diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ebb3e75d4..a497a7d7b 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -44,7 +44,7 @@ jobs:
         run: |
           echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-          go install gotest.tools/gotestsum@latest
+          go install gotest.tools/gotestsum@v1.12.0
 
       - name: Pull external libraries
         run: |
diff --git a/.golangci.yaml b/.golangci.yaml
index ef2596206..602f12630 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,9 +1,8 @@
 linters:
   disable-all: true
   enable:
-    # errcheck and govet are part of default setup and should be included but give too many errors now
-    # once errors are fixed, they should be enabled here:
-    #- errcheck
+    - bodyclose
+    - errcheck
     - gosimple
     #- govet
     - ineffassign
@@ -15,5 +14,11 @@ linters-settings:
     rewrite-rules:
       - pattern: 'a[b:len(a)]'
         replacement: 'a[b:]'
+      - pattern: 'interface{}'
+        replacement: 'any'
 issues:
   exclude-dirs-use-default: false  # recommended by docs https://golangci-lint.run/usage/false-positives/
+  exclude-rules:
+    - path-except: (_test\.go|internal)
+      linters:
+        - errcheck
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f2645b218..56207686a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Version changelog
 
+## [Release] Release v0.236.0
+
+**New features for Databricks Asset Bundles:**
+
+This release adds support for managing Unity Catalog volumes as part of your bundle configuration.
+
+Bundles:
+ * Add DABs support for Unity Catalog volumes ([#1762](https://github.com/databricks/cli/pull/1762)).
+ * Support lookup by name of notification destinations ([#1922](https://github.com/databricks/cli/pull/1922)).
+ * Extend "notebook not found" error to warn about missing extension ([#1920](https://github.com/databricks/cli/pull/1920)).
+ * Skip sync warning if no sync paths are defined ([#1926](https://github.com/databricks/cli/pull/1926)).
+ * Add validation for single node clusters ([#1909](https://github.com/databricks/cli/pull/1909)).
+ * Fix segfault in bundle summary command ([#1937](https://github.com/databricks/cli/pull/1937)).
+ * Add the `bundle_uuid` helper function for templates ([#1947](https://github.com/databricks/cli/pull/1947)).
+ * Add default value for `volume_type` for DABs ([#1952](https://github.com/databricks/cli/pull/1952)).
+ * Properly read Git metadata when running inside workspace ([#1945](https://github.com/databricks/cli/pull/1945)).
+ * Upgrade TF provider to 1.59.0 ([#1960](https://github.com/databricks/cli/pull/1960)).
+
+Internal:
+ * Breakout variable lookup into separate files and tests ([#1921](https://github.com/databricks/cli/pull/1921)).
+ * Add golangci-lint v1.62.2 ([#1953](https://github.com/databricks/cli/pull/1953)).
+
+Dependency updates:
+ * Bump golang.org/x/term from 0.25.0 to 0.26.0 ([#1907](https://github.com/databricks/cli/pull/1907)).
+ * Bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1 ([#1930](https://github.com/databricks/cli/pull/1930)).
+ * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 ([#1932](https://github.com/databricks/cli/pull/1932)).
+ * Bump github.com/databricks/databricks-sdk-go from 0.51.0 to 0.52.0 ([#1931](https://github.com/databricks/cli/pull/1931)).
 ## [Release] Release v0.235.0
 
 **Note:** the `bundle generate` command now uses the `.<resource-type>.yml`
diff --git a/Makefile b/Makefile
index 13787fdda..bc1c42cfa 100644
--- a/Makefile
+++ b/Makefile
@@ -36,5 +36,7 @@ vendor:
 	@echo "✓ Filling vendor folder with library code ..."
 	@go mod vendor
 
-.PHONY: build vendor coverage test lint fmt
+integration:
+	gotestsum --format github-actions --rerun-fails --jsonfile output.json --packages "./internal/..." -- -run "TestAcc.*" -parallel 4 -timeout=2h
 
+.PHONY: fmt lint lintfix test testonly coverage build snapshot vendor integration
diff --git a/bundle/config/mutator/initialize_urls_test.go b/bundle/config/mutator/initialize_urls_test.go
index ec4e790c4..f07a7deb3 100644
--- a/bundle/config/mutator/initialize_urls_test.go
+++ b/bundle/config/mutator/initialize_urls_test.go
@@ -110,7 +110,8 @@ func TestInitializeURLs(t *testing.T) {
 		"dashboard1":       "https://mycompany.databricks.com/dashboardsv3/01ef8d56871e1d50ae30ce7375e42478/published?o=123456",
 	}
 
-	initializeForWorkspace(b, "123456", "https://mycompany.databricks.com/")
+	err := initializeForWorkspace(b, "123456", "https://mycompany.databricks.com/")
+	require.NoError(t, err)
 
 	for _, group := range b.Config.Resources.AllResources() {
 		for key, r := range group.Resources {
@@ -133,7 +134,8 @@ func TestInitializeURLsWithoutOrgId(t *testing.T) {
 		},
 	}
 
-	initializeForWorkspace(b, "123456", "https://adb-123456.azuredatabricks.net/")
+	err := initializeForWorkspace(b, "123456", "https://adb-123456.azuredatabricks.net/")
+	require.NoError(t, err)
 
 	require.Equal(t, "https://adb-123456.azuredatabricks.net/jobs/1", b.Config.Resources.Jobs["job1"].URL)
 }
diff --git a/bundle/config/mutator/override_compute.go b/bundle/config/mutator/override_compute.go
index 5700cdf26..2e14b5824 100644
--- a/bundle/config/mutator/override_compute.go
+++ b/bundle/config/mutator/override_compute.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
+	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/env"
 )
@@ -38,18 +39,31 @@ func overrideJobCompute(j *resources.Job, compute string) {
 }
 
 func (m *overrideCompute) Apply(ctx context.Context, b *bundle.Bundle) diag.Diagnostics {
-	if b.Config.Bundle.Mode != config.Development {
+	var diags diag.Diagnostics
+
+	if b.Config.Bundle.Mode == config.Production {
 		if b.Config.Bundle.ClusterId != "" {
-			return diag.Errorf("cannot override compute for an target that does not use 'mode: development'")
+			// Overriding compute via a command-line flag for production works, but is not recommended.
+			diags = diags.Extend(diag.Diagnostics{{
+				Summary: "Setting a cluster override for a target that uses 'mode: production' is not recommended",
+				Detail:  "It is recommended to always use the same compute for production target for consistency.",
+			}})
 		}
-		return nil
 	}
 	if v := env.Get(ctx, "DATABRICKS_CLUSTER_ID"); v != "" {
+		// For historical reasons, we allow setting the cluster ID via the DATABRICKS_CLUSTER_ID
+		// when development mode is used. Sometimes, this is done by accident, so we log an info message.
+		if b.Config.Bundle.Mode == config.Development {
+			cmdio.LogString(ctx, "Setting a cluster override because DATABRICKS_CLUSTER_ID is set. It is recommended to use --cluster-id instead, which works in any target mode.")
+		} else {
+			// We don't allow using DATABRICKS_CLUSTER_ID in any other mode, it's too error-prone.
+			return diag.Warningf("The DATABRICKS_CLUSTER_ID variable is set but is ignored since the current target does not use 'mode: development'")
+		}
 		b.Config.Bundle.ClusterId = v
 	}
 
 	if b.Config.Bundle.ClusterId == "" {
-		return nil
+		return diags
 	}
 
 	r := b.Config.Resources
@@ -57,5 +71,5 @@ func (m *overrideCompute) Apply(ctx context.Context, b *bundle.Bundle) diag.Diag
 		overrideJobCompute(r.Jobs[i], b.Config.Bundle.ClusterId)
 	}
 
-	return nil
+	return diags
 }
diff --git a/bundle/config/mutator/override_compute_test.go b/bundle/config/mutator/override_compute_test.go
index 369447d7e..950091ed7 100644
--- a/bundle/config/mutator/override_compute_test.go
+++ b/bundle/config/mutator/override_compute_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestOverrideDevelopment(t *testing.T) {
+func TestOverrideComputeModeDevelopment(t *testing.T) {
 	t.Setenv("DATABRICKS_CLUSTER_ID", "")
 	b := &bundle.Bundle{
 		Config: config.Root{
@@ -62,10 +62,13 @@ func TestOverrideDevelopment(t *testing.T) {
 	assert.Empty(t, b.Config.Resources.Jobs["job1"].Tasks[3].JobClusterKey)
 }
 
-func TestOverrideDevelopmentEnv(t *testing.T) {
+func TestOverrideComputeModeDefaultIgnoresVariable(t *testing.T) {
 	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	b := &bundle.Bundle{
 		Config: config.Root{
+			Bundle: config.Bundle{
+				Mode: "",
+			},
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job1": {JobSettings: &jobs.JobSettings{
@@ -86,11 +89,12 @@ func TestOverrideDevelopmentEnv(t *testing.T) {
 
 	m := mutator.OverrideCompute()
 	diags := bundle.Apply(context.Background(), b, m)
-	require.NoError(t, diags.Error())
+	require.Len(t, diags, 1)
+	assert.Equal(t, "The DATABRICKS_CLUSTER_ID variable is set but is ignored since the current target does not use 'mode: development'", diags[0].Summary)
 	assert.Equal(t, "cluster2", b.Config.Resources.Jobs["job1"].Tasks[1].ExistingClusterId)
 }
 
-func TestOverridePipelineTask(t *testing.T) {
+func TestOverrideComputePipelineTask(t *testing.T) {
 	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	b := &bundle.Bundle{
 		Config: config.Root{
@@ -115,7 +119,7 @@ func TestOverridePipelineTask(t *testing.T) {
 	assert.Empty(t, b.Config.Resources.Jobs["job1"].Tasks[0].ExistingClusterId)
 }
 
-func TestOverrideForEachTask(t *testing.T) {
+func TestOverrideComputeForEachTask(t *testing.T) {
 	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	b := &bundle.Bundle{
 		Config: config.Root{
@@ -140,10 +144,11 @@ func TestOverrideForEachTask(t *testing.T) {
 	assert.Empty(t, b.Config.Resources.Jobs["job1"].Tasks[0].ForEachTask.Task)
 }
 
-func TestOverrideProduction(t *testing.T) {
+func TestOverrideComputeModeProduction(t *testing.T) {
 	b := &bundle.Bundle{
 		Config: config.Root{
 			Bundle: config.Bundle{
+				Mode:      config.Production,
 				ClusterId: "newClusterID",
 			},
 			Resources: config.Resources{
@@ -166,13 +171,18 @@ func TestOverrideProduction(t *testing.T) {
 
 	m := mutator.OverrideCompute()
 	diags := bundle.Apply(context.Background(), b, m)
-	require.True(t, diags.HasError())
+	require.Len(t, diags, 1)
+	assert.Equal(t, "Setting a cluster override for a target that uses 'mode: production' is not recommended", diags[0].Summary)
+	assert.Equal(t, "newClusterID", b.Config.Resources.Jobs["job1"].Tasks[0].ExistingClusterId)
 }
 
