Description Of Changes

Unfortunately the variable expansion logic in the FIDES__DATABASE__LOAD_SAMPLES handling can result in loading a character like &, which YAML parsing then tries to interpret as an anchor, and then it fails to load the sample data.

Fides' startup routine is resilient to that failure, it just continues starting up but aborts loading the rest of the sample data, which is a subtle footgun and caught us in a test environment recently!

This addresses this by wrapping all the variables we load from the template connections in quotes, and adds some tests to exercise that.

Code Changes

• Update sample connections YML to wrap variables in quotes
• Add test to ensure that sample connections YML loads safely with special characters in variables
• Add test to demonstrate what will/won't fail to load, for future engineers

Steps to Confirm

1. Run unit tests and confirm
2. Use FIDES__DATABASE__LOAD_SAMPLES=1 and insert ENV variables like FIDES_DEPLOY__CONNECTORS__POSTGRES__HOST=&123 and confirm that YAML errors do not occur

Pre-Merge Checklist

• Issue requirements met
• All CI pipelines succeeded
• CHANGELOG.md updated
  • Add a db-migration This indicates that a change includes a database migration label to the entry if your change includes a DB migration
  • Add a high-risk This issue suggests changes that have a high-probability of breaking existing code label to the entry if your change includes a high-risk change (i.e. potential for performance impact or unexpected regression) that should be flagged
• Followup issues:
  • Followup issues created (include link)
  • No followup issues
• Database migrations:
  • Ensure that your downrev is up to date with the latest revision on main
  • Ensure that your downgrade() migration is correct and works
    • If a downgrade migration is not possible for this change, please call this out in the PR description!
  • No migrations
• Documentation:
  • Documentation complete, PR opened in fidesdocs
  • Documentation issue created in fidesdocs
  • If there are any new client scopes created as part of the pull request, remember to update public-facing documentation that references our scope registry
  • No documentation updates required