output_schema validation, but missed some of the possible data types for output_values.

Before this PR, ouptut_schema could only do output_validation and secret masking for properties of objects.

The runner schema required that output_schema be an object and patternProperties here allowed each property to be a schema:

st2/st2common/st2common/models/api/action.py

Lines 119 to 125 in b8402b4

	"output_schema": {
	"description": "Schema for the runner's output.",
	"type": "object",
	"patternProperties": {r"^\w+$": util_schema.get_action_output_schema()},
	"additionalProperties": False,
	"default": {},
	},

And the same applies to action schema:

st2/st2common/st2common/models/api/action.py

Lines 231 to 237 in b8402b4

	"output_schema": {
	"description": "Schema for the action's output.",
	"type": "object",
	"patternProperties": {r"^\w+$": util_schema.get_action_output_schema()},
	"additionalProperties": False,
	"default": {},
	},

This is where the schema for each output_schema property schema is loaded:

st2/st2common/st2common/util/schema/__init__.py

Lines 89 to 95 in b8402b4

	def get_action_output_schema(additional_properties=True):
	"""
	Return a generic schema which is used for validating action output.
	"""
	return get_draft_schema(
	version="action_output_schema", additional_properties=additional_properties
	)

st2/st2common/st2common/util/schema/__init__.py

Lines 57 to 59 in b8402b4

	"action_output_schema": jsonify.load_file(
	os.path.join(PATH, "action_output_schema.json")
	),

And action_output_schema.json is the full json schema spec with our extensions (secret masking, etc)

st2/st2common/st2common/util/schema/action_output_schema.json

Lines 2 to 4 in b8402b4

	"id": "http://json-schema.org/draft-04/schema#",
	"$schema": "http://json-schema.org/draft-04/schema#",
	"description": "Core schema meta-schema",

st2/st2common/st2common/util/schema/action_output_schema.json

Lines 92 to 99 in b8402b4

	"required": {
	"type": "boolean",
	"default": false
	},
	"secret": {
	"type": "boolean",
	"default": false
	},

Since output_schema used patternProperties, it could only validate objects - the only type that has properties. If your action or runner needed to output any other types (list, int, bool, ...), then output_validation and secret masking was unavailable. And, if your action provided an object whose keys needed to be masked (vs the property values), then that was also not possible.

[m4dcoder]

I got some questions.

[guzzijones]

---
name: "array_to_file_newline"
runner_type: "python-script"
description: "convert json to string and dump to file"
enabled: true
entry_point: "array_to_file_newline.py"
parameters:
  json: 
    type: array 
    description: "listjson to convert to newline string"
    required: true
  output_file:
    type: string
    description: "file name to output"
    required: true
output_schema:
  output:
    status: bool 

Here is the offending yaml file. Yes it was malformed.

I addressed the feedback and asked for permission to dismiss the review on slack. @m4dcoder responded with 🆗

[cognifloyd]

Documentation added in StackStorm/st2docs#1137