-func TestOverrideProductionEnv(t *testing.T) {
+func TestOverrideComputeModeProductionIgnoresVariable(t *testing.T) {
 	t.Setenv("DATABRICKS_CLUSTER_ID", "newClusterId")
 	b := &bundle.Bundle{
 		Config: config.Root{
+			Bundle: config.Bundle{
+				Mode: config.Production,
+			},
 			Resources: config.Resources{
 				Jobs: map[string]*resources.Job{
 					"job1": {JobSettings: &jobs.JobSettings{
@@ -193,5 +203,7 @@ func TestOverrideProductionEnv(t *testing.T) {
 
 	m := mutator.OverrideCompute()
 	diags := bundle.Apply(context.Background(), b, m)
-	require.NoError(t, diags.Error())
+	require.Len(t, diags, 1)
+	assert.Equal(t, "The DATABRICKS_CLUSTER_ID variable is set but is ignored since the current target does not use 'mode: development'", diags[0].Summary)
+	assert.Equal(t, "cluster2", b.Config.Resources.Jobs["job1"].Tasks[1].ExistingClusterId)
 }
diff --git a/bundle/config/mutator/resolve_resource_references_test.go b/bundle/config/mutator/resolve_resource_references_test.go
index ee2f0e2ea..624e337c7 100644
--- a/bundle/config/mutator/resolve_resource_references_test.go
+++ b/bundle/config/mutator/resolve_resource_references_test.go
@@ -108,7 +108,8 @@ func TestNoLookupIfVariableIsSet(t *testing.T) {
 	m := mocks.NewMockWorkspaceClient(t)
 	b.SetWorkpaceClient(m.WorkspaceClient)
 
-	b.Config.Variables["my-cluster-id"].Set("random value")
+	err := b.Config.Variables["my-cluster-id"].Set("random value")
+	require.NoError(t, err)
 
 	diags := bundle.Apply(context.Background(), b, ResolveResourceReferences())
 	require.NoError(t, diags.Error())
diff --git a/bundle/config/mutator/translate_paths_test.go b/bundle/config/mutator/translate_paths_test.go
index bf6ba15d8..8442ff6cf 100644
--- a/bundle/config/mutator/translate_paths_test.go
+++ b/bundle/config/mutator/translate_paths_test.go
@@ -28,7 +28,8 @@ import (
 func touchNotebookFile(t *testing.T, path string) {
 	f, err := os.Create(path)
 	require.NoError(t, err)
-	f.WriteString("# Databricks notebook source\n")
+	_, err = f.WriteString("# Databricks notebook source\n")
+	require.NoError(t, err)
 	f.Close()
 }
 
diff --git a/bundle/config/resources_test.go b/bundle/config/resources_test.go
index 9ae73b22a..2d05acf3e 100644
--- a/bundle/config/resources_test.go
+++ b/bundle/config/resources_test.go
@@ -49,7 +49,8 @@ func TestCustomMarshallerIsImplemented(t *testing.T) {
 		// Eg: resource.Job implements MarshalJSON
 		v := reflect.Zero(vt.Elem()).Interface()
 		assert.NotPanics(t, func() {
-			json.Marshal(v)
+			_, err := json.Marshal(v)
+			assert.NoError(t, err)
 		}, "Resource %s does not have a custom marshaller", field.Name)
 
 		// Unmarshalling a *resourceStruct will panic if the resource does not have a custom unmarshaller
@@ -58,7 +59,8 @@ func TestCustomMarshallerIsImplemented(t *testing.T) {
 		// Eg: *resource.Job implements UnmarshalJSON
 		v = reflect.New(vt.Elem()).Interface()
 		assert.NotPanics(t, func() {
-			json.Unmarshal([]byte("{}"), v)
+			err := json.Unmarshal([]byte("{}"), v)
+			assert.NoError(t, err)
 		}, "Resource %s does not have a custom unmarshaller", field.Name)
 	}
 }
diff --git a/bundle/config/root_test.go b/bundle/config/root_test.go
index 9e6123534..fc1c148c3 100644
--- a/bundle/config/root_test.go
+++ b/bundle/config/root_test.go
@@ -100,7 +100,7 @@ func TestRootMergeTargetOverridesWithMode(t *testing.T) {
 			},
 		},
 	}
-	root.initializeDynamicValue()
+	require.NoError(t, root.initializeDynamicValue())
 	require.NoError(t, root.MergeTargetOverrides("development"))
 	assert.Equal(t, Development, root.Bundle.Mode)
 }
@@ -133,7 +133,7 @@ func TestRootMergeTargetOverridesWithVariables(t *testing.T) {
 			"complex": {
 				Type:        variable.VariableTypeComplex,
 				Description: "complex var",
-				Default: map[string]interface{}{
+				Default: map[string]any{
 					"key": "value",
 				},
 			},
@@ -148,7 +148,7 @@ func TestRootMergeTargetOverridesWithVariables(t *testing.T) {
 					"complex": {
 						Type:        "wrong",
 						Description: "wrong",
-						Default: map[string]interface{}{
+						Default: map[string]any{
 							"key1": "value1",
 						},
 					},
@@ -156,7 +156,7 @@ func TestRootMergeTargetOverridesWithVariables(t *testing.T) {
 			},
 		},
 	}
-	root.initializeDynamicValue()
+	require.NoError(t, root.initializeDynamicValue())
 	require.NoError(t, root.MergeTargetOverrides("development"))
 	assert.Equal(t, "bar", root.Variables["foo"].Default)
 	assert.Equal(t, "foo var", root.Variables["foo"].Description)
@@ -164,7 +164,7 @@ func TestRootMergeTargetOverridesWithVariables(t *testing.T) {
 	assert.Equal(t, "foo2", root.Variables["foo2"].Default)
 	assert.Equal(t, "foo2 var", root.Variables["foo2"].Description)
 
-	assert.Equal(t, map[string]interface{}{
+	assert.Equal(t, map[string]any{
 		"key1": "value1",
 	}, root.Variables["complex"].Default)
 	assert.Equal(t, "complex var", root.Variables["complex"].Description)
diff --git a/bundle/config/workspace_test.go b/bundle/config/workspace_test.go
index 3ef963253..384cc0a2c 100644
--- a/bundle/config/workspace_test.go
+++ b/bundle/config/workspace_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/databricks/cli/libs/databrickscfg"
 	"github.com/databricks/databricks-sdk-go/config"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func setupWorkspaceTest(t *testing.T) string {
@@ -42,11 +43,12 @@ func TestWorkspaceResolveProfileFromHost(t *testing.T) {
 		setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			Profile: "default",
 			Host:    "https://abc.cloud.databricks.com",
 			Token:   "123",
 		})
+		require.NoError(t, err)
 
 		client, err := w.Client()
 		assert.NoError(t, err)
@@ -57,12 +59,13 @@ func TestWorkspaceResolveProfileFromHost(t *testing.T) {
 		home := setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			ConfigFile: filepath.Join(home, "customcfg"),
 			Profile:    "custom",
 			Host:       "https://abc.cloud.databricks.com",
 			Token:      "123",
 		})
+		require.NoError(t, err)
 
 		t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(home, "customcfg"))
 		client, err := w.Client()
@@ -90,12 +93,13 @@ func TestWorkspaceVerifyProfileForHost(t *testing.T) {
 		setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			Profile: "abc",
 			Host:    "https://abc.cloud.databricks.com",
 		})
+		require.NoError(t, err)
 
-		_, err := w.Client()
+		_, err = w.Client()
 		assert.NoError(t, err)
 	})
 
@@ -103,12 +107,13 @@ func TestWorkspaceVerifyProfileForHost(t *testing.T) {
 		setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			Profile: "abc",
 			Host:    "https://def.cloud.databricks.com",
 		})
+		require.NoError(t, err)
 
-		_, err := w.Client()
+		_, err = w.Client()
 		assert.ErrorContains(t, err, "config host mismatch")
 	})
 
@@ -116,14 +121,15 @@ func TestWorkspaceVerifyProfileForHost(t *testing.T) {
 		home := setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			ConfigFile: filepath.Join(home, "customcfg"),
 			Profile:    "abc",
 			Host:       "https://abc.cloud.databricks.com",
 		})
+		require.NoError(t, err)
 
 		t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(home, "customcfg"))
-		_, err := w.Client()
+		_, err = w.Client()
 		assert.NoError(t, err)
 	})
 
@@ -131,14 +137,15 @@ func TestWorkspaceVerifyProfileForHost(t *testing.T) {
 		home := setupWorkspaceTest(t)
 
 		// This works if there is a config file with a matching profile.
-		databrickscfg.SaveToProfile(context.Background(), &config.Config{
+		err := databrickscfg.SaveToProfile(context.Background(), &config.Config{
 			ConfigFile: filepath.Join(home, "customcfg"),
 			Profile:    "abc",
 			Host:       "https://def.cloud.databricks.com",
 		})
+		require.NoError(t, err)
 
 		t.Setenv("DATABRICKS_CONFIG_FILE", filepath.Join(home, "customcfg"))
-		_, err := w.Client()
+		_, err = w.Client()
 		assert.ErrorContains(t, err, "config host mismatch")
 	})
 }
diff --git a/bundle/internal/bundletest/location.go b/bundle/internal/bundletest/location.go
index 2ffd621bf..5dcd9d78f 100644
--- a/bundle/internal/bundletest/location.go
+++ b/bundle/internal/bundletest/location.go
@@ -10,7 +10,7 @@ import (
 // with the path it is loaded from.
 func SetLocation(b *bundle.Bundle, prefix string, locations []dyn.Location) {
 	start := dyn.MustPathFromString(prefix)
-	b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
+	err := b.Config.Mutate(func(root dyn.Value) (dyn.Value, error) {
 		return dyn.Walk(root, func(p dyn.Path, v dyn.Value) (dyn.Value, error) {
 			// If the path has the given prefix, set the location.
 			if p.HasPrefix(start) {
@@ -27,4 +27,7 @@ func SetLocation(b *bundle.Bundle, prefix string, locations []dyn.Location) {
 			return v, dyn.ErrSkip
 		})
 	})
+	if err != nil {
+		panic("Mutate() failed: " + err.Error())
+	}
 }
diff --git a/bundle/internal/tf/codegen/go.mod b/bundle/internal/tf/codegen/go.mod
index 67ac4bbc7..508ff6ffb 100644
--- a/bundle/internal/tf/codegen/go.mod
+++ b/bundle/internal/tf/codegen/go.mod
@@ -1,24 +1,27 @@
 module github.com/databricks/cli/bundle/internal/tf/codegen
 
