(PA-7812) Only check_schema on resources actually consumed

lib/puppet/resource_api.rb

@@ -282,7 +282,6 @@ def self.rsapi_provider_get(names = nil)
                   end
 
         fetched.each do |resource_hash|
-          type_definition.check_schema(resource_hash)
           rsapi_provider_get_cache.add(build_title(type_definition, resource_hash), resource_hash)
         end
 
@@ -300,6 +299,7 @@ def self.instances
         provider(type_definition.name)
 
         rsapi_provider_get.map do |resource_hash|
+          type_definition.check_schema(resource_hash)
           # allow a :title from the provider to override the default
           result = if resource_hash.key? :title
                      new(title: resource_hash[:title])
@@ -317,6 +317,7 @@ def refresh_current_state
         current_state = self.class.rsapi_provider_get([rsapi_title]).find { |h| namevar_match?(h) }
 
         if current_state
+          type_definition.check_schema(current_state)
           strict_check(current_state)
         else
           current_state = if rsapi_title.is_a? Hash

spec/puppet/resource_api_spec.rb

@@ -367,6 +367,38 @@ def set(_context, _changes); end
           end
         end
       end
+
+      context 'with a provider that returns other, unmanaged resources with schema violations', :agent_test do
+        before do
+          stub_const('Puppet::Provider::TypeCheck', Module.new)
+          stub_const('Puppet::Provider::TypeCheck::TypeCheck', provider_class)
+          Puppet::Type.type(type_name.to_sym).rsapi_provider_get_cache.clear
+        end
+
+        # `get` returns the managed resource (`test`, schema-valid) alongside another
+        # resource (`other`) that the catalog does not manage but which violates the
+        # schema. Only the managed resource should be schema-checked on retrieve.
+        let(:provider_class) do
+          Class.new do
+            def get(_context)
+              [
+                { name: 'test' },
+                { name: 'other', test_string: 15, wibble: 'foo' }
+              ]
+            end
+
+            def set(_context, _changes); end
+          end
+        end
+
+        context 'when strict is :error' do
+          let(:strict_level) { :error }
+
+          it 'does not raise for schema violations in the unmanaged resource' do
+            expect { instance.retrieve }.not_to raise_error
+          end
+        end
+      end
     end
   end