-go 1.21
+go 1.23
+
+toolchain go1.23.2
 
 require (
-	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/hc-install v0.6.3
-	github.com/hashicorp/terraform-exec v0.20.0
-	github.com/hashicorp/terraform-json v0.21.0
+	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/hc-install v0.9.0
+	github.com/hashicorp/terraform-exec v0.21.0
+	github.com/hashicorp/terraform-json v0.23.0
 	github.com/iancoleman/strcase v0.3.0
-	github.com/zclconf/go-cty v1.14.2
-	golang.org/x/exp v0.0.0-20240213143201-ec583247a57a
+	github.com/zclconf/go-cty v1.15.1
+	golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d
 )
 
 require (
-	github.com/ProtonMail/go-crypto v1.1.0-alpha.0 // indirect
+	github.com/ProtonMail/go-crypto v1.1.3 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/cloudflare/circl v1.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	golang.org/x/crypto v0.19.0 // indirect
-	golang.org/x/mod v0.15.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	golang.org/x/crypto v0.30.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 )
diff --git a/bundle/internal/tf/codegen/go.sum b/bundle/internal/tf/codegen/go.sum
index 7a4023ba5..df59b9d05 100644
--- a/bundle/internal/tf/codegen/go.sum
+++ b/bundle/internal/tf/codegen/go.sum
@@ -2,67 +2,79 @@ dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.0 h1:nHGfwXmFvJrSR9xu8qL7BkO4DqTHXE9N5vPhgY2I+j0=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.0/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
+github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/cloudflare/circl v1.5.0 h1:hxIWksrX6XN5a1L2TI/h53AGPhNHoUBo+TD1ms9+pys=
+github.com/cloudflare/circl v1.5.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
 github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
 github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
 github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
-github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
-github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
+github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.6.3 h1:yE/r1yJvWbtrJ0STwScgEnCanb0U9v7zp0Gbkmcoxqs=
-github.com/hashicorp/hc-install v0.6.3/go.mod h1:KamGdbodYzlufbWh4r9NRo8y6GLHWZP2GBtdnms1Ln0=
-github.com/hashicorp/terraform-exec v0.20.0 h1:DIZnPsqzPGuUnq6cH8jWcPunBfY+C+M8JyYF3vpnuEo=
-github.com/hashicorp/terraform-exec v0.20.0/go.mod h1:ckKGkJWbsNqFKV1itgMnE0hY9IYf1HoiekpuN0eWoDw=
-github.com/hashicorp/terraform-json v0.21.0 h1:9NQxbLNqPbEMze+S6+YluEdXgJmhQykRyRNd+zTI05U=
-github.com/hashicorp/terraform-json v0.21.0/go.mod h1:qdeBs11ovMzo5puhrRibdD6d2Dq6TyE/28JiU4tIQxk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
+github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/hc-install v0.9.0 h1:2dIk8LcvANwtv3QZLckxcjyF5w8KVtiMxu6G6eLhghE=
+github.com/hashicorp/hc-install v0.9.0/go.mod h1:+6vOP+mf3tuGgMApVYtmsnDoKWMDcFXeTxCACYZ8SFg=
+github.com/hashicorp/terraform-exec v0.21.0 h1:uNkLAe95ey5Uux6KJdua6+cv8asgILFVWkd/RG0D2XQ=
+github.com/hashicorp/terraform-exec v0.21.0/go.mod h1:1PPeMYou+KDUSSeRE9szMZ/oHf4fYUmB923Wzbq1ICg=
+github.com/hashicorp/terraform-json v0.23.0 h1:sniCkExU4iKtTADReHzACkk8fnpQXrdD2xoR+lppBkI=
+github.com/hashicorp/terraform-json v0.23.0/go.mod h1:MHdXbBAbSg0GvzuWazEGKAn/cyNfIB7mN6y7KJN6y2c=
 github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI=
 github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
-github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
+github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-github.com/zclconf/go-cty v1.14.2 h1:kTG7lqmBou0Zkx35r6HJHUQTvaRPr5bIAf3AoHS0izI=
-github.com/zclconf/go-cty v1.14.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/exp v0.0.0-20240213143201-ec583247a57a h1:HinSgX1tJRX3KsL//Gxynpw5CTOAIPhgL4W8PNiIpVE=
-golang.org/x/exp v0.0.0-20240213143201-ec583247a57a/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
-golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
-golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
+github.com/zclconf/go-cty v1.15.1 h1:RgQYm4j2EvoBRXOPxhUvxPzRrGDo1eCOhHXuGfrj5S0=
+github.com/zclconf/go-cty v1.15.1/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
+golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d h1:0olWaB5pg3+oychR51GUVCEsGkeCU/2JxjBgIo4f3M0=
+golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
diff --git a/bundle/internal/tf/codegen/schema/generate.go b/bundle/internal/tf/codegen/schema/generate.go
index de2d27225..c0253c9b4 100644
--- a/bundle/internal/tf/codegen/schema/generate.go
+++ b/bundle/internal/tf/codegen/schema/generate.go
@@ -15,10 +15,10 @@ import (
 )
 
 func (s *Schema) writeTerraformBlock(_ context.Context) error {
-	var body = map[string]interface{}{
-		"terraform": map[string]interface{}{
-			"required_providers": map[string]interface{}{
-				"databricks": map[string]interface{}{
+	var body = map[string]any{
+		"terraform": map[string]any{
+			"required_providers": map[string]any{
+				"databricks": map[string]any{
 					"source":  "databricks/databricks",
 					"version": ProviderVersion,
 				},
diff --git a/bundle/internal/tf/schema/root.go b/bundle/internal/tf/schema/root.go
index ebfbd7df7..2cadb8090 100644
--- a/bundle/internal/tf/schema/root.go
+++ b/bundle/internal/tf/schema/root.go
@@ -25,9 +25,9 @@ const ProviderVersion = "1.59.0"
 
 func NewRoot() *Root {
 	return &Root{
-		Terraform: map[string]interface{}{
-			"required_providers": map[string]interface{}{
-				"databricks": map[string]interface{}{
+		Terraform: map[string]any{
+			"required_providers": map[string]any{
+				"databricks": map[string]any{
 					"source":  ProviderSource,
 					"version": ProviderVersion,
 				},
diff --git a/bundle/permissions/mutator.go b/bundle/permissions/mutator.go
index b0d443e29..a97382300 100644
--- a/bundle/permissions/mutator.go
+++ b/bundle/permissions/mutator.go
@@ -17,6 +17,8 @@ const CAN_MANAGE = "CAN_MANAGE"
 const CAN_VIEW = "CAN_VIEW"
 const CAN_RUN = "CAN_RUN"
 
+var unsupportedResources = []string{"clusters", "volumes", "schemas", "quality_monitors", "registered_models"}
+
 var allowedLevels = []string{CAN_MANAGE, CAN_VIEW, CAN_RUN}
 var levelsMap = map[string](map[string]string){
 	"jobs": {
diff --git a/bundle/permissions/mutator_test.go b/bundle/permissions/mutator_test.go
index 5d0a1552b..1949cca37 100644
--- a/bundle/permissions/mutator_test.go
+++ b/bundle/permissions/mutator_test.go
@@ -2,12 +2,15 @@ package permissions
 
 import (
 	"context"
+	"fmt"
+	"slices"
 	"testing"
 
 	"github.com/databricks/cli/bundle"
 	"github.com/databricks/cli/bundle/config"
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -162,5 +165,20 @@ func TestWarningOnOverlapPermission(t *testing.T) {
 	require.Contains(t, b.Config.Resources.Jobs["job_2"].Permissions, resources.Permission{Level: "CAN_VIEW", UserName: "TestUser2"})
 	require.Contains(t, b.Config.Resources.Jobs["job_2"].Permissions, resources.Permission{Level: "CAN_MANAGE", UserName: "TestUser"})
 	require.Contains(t, b.Config.Resources.Jobs["job_2"].Permissions, resources.Permission{Level: "CAN_VIEW", GroupName: "TestGroup"})
-
+}
+
+func TestAllResourcesExplicitlyDefinedForPermissionsSupport(t *testing.T) {
+	r := config.Resources{}
+
+	for _, resource := range unsupportedResources {
+		_, ok := levelsMap[resource]
+		assert.False(t, ok, fmt.Sprintf("Resource %s is defined in both levelsMap and unsupportedResources", resource))
+	}
+
+	for _, resource := range r.AllResources() {
+		_, ok := levelsMap[resource.Description.PluralName]
+		if !slices.Contains(unsupportedResources, resource.Description.PluralName) && !ok {
+			assert.Fail(t, fmt.Sprintf("Resource %s is not explicitly defined in levelsMap or unsupportedResources", resource.Description.PluralName))
+		}
+	}
 }
diff --git a/bundle/render/render_text_output.go b/bundle/render/render_text_output.go
index 2f7affbf3..92dacb448 100644
--- a/bundle/render/render_text_output.go
+++ b/bundle/render/render_text_output.go
@@ -23,10 +23,10 @@ var renderFuncMap = template.FuncMap{
 	"yellow":  color.YellowString,
 	"magenta": color.MagentaString,
 	"cyan":    color.CyanString,
-	"bold": func(format string, a ...interface{}) string {
+	"bold": func(format string, a ...any) string {
 		return color.New(color.Bold).Sprintf(format, a...)
 	},
-	"italic": func(format string, a ...interface{}) string {
+	"italic": func(format string, a ...any) string {
 		return color.New(color.Italic).Sprintf(format, a...)
 	},
 }
diff --git a/bundle/render/render_text_output_test.go b/bundle/render/render_text_output_test.go
index 135d79dae..2b7f0e825 100644
--- a/bundle/render/render_text_output_test.go
+++ b/bundle/render/render_text_output_test.go
@@ -489,7 +489,8 @@ func TestRenderSummaryTemplate_nilBundle(t *testing.T) {
 	err := renderSummaryHeaderTemplate(writer, nil)
 	require.NoError(t, err)
 
-	io.WriteString(writer, buildTrailer(nil))
+	_, err = io.WriteString(writer, buildTrailer(nil))
+	require.NoError(t, err)
 
 	assert.Equal(t, "Validation OK!\n", writer.String())
 }
diff --git a/bundle/run/job_test.go b/bundle/run/job_test.go
index 369c546aa..2461f61bd 100644
--- a/bundle/run/job_test.go
+++ b/bundle/run/job_test.go
@@ -42,7 +42,8 @@ func TestConvertPythonParams(t *testing.T) {
 	opts := &Options{
 		Job: JobOptions{},
 	}
-	runner.convertPythonParams(opts)
+	err := runner.convertPythonParams(opts)
+	require.NoError(t, err)
 	require.NotContains(t, opts.Job.notebookParams, "__python_params")
 
 	opts = &Options{
@@ -50,7 +51,8 @@ func TestConvertPythonParams(t *testing.T) {
 			pythonParams: []string{"param1", "param2", "param3"},
 		},
 	}
-	runner.convertPythonParams(opts)
+	err = runner.convertPythonParams(opts)
+	require.NoError(t, err)
 	require.Contains(t, opts.Job.notebookParams, "__python_params")
 	require.Equal(t, opts.Job.notebookParams["__python_params"], `["param1","param2","param3"]`)
 }
diff --git a/bundle/run/output/task.go b/bundle/run/output/task.go
index 1beac17f3..402e4d66a 100644
--- a/bundle/run/output/task.go
+++ b/bundle/run/output/task.go
@@ -15,7 +15,7 @@ type LogsOutput struct {
 	LogsTruncated bool   `json:"logs_truncated"`
 }
 
-func structToString(val interface{}) (string, error) {
+func structToString(val any) (string, error) {
 	b, err := json.MarshalIndent(val, "", "  ")
 	if err != nil {
 		return "", err
diff --git a/bundle/tests/complex_variables_test.go b/bundle/tests/complex_variables_test.go
index 7a9a53a76..e68823c33 100644
--- a/bundle/tests/complex_variables_test.go
+++ b/bundle/tests/complex_variables_test.go
@@ -104,5 +104,5 @@ func TestComplexVariablesOverrideWithFullSyntax(t *testing.T) {
 	require.Empty(t, diags)
 
 	complexvar := b.Config.Variables["complexvar"].Value
-	require.Equal(t, map[string]interface{}{"key1": "1", "key2": "2", "key3": "3"}, complexvar)
+	require.Equal(t, map[string]any{"key1": "1", "key2": "2", "key3": "3"}, complexvar)
 }
diff --git a/cmd/auth/describe_test.go b/cmd/auth/describe_test.go
index d0260abc7..7f5f900d4 100644
--- a/cmd/auth/describe_test.go
+++ b/cmd/auth/describe_test.go
@@ -31,7 +31,8 @@ func TestGetWorkspaceAuthStatus(t *testing.T) {
 
 	cmd.Flags().String("host", "", "")
 	cmd.Flags().String("profile", "", "")
-	cmd.Flag("profile").Value.Set("my-profile")
+	err := cmd.Flag("profile").Value.Set("my-profile")
+	require.NoError(t, err)
 	cmd.Flag("profile").Changed = true
 
 	cfg := &config.Config{
@@ -39,14 +40,16 @@ func TestGetWorkspaceAuthStatus(t *testing.T) {
 	}
 	m.WorkspaceClient.Config = cfg
 	t.Setenv("DATABRICKS_AUTH_TYPE", "azure-cli")
-	config.ConfigAttributes.Configure(cfg)
+	err = config.ConfigAttributes.Configure(cfg)
+	require.NoError(t, err)
 
 	status, err := getAuthStatus(cmd, []string{}, showSensitive, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
-		config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+		err := config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
 			"host":      "https://test.com",
 			"token":     "test-token",
 			"auth_type": "azure-cli",
 		})
+		require.NoError(t, err)
 		return cfg, false, nil
 	})
 	require.NoError(t, err)
@@ -81,7 +84,8 @@ func TestGetWorkspaceAuthStatusError(t *testing.T) {
 
 	cmd.Flags().String("host", "", "")
 	cmd.Flags().String("profile", "", "")
-	cmd.Flag("profile").Value.Set("my-profile")
+	err := cmd.Flag("profile").Value.Set("my-profile")
+	require.NoError(t, err)
 	cmd.Flag("profile").Changed = true
 
 	cfg := &config.Config{
@@ -89,10 +93,11 @@ func TestGetWorkspaceAuthStatusError(t *testing.T) {
 	}
 	m.WorkspaceClient.Config = cfg
 	t.Setenv("DATABRICKS_AUTH_TYPE", "azure-cli")
-	config.ConfigAttributes.Configure(cfg)
+	err = config.ConfigAttributes.Configure(cfg)
+	require.NoError(t, err)
 
 	status, err := getAuthStatus(cmd, []string{}, showSensitive, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
-		config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+		err = config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
 			"host":      "https://test.com",
 			"token":     "test-token",
 			"auth_type": "azure-cli",
@@ -128,7 +133,8 @@ func TestGetWorkspaceAuthStatusSensitive(t *testing.T) {
 
 	cmd.Flags().String("host", "", "")
 	cmd.Flags().String("profile", "", "")
-	cmd.Flag("profile").Value.Set("my-profile")
+	err := cmd.Flag("profile").Value.Set("my-profile")
+	require.NoError(t, err)
 	cmd.Flag("profile").Changed = true
 
 	cfg := &config.Config{
@@ -136,10 +142,11 @@ func TestGetWorkspaceAuthStatusSensitive(t *testing.T) {
 	}
 	m.WorkspaceClient.Config = cfg
 	t.Setenv("DATABRICKS_AUTH_TYPE", "azure-cli")
-	config.ConfigAttributes.Configure(cfg)
+	err = config.ConfigAttributes.Configure(cfg)
+	require.NoError(t, err)
 
 	status, err := getAuthStatus(cmd, []string{}, showSensitive, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
-		config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+		err = config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
 			"host":      "https://test.com",
 			"token":     "test-token",
 			"auth_type": "azure-cli",
@@ -171,7 +178,8 @@ func TestGetAccountAuthStatus(t *testing.T) {
 
 	cmd.Flags().String("host", "", "")
 	cmd.Flags().String("profile", "", "")
-	cmd.Flag("profile").Value.Set("my-profile")
+	err := cmd.Flag("profile").Value.Set("my-profile")
+	require.NoError(t, err)
 	cmd.Flag("profile").Changed = true
 
 	cfg := &config.Config{
@@ -179,13 +187,14 @@ func TestGetAccountAuthStatus(t *testing.T) {
 	}
 	m.AccountClient.Config = cfg
 	t.Setenv("DATABRICKS_AUTH_TYPE", "azure-cli")
-	config.ConfigAttributes.Configure(cfg)
+	err = config.ConfigAttributes.Configure(cfg)
+	require.NoError(t, err)
 
 	wsApi := m.GetMockWorkspacesAPI()
 	wsApi.EXPECT().List(mock.Anything).Return(nil, nil)
 
 	status, err := getAuthStatus(cmd, []string{}, showSensitive, func(cmd *cobra.Command, args []string) (*config.Config, bool, error) {
-		config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
+		err = config.ConfigAttributes.ResolveFromStringMap(cfg, map[string]string{
 			"account_id": "test-account-id",
 			"username":   "test-user",
 			"host":       "https://test.com",
diff --git a/cmd/bundle/generate/dashboard_test.go b/cmd/bundle/generate/dashboard_test.go
index 6741e6a39..f1161950b 100644
--- a/cmd/bundle/generate/dashboard_test.go
+++ b/cmd/bundle/generate/dashboard_test.go
@@ -67,9 +67,10 @@ func TestDashboard_ExistingID_Nominal(t *testing.T) {
 	ctx := bundle.Context(context.Background(), b)
 	cmd := NewGenerateDashboardCommand()
 	cmd.SetContext(ctx)
-	cmd.Flag("existing-id").Value.Set("f00dcafe")
+	err := cmd.Flag("existing-id").Value.Set("f00dcafe")
+	require.NoError(t, err)
 
-	err := cmd.RunE(cmd, []string{})
+	err = cmd.RunE(cmd, []string{})
 	require.NoError(t, err)
 
 	// Assert the contents of the generated configuration
@@ -105,9 +106,10 @@ func TestDashboard_ExistingID_NotFound(t *testing.T) {
 	ctx := bundle.Context(context.Background(), b)
 	cmd := NewGenerateDashboardCommand()
 	cmd.SetContext(ctx)
-	cmd.Flag("existing-id").Value.Set("f00dcafe")
+	err := cmd.Flag("existing-id").Value.Set("f00dcafe")
+	require.NoError(t, err)
 
-	err := cmd.RunE(cmd, []string{})
+	err = cmd.RunE(cmd, []string{})
 	require.Error(t, err)
 }
 
@@ -137,9 +139,10 @@ func TestDashboard_ExistingPath_Nominal(t *testing.T) {
 	ctx := bundle.Context(context.Background(), b)
 	cmd := NewGenerateDashboardCommand()
 	cmd.SetContext(ctx)
-	cmd.Flag("existing-path").Value.Set("/path/to/dashboard")
+	err := cmd.Flag("existing-path").Value.Set("/path/to/dashboard")
+	require.NoError(t, err)
 
-	err := cmd.RunE(cmd, []string{})
+	err = cmd.RunE(cmd, []string{})
 	require.NoError(t, err)
 
 	// Assert the contents of the generated configuration
@@ -175,8 +178,9 @@ func TestDashboard_ExistingPath_NotFound(t *testing.T) {
 	ctx := bundle.Context(context.Background(), b)
 	cmd := NewGenerateDashboardCommand()
 	cmd.SetContext(ctx)
-	cmd.Flag("existing-path").Value.Set("/path/to/dashboard")
+	err := cmd.Flag("existing-path").Value.Set("/path/to/dashboard")
+	require.NoError(t, err)
 
-	err := cmd.RunE(cmd, []string{})
+	err = cmd.RunE(cmd, []string{})
 	require.Error(t, err)
 }
diff --git a/cmd/bundle/generate/generate_test.go b/cmd/bundle/generate/generate_test.go
index bc1549e64..33f166158 100644
--- a/cmd/bundle/generate/generate_test.go
+++ b/cmd/bundle/generate/generate_test.go
@@ -78,13 +78,13 @@ func TestGeneratePipelineCommand(t *testing.T) {
 	workspaceApi.EXPECT().Download(mock.Anything, "/test/file.py", mock.Anything).Return(pyContent, nil)
 
 	cmd.SetContext(bundle.Context(context.Background(), b))
-	cmd.Flag("existing-pipeline-id").Value.Set("test-pipeline")
+	require.NoError(t, cmd.Flag("existing-pipeline-id").Value.Set("test-pipeline"))
 
 	configDir := filepath.Join(root, "resources")
-	cmd.Flag("config-dir").Value.Set(configDir)
+	require.NoError(t, cmd.Flag("config-dir").Value.Set(configDir))
 
 	srcDir := filepath.Join(root, "src")
-	cmd.Flag("source-dir").Value.Set(srcDir)
+	require.NoError(t, cmd.Flag("source-dir").Value.Set(srcDir))
 
 	var key string
 	cmd.Flags().StringVar(&key, "key", "test_pipeline", "")
@@ -174,13 +174,13 @@ func TestGenerateJobCommand(t *testing.T) {
 	workspaceApi.EXPECT().Download(mock.Anything, "/test/notebook", mock.Anything).Return(notebookContent, nil)
 
 	cmd.SetContext(bundle.Context(context.Background(), b))
-	cmd.Flag("existing-job-id").Value.Set("1234")
+	require.NoError(t, cmd.Flag("existing-job-id").Value.Set("1234"))
 
 	configDir := filepath.Join(root, "resources")
-	cmd.Flag("config-dir").Value.Set(configDir)
+	require.NoError(t, cmd.Flag("config-dir").Value.Set(configDir))
 
 	srcDir := filepath.Join(root, "src")
-	cmd.Flag("source-dir").Value.Set(srcDir)
+	require.NoError(t, cmd.Flag("source-dir").Value.Set(srcDir))
 
 	var key string
 	cmd.Flags().StringVar(&key, "key", "test_job", "")
@@ -279,13 +279,13 @@ func TestGenerateJobCommandOldFileRename(t *testing.T) {
 	workspaceApi.EXPECT().Download(mock.Anything, "/test/notebook", mock.Anything).Return(notebookContent, nil)
 
 	cmd.SetContext(bundle.Context(context.Background(), b))
-	cmd.Flag("existing-job-id").Value.Set("1234")
+	require.NoError(t, cmd.Flag("existing-job-id").Value.Set("1234"))
 
 	configDir := filepath.Join(root, "resources")
-	cmd.Flag("config-dir").Value.Set(configDir)
+	require.NoError(t, cmd.Flag("config-dir").Value.Set(configDir))
 
 	srcDir := filepath.Join(root, "src")
-	cmd.Flag("source-dir").Value.Set(srcDir)
+	require.NoError(t, cmd.Flag("source-dir").Value.Set(srcDir))
 
 	var key string
 	cmd.Flags().StringVar(&key, "key", "test_job", "")
@@ -295,7 +295,7 @@ func TestGenerateJobCommandOldFileRename(t *testing.T) {
 	touchEmptyFile(t, oldFilename)
 
 	// Having an existing files require --force flag to regenerate them
-	cmd.Flag("force").Value.Set("true")
+	require.NoError(t, cmd.Flag("force").Value.Set("true"))
 
 	err := cmd.RunE(cmd, []string{})
 	require.NoError(t, err)
diff --git a/cmd/labs/github/ref_test.go b/cmd/labs/github/ref_test.go
index 2a9ffcc5b..cc27d1e81 100644
--- a/cmd/labs/github/ref_test.go
+++ b/cmd/labs/github/ref_test.go
@@ -7,12 +7,14 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestFileFromRef(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/databrickslabs/ucx/main/README.md" {
-			w.Write([]byte(`abc`))
+			_, err := w.Write([]byte(`abc`))
+			require.NoError(t, err)
 			return
 		}
 		t.Logf("Requested: %s", r.URL.Path)
@@ -31,7 +33,8 @@ func TestFileFromRef(t *testing.T) {
 func TestDownloadZipball(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/repos/databrickslabs/ucx/zipball/main" {
-			w.Write([]byte(`abc`))
+			_, err := w.Write([]byte(`abc`))
+			require.NoError(t, err)
 			return
 		}
 		t.Logf("Requested: %s", r.URL.Path)
diff --git a/cmd/labs/github/releases_test.go b/cmd/labs/github/releases_test.go
index ea24a1e2e..9c3d7a959 100644
--- a/cmd/labs/github/releases_test.go
+++ b/cmd/labs/github/releases_test.go
@@ -7,12 +7,14 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestLoadsReleasesForCLI(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/repos/databricks/cli/releases" {
-			w.Write([]byte(`[{"tag_name": "v1.2.3"}, {"tag_name": "v1.2.2"}]`))
+			_, err := w.Write([]byte(`[{"tag_name": "v1.2.3"}, {"tag_name": "v1.2.2"}]`))
+			require.NoError(t, err)
 			return
 		}
 		t.Logf("Requested: %s", r.URL.Path)
diff --git a/cmd/labs/github/repositories_test.go b/cmd/labs/github/repositories_test.go
index 4f2fef3e1..412b440bc 100644
--- a/cmd/labs/github/repositories_test.go
+++ b/cmd/labs/github/repositories_test.go
@@ -7,12 +7,14 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRepositories(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/users/databrickslabs/repos" {
-			w.Write([]byte(`[{"name": "x"}]`))
+			_, err := w.Write([]byte(`[{"name": "x"}]`))
+			require.NoError(t, err)
 			return
 		}
 		t.Logf("Requested: %s", r.URL.Path)
diff --git a/cmd/labs/project/installer_test.go b/cmd/labs/project/installer_test.go
index 1e45fafe6..c62d546b7 100644
--- a/cmd/labs/project/installer_test.go
+++ b/cmd/labs/project/installer_test.go
@@ -117,10 +117,10 @@ func installerContext(t *testing.T, server *httptest.Server) context.Context {
 
 func respondWithJSON(t *testing.T, w http.ResponseWriter, v any) {
 	raw, err := json.Marshal(v)
-	if err != nil {
-		require.NoError(t, err)
-	}
-	w.Write(raw)
+	require.NoError(t, err)
+
+	_, err = w.Write(raw)
+	require.NoError(t, err)
 }
 
 type fileTree struct {
@@ -167,19 +167,17 @@ func TestInstallerWorksForReleases(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/databrickslabs/blueprint/v0.3.15/labs.yml" {
 			raw, err := os.ReadFile("testdata/installed-in-home/.databricks/labs/blueprint/lib/labs.yml")
-			if err != nil {
-				panic(err)
-			}
-			w.Write(raw)
+			require.NoError(t, err)
+			_, err = w.Write(raw)
+			require.NoError(t, err)
 			return
 		}
 		if r.URL.Path == "/repos/databrickslabs/blueprint/zipball/v0.3.15" {
 			raw, err := zipballFromFolder("testdata/installed-in-home/.databricks/labs/blueprint/lib")
-			if err != nil {
-				panic(err)
-			}
+			require.NoError(t, err)
 			w.Header().Add("Content-Type", "application/octet-stream")
-			w.Write(raw)
+			_, err = w.Write(raw)
+			require.NoError(t, err)
 			return
 		}
 		if r.URL.Path == "/api/2.1/clusters/get" {
@@ -314,7 +312,10 @@ func TestInstallerWorksForDevelopment(t *testing.T) {
 	defer server.Close()
 
 	wd, _ := os.Getwd()
-	defer os.Chdir(wd)
+	defer func() {
+		err := os.Chdir(wd)
+		require.NoError(t, err)
+	}()
 
 	devDir := copyTestdata(t, "testdata/installed-in-home/.databricks/labs/blueprint/lib")
 	err := os.Chdir(devDir)
@@ -373,19 +374,17 @@ func TestUpgraderWorksForReleases(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/databrickslabs/blueprint/v0.4.0/labs.yml" {
 			raw, err := os.ReadFile("testdata/installed-in-home/.databricks/labs/blueprint/lib/labs.yml")
-			if err != nil {
-				panic(err)
-			}
-			w.Write(raw)
+			require.NoError(t, err)
+			_, err = w.Write(raw)
+			require.NoError(t, err)
 			return
 		}
 		if r.URL.Path == "/repos/databrickslabs/blueprint/zipball/v0.4.0" {
 			raw, err := zipballFromFolder("testdata/installed-in-home/.databricks/labs/blueprint/lib")
-			if err != nil {
-				panic(err)
-			}
+			require.NoError(t, err)
 			w.Header().Add("Content-Type", "application/octet-stream")
-			w.Write(raw)
+			_, err = w.Write(raw)
+			require.NoError(t, err)
 			return
 		}
 		if r.URL.Path == "/api/2.1/clusters/get" {
diff --git a/cmd/root/bundle_test.go b/cmd/root/bundle_test.go
index 301884287..72e0bef55 100644
--- a/cmd/root/bundle_test.go
+++ b/cmd/root/bundle_test.go
@@ -99,10 +99,11 @@ func TestBundleConfigureWithNonExistentProfileFlag(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("NOEXIST")
+	err := cmd.Flag("profile").Value.Set("NOEXIST")
+	require.NoError(t, err)
 	b := setupWithHost(t, cmd, "https://x.com")
 
-	_, err := b.InitializeWorkspaceClient()
+	_, err = b.InitializeWorkspaceClient()
 	assert.ErrorContains(t, err, "has no NOEXIST profile configured")
 }
 
@@ -110,10 +111,11 @@ func TestBundleConfigureWithMismatchedProfile(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("PROFILE-1")
+	err := cmd.Flag("profile").Value.Set("PROFILE-1")
+	require.NoError(t, err)
 	b := setupWithHost(t, cmd, "https://x.com")
 
-	_, err := b.InitializeWorkspaceClient()
+	_, err = b.InitializeWorkspaceClient()
 	assert.ErrorContains(t, err, "config host mismatch: profile uses host https://a.com, but CLI configured to use https://x.com")
 }
 
@@ -121,7 +123,8 @@ func TestBundleConfigureWithCorrectProfile(t *testing.T) {
 	testutil.CleanupEnvironment(t)
 
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("PROFILE-1")
+	err := cmd.Flag("profile").Value.Set("PROFILE-1")
+	require.NoError(t, err)
 	b := setupWithHost(t, cmd, "https://a.com")
 
 	client, err := b.InitializeWorkspaceClient()
@@ -146,7 +149,8 @@ func TestBundleConfigureWithProfileFlagAndEnvVariable(t *testing.T) {
 
 	t.Setenv("DATABRICKS_CONFIG_PROFILE", "NOEXIST")
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("PROFILE-1")
+	err := cmd.Flag("profile").Value.Set("PROFILE-1")
+	require.NoError(t, err)
 	b := setupWithHost(t, cmd, "https://a.com")
 
 	client, err := b.InitializeWorkspaceClient()
@@ -174,7 +178,8 @@ func TestBundleConfigureProfileFlag(t *testing.T) {
 
 	// The --profile flag takes precedence over the profile in the databricks.yml file
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("PROFILE-2")
+	err := cmd.Flag("profile").Value.Set("PROFILE-2")
+	require.NoError(t, err)
 	b := setupWithProfile(t, cmd, "PROFILE-1")
 
 	client, err := b.InitializeWorkspaceClient()
@@ -205,7 +210,8 @@ func TestBundleConfigureProfileFlagAndEnvVariable(t *testing.T) {
 	// The --profile flag takes precedence over the DATABRICKS_CONFIG_PROFILE environment variable
 	t.Setenv("DATABRICKS_CONFIG_PROFILE", "NOEXIST")
 	cmd := emptyCommand(t)
-	cmd.Flag("profile").Value.Set("PROFILE-2")
+	err := cmd.Flag("profile").Value.Set("PROFILE-2")
+	require.NoError(t, err)
 	b := setupWithProfile(t, cmd, "PROFILE-1")
 
 	client, err := b.InitializeWorkspaceClient()
diff --git a/cmd/root/progress_logger_test.go b/cmd/root/progress_logger_test.go
index 9dceee8d5..42ba1bdc6 100644
--- a/cmd/root/progress_logger_test.go
+++ b/cmd/root/progress_logger_test.go
@@ -33,27 +33,27 @@ func initializeProgressLoggerTest(t *testing.T) (
 
 func TestInitializeErrorOnIncompatibleConfig(t *testing.T) {
 	plt, logLevel, logFile, progressFormat := initializeProgressLoggerTest(t)
-	logLevel.Set("info")
-	logFile.Set("stderr")
-	progressFormat.Set("inplace")
+	require.NoError(t, logLevel.Set("info"))
+	require.NoError(t, logFile.Set("stderr"))
+	require.NoError(t, progressFormat.Set("inplace"))
 	_, err := plt.progressLoggerFlag.initializeContext(context.Background())
 	assert.ErrorContains(t, err, "inplace progress logging cannot be used when log-file is stderr")
 }
 
 func TestNoErrorOnDisabledLogLevel(t *testing.T) {
 	plt, logLevel, logFile, progressFormat := initializeProgressLoggerTest(t)
-	logLevel.Set("disabled")
-	logFile.Set("stderr")
-	progressFormat.Set("inplace")
+	require.NoError(t, logLevel.Set("disabled"))
+	require.NoError(t, logFile.Set("stderr"))
+	require.NoError(t, progressFormat.Set("inplace"))
 	_, err := plt.progressLoggerFlag.initializeContext(context.Background())
 	assert.NoError(t, err)
 }
 
 func TestNoErrorOnNonStderrLogFile(t *testing.T) {
 	plt, logLevel, logFile, progressFormat := initializeProgressLoggerTest(t)
-	logLevel.Set("info")
-	logFile.Set("stdout")
-	progressFormat.Set("inplace")
+	require.NoError(t, logLevel.Set("info"))
+	require.NoError(t, logFile.Set("stdout"))
+	require.NoError(t, progressFormat.Set("inplace"))
 	_, err := plt.progressLoggerFlag.initializeContext(context.Background())
 	assert.NoError(t, err)
 }
diff --git a/go.mod b/go.mod
index 7141ed768..d24f97f42 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	golang.org/x/mod v0.22.0
 	golang.org/x/oauth2 v0.24.0
 	golang.org/x/sync v0.9.0
-	golang.org/x/term v0.26.0
+	golang.org/x/term v0.27.0
 	golang.org/x/text v0.20.0
 	gopkg.in/ini.v1 v1.67.0 // Apache 2.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -64,7 +64,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	golang.org/x/crypto v0.24.0 // indirect
 	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	google.golang.org/api v0.182.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240521202816-d264139d666e // indirect
diff --git a/go.sum b/go.sum
index 5d2c53a37..a62dbdc6c 100644
--- a/go.sum
+++ b/go.sum
@@ -212,10 +212,10 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
-golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
diff --git a/internal/bundle/bind_resource_test.go b/internal/bundle/bind_resource_test.go
index 8cc5da536..bf80b3669 100644
--- a/internal/bundle/bind_resource_test.go
+++ b/internal/bundle/bind_resource_test.go
@@ -99,7 +99,8 @@ func TestAccAbortBind(t *testing.T) {
 	jobId := gt.createTestJob(ctx)
 	t.Cleanup(func() {
 		gt.destroyJob(ctx, jobId)
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	// Bind should fail because prompting is not possible.
diff --git a/internal/bundle/deploy_test.go b/internal/bundle/deploy_test.go
index 759e85de5..f4c6a440c 100644
--- a/internal/bundle/deploy_test.go
+++ b/internal/bundle/deploy_test.go
@@ -33,7 +33,8 @@ func setupUcSchemaBundle(t *testing.T, ctx context.Context, w *databricks.Worksp
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	// Assert the schema is created
@@ -190,7 +191,8 @@ func TestAccBundlePipelineRecreateWithoutAutoApprove(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	// Assert the pipeline is created
@@ -258,7 +260,8 @@ func TestAccDeployUcVolume(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	// Assert the volume is created successfully
diff --git a/internal/bundle/deployment_state_test.go b/internal/bundle/deployment_state_test.go
index 25f36d4a2..0ab99aeb3 100644
--- a/internal/bundle/deployment_state_test.go
+++ b/internal/bundle/deployment_state_test.go
@@ -46,7 +46,7 @@ func TestAccFilesAreSyncedCorrectlyWhenNoSnapshot(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, destroyBundle(t, ctx, bundleRoot))
 	})
 
 	remoteRoot := getBundleRemoteRootPath(w, t, uniqueId)
diff --git a/internal/bundle/environments_test.go b/internal/bundle/environments_test.go
index 5cffe8857..7c5b6db89 100644
--- a/internal/bundle/environments_test.go
+++ b/internal/bundle/environments_test.go
@@ -22,7 +22,8 @@ func TestAccPythonWheelTaskWithEnvironmentsDeployAndRun(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	out, err := runResource(t, ctx, bundleRoot, "some_other_job")
diff --git a/internal/bundle/python_wheel_test.go b/internal/bundle/python_wheel_test.go
index 846f14177..44f6200c1 100644
--- a/internal/bundle/python_wheel_test.go
+++ b/internal/bundle/python_wheel_test.go
@@ -29,7 +29,8 @@ func runPythonWheelTest(t *testing.T, templateName string, sparkVersion string,
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	out, err := runResource(t, ctx, bundleRoot, "some_other_job")
diff --git a/internal/bundle/spark_jar_test.go b/internal/bundle/spark_jar_test.go
index 4b469617c..cffcbb755 100644
--- a/internal/bundle/spark_jar_test.go
+++ b/internal/bundle/spark_jar_test.go
@@ -31,7 +31,8 @@ func runSparkJarTestCommon(t *testing.T, ctx context.Context, sparkVersion strin
 	require.NoError(t, err)
 
 	t.Cleanup(func() {
-		destroyBundle(t, ctx, bundleRoot)
+		err := destroyBundle(t, ctx, bundleRoot)
+		require.NoError(t, err)
 	})
 
 	out, err := runResource(t, ctx, bundleRoot, "jar_job")
diff --git a/internal/clusters_test.go b/internal/clusters_test.go
index 6daddcce3..2c41ebe1d 100644
--- a/internal/clusters_test.go
+++ b/internal/clusters_test.go
@@ -5,11 +5,13 @@ import (
 	"regexp"
 	"testing"
 
+	"github.com/databricks/cli/internal/acc"
+	"github.com/databricks/databricks-sdk-go/listing"
+	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-var clusterId string
-
 func TestAccClustersList(t *testing.T) {
 	t.Log(GetEnvOrSkipTest(t, "CLOUD_ENV"))
 
@@ -21,13 +23,14 @@ func TestAccClustersList(t *testing.T) {
 	assert.Equal(t, "", stderr.String())
 
 	idRegExp := regexp.MustCompile(`[0-9]{4}\-[0-9]{6}-[a-z0-9]{8}`)
-	clusterId = idRegExp.FindString(outStr)
+	clusterId := idRegExp.FindString(outStr)
 	assert.NotEmpty(t, clusterId)
 }
 
 func TestAccClustersGet(t *testing.T) {
 	t.Log(GetEnvOrSkipTest(t, "CLOUD_ENV"))
 
+	clusterId := findValidClusterID(t)
 	stdout, stderr := RequireSuccessfulRun(t, "clusters", "get", clusterId)
 	outStr := stdout.String()
 	assert.Contains(t, outStr, fmt.Sprintf(`"cluster_id":"%s"`, clusterId))
@@ -38,3 +41,22 @@ func TestClusterCreateErrorWhenNoArguments(t *testing.T) {
 	_, _, err := RequireErrorRun(t, "clusters", "create")
 	assert.Contains(t, err.Error(), "accepts 1 arg(s), received 0")
 }
+
+// findValidClusterID lists clusters in the workspace to find a valid cluster ID.
+func findValidClusterID(t *testing.T) string {
+	ctx, wt := acc.WorkspaceTest(t)
+	it := wt.W.Clusters.List(ctx, compute.ListClustersRequest{
+		FilterBy: &compute.ListClustersFilterBy{
+			ClusterSources: []compute.ClusterSource{
+				compute.ClusterSourceApi,
+				compute.ClusterSourceUi,
+			},
+		},
+	})
+
+	clusterIDs, err := listing.ToSliceN(ctx, it, 1)
+	require.NoError(t, err)
+	require.Len(t, clusterIDs, 1)
+
+	return clusterIDs[0].ClusterId
+}
diff --git a/internal/filer_test.go b/internal/filer_test.go
index a2760d911..4e6a15671 100644
--- a/internal/filer_test.go
+++ b/internal/filer_test.go
@@ -457,7 +457,7 @@ func TestAccFilerWorkspaceNotebook(t *testing.T) {
 
 			// Assert uploading a second time fails due to overwrite mode missing
 			err = f.Write(ctx, tc.name, strings.NewReader(tc.content2))
-			assert.ErrorIs(t, err, fs.ErrExist)
+			require.ErrorIs(t, err, fs.ErrExist)
 			assert.Regexp(t, regexp.MustCompile(`file already exists: .*/`+tc.nameWithoutExt+`$`), err.Error())
 
 			// Try uploading the notebook again with overwrite flag. This time it should succeed.
diff --git a/internal/helpers.go b/internal/helpers.go
index 7cd2b578b..a76ea92b5 100644
--- a/internal/helpers.go
+++ b/internal/helpers.go
@@ -176,7 +176,10 @@ func (t *cobraTestRunner) SendText(text string) {
 	if t.stdinW == nil {
 		panic("no standard input configured")
 	}
-	t.stdinW.Write([]byte(text + "\n"))
+	_, err := t.stdinW.Write([]byte(text + "\n"))
+	if err != nil {
+		panic("Failed to to write to t.stdinW")
+	}
 }
 
 func (t *cobraTestRunner) RunBackground() {
@@ -276,7 +279,7 @@ func (t *cobraTestRunner) Run() (bytes.Buffer, bytes.Buffer, error) {
 }
 
 // Like [require.Eventually] but errors if the underlying command has failed.
-func (c *cobraTestRunner) Eventually(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) {
+func (c *cobraTestRunner) Eventually(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...any) {
 	ch := make(chan bool, 1)
 
 	timer := time.NewTimer(waitFor)
@@ -496,9 +499,10 @@ func TemporaryUcVolume(t *testing.T, w *databricks.WorkspaceClient) string {
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		w.Schemas.Delete(ctx, catalog.DeleteSchemaRequest{
+		err := w.Schemas.Delete(ctx, catalog.DeleteSchemaRequest{
 			FullName: schema.FullName,
 		})
+		require.NoError(t, err)
 	})
 
 	// Create a volume
@@ -510,9 +514,10 @@ func TemporaryUcVolume(t *testing.T, w *databricks.WorkspaceClient) string {
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		w.Volumes.Delete(ctx, catalog.DeleteVolumeRequest{
+		err := w.Volumes.Delete(ctx, catalog.DeleteVolumeRequest{
 			Name: volume.FullName,
 		})
+		require.NoError(t, err)
 	})
 
 	return path.Join("/Volumes", "main", schema.Name, volume.Name)
diff --git a/internal/init_test.go b/internal/init_test.go
index 25bfc19da..08a808f45 100644
--- a/internal/init_test.go
+++ b/internal/init_test.go
@@ -39,7 +39,6 @@ func TestAccBundleInitErrorOnUnknownFields(t *testing.T) {
 //     make changes that can break the MLOps Stacks DAB. In which case we should
 //     skip this test until the MLOps Stacks DAB is updated to work again.
 func TestAccBundleInitOnMlopsStacks(t *testing.T) {
-	t.Parallel()
 	env := testutil.GetCloud(t).String()
 
 	tmpDir1 := t.TempDir()
@@ -59,7 +58,8 @@ func TestAccBundleInitOnMlopsStacks(t *testing.T) {
 	}
 	b, err := json.Marshal(initConfig)
 	require.NoError(t, err)
-	os.WriteFile(filepath.Join(tmpDir1, "config.json"), b, 0644)
+	err = os.WriteFile(filepath.Join(tmpDir1, "config.json"), b, 0644)
+	require.NoError(t, err)
 
 	// Run bundle init
 	assert.NoFileExists(t, filepath.Join(tmpDir2, "repo_name", projectName, "README.md"))
diff --git a/internal/locker_test.go b/internal/locker_test.go
index 3ae783d1b..62fcfc69f 100644
--- a/internal/locker_test.go
+++ b/internal/locker_test.go
@@ -133,7 +133,8 @@ func TestAccLock(t *testing.T) {
 
 	// assert on active locker content
 	var res map[string]string
-	json.Unmarshal(b, &res)
+	err = json.Unmarshal(b, &res)
+	require.NoError(t, err)
 	assert.NoError(t, err)
 	assert.Equal(t, "Khan", res["surname"])
 	assert.Equal(t, "Shah Rukh", res["name"])
diff --git a/internal/mocks/libs/filer/mock_filer.go b/internal/mocks/libs/filer/mock_filer.go
index d0d58cbda..c2e64cad4 100644
--- a/internal/mocks/libs/filer/mock_filer.go
+++ b/internal/mocks/libs/filer/mock_filer.go
@@ -28,11 +28,11 @@ func (_m *MockFiler) EXPECT() *MockFiler_Expecter {
 
 // Delete provides a mock function with given fields: ctx, path, mode
 func (_m *MockFiler) Delete(ctx context.Context, path string, mode ...filer.DeleteMode) error {
-	_va := make([]interface{}, len(mode))
+	_va := make([]any, len(mode))
 	for _i := range mode {
 		_va[_i] = mode[_i]
 	}
-	var _ca []interface{}
+	var _ca []any
 	_ca = append(_ca, ctx, path)
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
@@ -60,9 +60,9 @@ type MockFiler_Delete_Call struct {
 //   - ctx context.Context
 //   - path string
 //   - mode ...filer.DeleteMode
-func (_e *MockFiler_Expecter) Delete(ctx interface{}, path interface{}, mode ...interface{}) *MockFiler_Delete_Call {
+func (_e *MockFiler_Expecter) Delete(ctx any, path any, mode ...any) *MockFiler_Delete_Call {
 	return &MockFiler_Delete_Call{Call: _e.mock.On("Delete",
-		append([]interface{}{ctx, path}, mode...)...)}
+		append([]any{ctx, path}, mode...)...)}
 }
 
 func (_c *MockFiler_Delete_Call) Run(run func(ctx context.Context, path string, mode ...filer.DeleteMode)) *MockFiler_Delete_Call {
@@ -114,7 +114,7 @@ type MockFiler_Mkdir_Call struct {
 // Mkdir is a helper method to define mock.On call
 //   - ctx context.Context
 //   - path string
-func (_e *MockFiler_Expecter) Mkdir(ctx interface{}, path interface{}) *MockFiler_Mkdir_Call {
+func (_e *MockFiler_Expecter) Mkdir(ctx any, path any) *MockFiler_Mkdir_Call {
 	return &MockFiler_Mkdir_Call{Call: _e.mock.On("Mkdir", ctx, path)}
 }
 
@@ -173,7 +173,7 @@ type MockFiler_Read_Call struct {
 // Read is a helper method to define mock.On call
 //   - ctx context.Context
 //   - path string
-func (_e *MockFiler_Expecter) Read(ctx interface{}, path interface{}) *MockFiler_Read_Call {
+func (_e *MockFiler_Expecter) Read(ctx any, path any) *MockFiler_Read_Call {
 	return &MockFiler_Read_Call{Call: _e.mock.On("Read", ctx, path)}
 }
 
@@ -232,7 +232,7 @@ type MockFiler_ReadDir_Call struct {
 // ReadDir is a helper method to define mock.On call
 //   - ctx context.Context
 //   - path string
-func (_e *MockFiler_Expecter) ReadDir(ctx interface{}, path interface{}) *MockFiler_ReadDir_Call {
+func (_e *MockFiler_Expecter) ReadDir(ctx any, path any) *MockFiler_ReadDir_Call {
 	return &MockFiler_ReadDir_Call{Call: _e.mock.On("ReadDir", ctx, path)}
 }
 
@@ -291,7 +291,7 @@ type MockFiler_Stat_Call struct {
 // Stat is a helper method to define mock.On call
 //   - ctx context.Context
 //   - name string
-func (_e *MockFiler_Expecter) Stat(ctx interface{}, name interface{}) *MockFiler_Stat_Call {
+func (_e *MockFiler_Expecter) Stat(ctx any, name any) *MockFiler_Stat_Call {
 	return &MockFiler_Stat_Call{Call: _e.mock.On("Stat", ctx, name)}
 }
 
@@ -314,11 +314,11 @@ func (_c *MockFiler_Stat_Call) RunAndReturn(run func(context.Context, string) (f
 
 // Write provides a mock function with given fields: ctx, path, reader, mode
 func (_m *MockFiler) Write(ctx context.Context, path string, reader io.Reader, mode ...filer.WriteMode) error {
-	_va := make([]interface{}, len(mode))
+	_va := make([]any, len(mode))
 	for _i := range mode {
 		_va[_i] = mode[_i]
 	}
-	var _ca []interface{}
+	var _ca []any
 	_ca = append(_ca, ctx, path, reader)
 	_ca = append(_ca, _va...)
 	ret := _m.Called(_ca...)
@@ -347,9 +347,9 @@ type MockFiler_Write_Call struct {
 //   - path string
 //   - reader io.Reader
 //   - mode ...filer.WriteMode
-func (_e *MockFiler_Expecter) Write(ctx interface{}, path interface{}, reader interface{}, mode ...interface{}) *MockFiler_Write_Call {
+func (_e *MockFiler_Expecter) Write(ctx any, path any, reader any, mode ...any) *MockFiler_Write_Call {
 	return &MockFiler_Write_Call{Call: _e.mock.On("Write",
-		append([]interface{}{ctx, path, reader}, mode...)...)}
+		append([]any{ctx, path, reader}, mode...)...)}
 }
 
 func (_c *MockFiler_Write_Call) Run(run func(ctx context.Context, path string, reader io.Reader, mode ...filer.WriteMode)) *MockFiler_Write_Call {
diff --git a/internal/tags_test.go b/internal/tags_test.go
index 2dd3759ac..54039223f 100644
--- a/internal/tags_test.go
+++ b/internal/tags_test.go
@@ -47,7 +47,11 @@ func testTags(t *testing.T, tags map[string]string) error {
 
 	if resp != nil {
 		t.Cleanup(func() {
-			w.Jobs.DeleteByJobId(ctx, resp.JobId)
+			_ = w.Jobs.DeleteByJobId(ctx, resp.JobId)
+			// Cannot enable errchecking there, tests fail with:
+			//   Error: Received unexpected error:
+			//   Job 0 does not exist.
+			// require.NoError(t, err)
 		})
 	}
 
diff --git a/internal/testutil/env.go b/internal/testutil/env.go
index e1973ba82..7a7436f47 100644
--- a/internal/testutil/env.go
+++ b/internal/testutil/env.go
@@ -51,6 +51,10 @@ func GetEnvOrSkipTest(t *testing.T, name string) string {
 // Changes into specified directory for the duration of the test.
 // Returns the current working directory.
 func Chdir(t *testing.T, dir string) string {
+	// Prevent parallel execution when changing the working directory.
+	// t.Setenv automatically fails if t.Parallel is set.
+	t.Setenv("DO_NOT_RUN_IN_PARALLEL", "true")
+
 	wd, err := os.Getwd()
 	require.NoError(t, err)
 
diff --git a/libs/auth/oauth_test.go b/libs/auth/oauth_test.go
index fdf0d04bf..837ff4fee 100644
--- a/libs/auth/oauth_test.go
+++ b/libs/auth/oauth_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/databricks/databricks-sdk-go/httpclient/fixtures"
 	"github.com/databricks/databricks-sdk-go/qa"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 )
 
@@ -182,7 +183,8 @@ func TestChallenge(t *testing.T) {
 
 		state := <-browserOpened
 		resp, err := http.Get(fmt.Sprintf("http://%s?code=__THIS__&state=%s", appRedirectAddr, state))
-		assert.NoError(t, err)
+		require.NoError(t, err)
+		defer resp.Body.Close()
 		assert.Equal(t, 200, resp.StatusCode)
 
 		err = <-errc
@@ -221,7 +223,8 @@ func TestChallengeFailed(t *testing.T) {
 		resp, err := http.Get(fmt.Sprintf(
 			"http://%s?error=access_denied&error_description=Policy%%20evaluation%%20failed%%20for%%20this%%20request",
 			appRedirectAddr))
-		assert.NoError(t, err)
+		require.NoError(t, err)
+		defer resp.Body.Close()
 		assert.Equal(t, 400, resp.StatusCode)
 
 		err = <-errc
diff --git a/libs/cmdgroup/command.go b/libs/cmdgroup/command.go
index a2a776935..388dbe62b 100644
--- a/libs/cmdgroup/command.go
+++ b/libs/cmdgroup/command.go
@@ -100,7 +100,7 @@ func trimRightSpace(s string) string {
 }
 
 // tmpl executes the given template text on data, writing the result to w.
-func tmpl(w io.Writer, text string, data interface{}) error {
+func tmpl(w io.Writer, text string, data any) error {
 	t := template.New("top")
 	t.Funcs(templateFuncs)
 	template.Must(t.Parse(text))
diff --git a/libs/cmdgroup/command_test.go b/libs/cmdgroup/command_test.go
index f3e3fe6ab..2c248f09f 100644
--- a/libs/cmdgroup/command_test.go
+++ b/libs/cmdgroup/command_test.go
@@ -42,7 +42,8 @@ func TestCommandFlagGrouping(t *testing.T) {
 
 	buf := bytes.NewBuffer(nil)
 	cmd.SetOutput(buf)
-	cmd.Usage()
+	err := cmd.Usage()
+	require.NoError(t, err)
 
 	expected := `Usage:
   parent test [flags]
diff --git a/libs/cmdio/render.go b/libs/cmdio/render.go
index 72d95978a..c68ddca0d 100644
--- a/libs/cmdio/render.go
+++ b/libs/cmdio/render.go
@@ -297,10 +297,10 @@ var renderFuncMap = template.FuncMap{
 	"yellow":  color.YellowString,
 	"magenta": color.MagentaString,
 	"cyan":    color.CyanString,
-	"bold": func(format string, a ...interface{}) string {
+	"bold": func(format string, a ...any) string {
 		return color.New(color.Bold).Sprintf(format, a...)
 	},
-	"italic": func(format string, a ...interface{}) string {
+	"italic": func(format string, a ...any) string {
 		return color.New(color.Italic).Sprintf(format, a...)
 	},
 	"replace": strings.ReplaceAll,
diff --git a/libs/dyn/convert/normalize_test.go b/libs/dyn/convert/normalize_test.go
index ab0a1cec1..449c09075 100644
--- a/libs/dyn/convert/normalize_test.go
+++ b/libs/dyn/convert/normalize_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/databricks/cli/libs/diag"
 	"github.com/databricks/cli/libs/dyn"
 	assert "github.com/databricks/cli/libs/dyn/dynassert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestNormalizeStruct(t *testing.T) {
@@ -20,8 +21,8 @@ func TestNormalizeStruct(t *testing.T) {
 		"bar": dyn.V("baz"),
 	})
 
-	vout, err := Normalize(typ, vin)
-	assert.Empty(t, err)
+	vout, diags := Normalize(typ, vin)
+	assert.Empty(t, diags)
 	assert.Equal(t, vin, vout)
 }
 
@@ -37,14 +38,14 @@ func TestNormalizeStructElementDiagnostic(t *testing.T) {
 		"bar": dyn.V(map[string]dyn.Value{"an": dyn.V("error")}),
 	})
 
-	vout, err := Normalize(typ, vin)
-	assert.Len(t, err, 1)
+	vout, diags := Normalize(typ, vin)
+	assert.Len(t, diags, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity:  diag.Warning,
 		Summary:   `expected string, found map`,
 		Locations: []dyn.Location{{}},
 		Paths:     []dyn.Path{dyn.NewPath(dyn.Key("bar"))},
-	}, err[0])
+	}, diags[0])
 
 	// Elements that encounter an error during normalization are dropped.
 	assert.Equal(t, map[string]any{
@@ -60,17 +61,20 @@ func TestNormalizeStructUnknownField(t *testing.T) {
 	var typ Tmp
 
 	m := dyn.NewMapping()
-	m.Set(dyn.V("foo"), dyn.V("val-foo"))
+	err := m.Set(dyn.V("foo"), dyn.V("val-foo"))
+	require.NoError(t, err)
+
 	// Set the unknown field, with location information.
-	m.Set(dyn.NewValue("bar", []dyn.Location{
+	err = m.Set(dyn.NewValue("bar", []dyn.Location{
 		{File: "hello.yaml", Line: 1, Column: 1},
 		{File: "world.yaml", Line: 2, Column: 2},
 	}), dyn.V("var-bar"))
+	require.NoError(t, err)
 
 	vin := dyn.V(m)
 
-	vout, err := Normalize(typ, vin)
-	assert.Len(t, err, 1)
+	vout, diags := Normalize(typ, vin)
+	assert.Len(t, diags, 1)
 	assert.Equal(t, diag.Diagnostic{
 		Severity: diag.Warning,
 		Summary:  `unknown field: bar`,
@@ -80,7 +84,7 @@ func TestNormalizeStructUnknownField(t *testing.T) {
 			{File: "world.yaml", Line: 2, Column: 2},
 		},
 		Paths: []dyn.Path{dyn.EmptyPath},
-	}, err[0])
+	}, diags[0])
 
 	// The field that can be mapped to the struct field is retained.
 	assert.Equal(t, map[string]any{
diff --git a/libs/dyn/dynassert/assert.go b/libs/dyn/dynassert/assert.go
index f667b08c7..ebdba1214 100644
--- a/libs/dyn/dynassert/assert.go
+++ b/libs/dyn/dynassert/assert.go
@@ -5,7 +5,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Equal(t assert.TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
+func Equal(t assert.TestingT, expected any, actual any, msgAndArgs ...any) bool {
 	ev, eok := expected.(dyn.Value)
 	av, aok := actual.(dyn.Value)
 	if eok && aok && ev.IsValid() && av.IsValid() {
@@ -32,86 +32,86 @@ func Equal(t assert.TestingT, expected interface{}, actual interface{}, msgAndAr
 	return assert.Equal(t, expected, actual, msgAndArgs...)
 }
 
-func EqualValues(t assert.TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
+func EqualValues(t assert.TestingT, expected, actual any, msgAndArgs ...any) bool {
 	return assert.EqualValues(t, expected, actual, msgAndArgs...)
 }
 
-func NotEqual(t assert.TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
+func NotEqual(t assert.TestingT, expected any, actual any, msgAndArgs ...any) bool {
 	return assert.NotEqual(t, expected, actual, msgAndArgs...)
 }
 
-func Len(t assert.TestingT, object interface{}, length int, msgAndArgs ...interface{}) bool {
+func Len(t assert.TestingT, object any, length int, msgAndArgs ...any) bool {
 	return assert.Len(t, object, length, msgAndArgs...)
 }
 
-func Empty(t assert.TestingT, object interface{}, msgAndArgs ...interface{}) bool {
+func Empty(t assert.TestingT, object any, msgAndArgs ...any) bool {
 	return assert.Empty(t, object, msgAndArgs...)
 }
 
-func Nil(t assert.TestingT, object interface{}, msgAndArgs ...interface{}) bool {
+func Nil(t assert.TestingT, object any, msgAndArgs ...any) bool {
 	return assert.Nil(t, object, msgAndArgs...)
 }
 
-func NotNil(t assert.TestingT, object interface{}, msgAndArgs ...interface{}) bool {
+func NotNil(t assert.TestingT, object any, msgAndArgs ...any) bool {
 	return assert.NotNil(t, object, msgAndArgs...)
 }
 
-func NoError(t assert.TestingT, err error, msgAndArgs ...interface{}) bool {
+func NoError(t assert.TestingT, err error, msgAndArgs ...any) bool {
 	return assert.NoError(t, err, msgAndArgs...)
 }
 
-func Error(t assert.TestingT, err error, msgAndArgs ...interface{}) bool {
+func Error(t assert.TestingT, err error, msgAndArgs ...any) bool {
 	return assert.Error(t, err, msgAndArgs...)
 }
 
-func EqualError(t assert.TestingT, theError error, errString string, msgAndArgs ...interface{}) bool {
+func EqualError(t assert.TestingT, theError error, errString string, msgAndArgs ...any) bool {
 	return assert.EqualError(t, theError, errString, msgAndArgs...)
 }
 
-func ErrorContains(t assert.TestingT, theError error, contains string, msgAndArgs ...interface{}) bool {
+func ErrorContains(t assert.TestingT, theError error, contains string, msgAndArgs ...any) bool {
 	return assert.ErrorContains(t, theError, contains, msgAndArgs...)
 }
 
-func ErrorIs(t assert.TestingT, theError, target error, msgAndArgs ...interface{}) bool {
+func ErrorIs(t assert.TestingT, theError, target error, msgAndArgs ...any) bool {
 	return assert.ErrorIs(t, theError, target, msgAndArgs...)
 }
 
-func True(t assert.TestingT, value bool, msgAndArgs ...interface{}) bool {
+func True(t assert.TestingT, value bool, msgAndArgs ...any) bool {
 	return assert.True(t, value, msgAndArgs...)
 }
 
-func False(t assert.TestingT, value bool, msgAndArgs ...interface{}) bool {
+func False(t assert.TestingT, value bool, msgAndArgs ...any) bool {
 	return assert.False(t, value, msgAndArgs...)
 }
 
-func Contains(t assert.TestingT, list interface{}, element interface{}, msgAndArgs ...interface{}) bool {
+func Contains(t assert.TestingT, list any, element any, msgAndArgs ...any) bool {
 	return assert.Contains(t, list, element, msgAndArgs...)
 }
 
-func NotContains(t assert.TestingT, list interface{}, element interface{}, msgAndArgs ...interface{}) bool {
+func NotContains(t assert.TestingT, list any, element any, msgAndArgs ...any) bool {
 	return assert.NotContains(t, list, element, msgAndArgs...)
 }
 
-func ElementsMatch(t assert.TestingT, listA, listB interface{}, msgAndArgs ...interface{}) bool {
+func ElementsMatch(t assert.TestingT, listA, listB any, msgAndArgs ...any) bool {
 	return assert.ElementsMatch(t, listA, listB, msgAndArgs...)
 }
 
-func Panics(t assert.TestingT, f func(), msgAndArgs ...interface{}) bool {
+func Panics(t assert.TestingT, f func(), msgAndArgs ...any) bool {
 	return assert.Panics(t, f, msgAndArgs...)
 }
 
-func PanicsWithValue(t assert.TestingT, expected interface{}, f func(), msgAndArgs ...interface{}) bool {
+func PanicsWithValue(t assert.TestingT, expected any, f func(), msgAndArgs ...any) bool {
 	return assert.PanicsWithValue(t, expected, f, msgAndArgs...)
 }
 
-func PanicsWithError(t assert.TestingT, errString string, f func(), msgAndArgs ...interface{}) bool {
+func PanicsWithError(t assert.TestingT, errString string, f func(), msgAndArgs ...any) bool {
 	return assert.PanicsWithError(t, errString, f, msgAndArgs...)
 }
 
-func NotPanics(t assert.TestingT, f func(), msgAndArgs ...interface{}) bool {
+func NotPanics(t assert.TestingT, f func(), msgAndArgs ...any) bool {
 	return assert.NotPanics(t, f, msgAndArgs...)
 }
 
-func JSONEq(t assert.TestingT, expected string, actual string, msgAndArgs ...interface{}) bool {
+func JSONEq(t assert.TestingT, expected string, actual string, msgAndArgs ...any) bool {
 	return assert.JSONEq(t, expected, actual, msgAndArgs...)
 }
diff --git a/libs/dyn/jsonsaver/marshal_test.go b/libs/dyn/jsonsaver/marshal_test.go
index 0b6a34283..e8897ea49 100644
--- a/libs/dyn/jsonsaver/marshal_test.go
+++ b/libs/dyn/jsonsaver/marshal_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/databricks/cli/libs/dyn"
 	assert "github.com/databricks/cli/libs/dyn/dynassert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestMarshal_String(t *testing.T) {
@@ -44,8 +45,8 @@ func TestMarshal_Time(t *testing.T) {
 
 func TestMarshal_Map(t *testing.T) {
 	m := dyn.NewMapping()
-	m.Set(dyn.V("key1"), dyn.V("value1"))
-	m.Set(dyn.V("key2"), dyn.V("value2"))
+	require.NoError(t, m.Set(dyn.V("key1"), dyn.V("value1")))
+	require.NoError(t, m.Set(dyn.V("key2"), dyn.V("value2")))
 
 	b, err := Marshal(dyn.V(m))
 	if assert.NoError(t, err) {
@@ -66,16 +67,16 @@ func TestMarshal_Sequence(t *testing.T) {
 
 func TestMarshal_Complex(t *testing.T) {
 	map1 := dyn.NewMapping()
-	map1.Set(dyn.V("str1"), dyn.V("value1"))
-	map1.Set(dyn.V("str2"), dyn.V("value2"))
+	require.NoError(t, map1.Set(dyn.V("str1"), dyn.V("value1")))
+	require.NoError(t, map1.Set(dyn.V("str2"), dyn.V("value2")))
 
 	seq1 := []dyn.Value{}
 	seq1 = append(seq1, dyn.V("value1"))
 	seq1 = append(seq1, dyn.V("value2"))
 
 	root := dyn.NewMapping()
-	root.Set(dyn.V("map1"), dyn.V(map1))
-	root.Set(dyn.V("seq1"), dyn.V(seq1))
+	require.NoError(t, root.Set(dyn.V("map1"), dyn.V(map1)))
+	require.NoError(t, root.Set(dyn.V("seq1"), dyn.V(seq1)))
 
 	// Marshal without indent.
 	b, err := Marshal(dyn.V(root))
diff --git a/libs/dyn/merge/override_test.go b/libs/dyn/merge/override_test.go
index 264c32e5e..4af937774 100644
--- a/libs/dyn/merge/override_test.go
+++ b/libs/dyn/merge/override_test.go
@@ -432,10 +432,12 @@ func TestOverride_PreserveMappingKeys(t *testing.T) {
 	rightValueLocation := dyn.Location{File: "right.yml", Line: 3, Column: 1}
 
 	left := dyn.NewMapping()
-	left.Set(dyn.NewValue("a", []dyn.Location{leftKeyLocation}), dyn.NewValue(42, []dyn.Location{leftValueLocation}))
+	err := left.Set(dyn.NewValue("a", []dyn.Location{leftKeyLocation}), dyn.NewValue(42, []dyn.Location{leftValueLocation}))
+	require.NoError(t, err)
 
 	right := dyn.NewMapping()
-	right.Set(dyn.NewValue("a", []dyn.Location{rightKeyLocation}), dyn.NewValue(7, []dyn.Location{rightValueLocation}))
+	err = right.Set(dyn.NewValue("a", []dyn.Location{rightKeyLocation}), dyn.NewValue(7, []dyn.Location{rightValueLocation}))
+	require.NoError(t, err)
 
 	state, visitor := createVisitor(visitorOpts{})
 
diff --git a/libs/dyn/yamlloader/loader.go b/libs/dyn/yamlloader/loader.go
index b4aaf0a74..a77ee0744 100644
--- a/libs/dyn/yamlloader/loader.go
+++ b/libs/dyn/yamlloader/loader.go
@@ -14,7 +14,7 @@ type loader struct {
 	path string
 }
 
-func errorf(loc dyn.Location, format string, args ...interface{}) error {
+func errorf(loc dyn.Location, format string, args ...any) error {
 	return fmt.Errorf("yaml (%s): %s", loc, fmt.Sprintf(format, args...))
 }
 
diff --git a/libs/errs/aggregate.go b/libs/errs/aggregate.go
index b6bab0ef7..088364948 100644
--- a/libs/errs/aggregate.go
+++ b/libs/errs/aggregate.go
@@ -59,7 +59,7 @@ func (ec errorChain) Unwrap() error {
 	return ec[1:]
 }
 
-func (ec errorChain) As(target interface{}) bool {
+func (ec errorChain) As(target any) bool {
 	return errors.As(ec[0], target)
 }
 
diff --git a/libs/exec/exec_test.go b/libs/exec/exec_test.go
index ad54601d0..e75c158bd 100644
--- a/libs/exec/exec_test.go
+++ b/libs/exec/exec_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestExecutorWithSimpleInput(t *testing.T) {
@@ -86,9 +87,11 @@ func testExecutorWithShell(t *testing.T, shell string) {
 	tmpDir := t.TempDir()
 	t.Setenv("PATH", tmpDir)
 	if runtime.GOOS == "windows" {
-		os.Symlink(p, fmt.Sprintf("%s/%s.exe", tmpDir, shell))
+		err = os.Symlink(p, fmt.Sprintf("%s/%s.exe", tmpDir, shell))
+		require.NoError(t, err)
 	} else {
-		os.Symlink(p, fmt.Sprintf("%s/%s", tmpDir, shell))
+		err = os.Symlink(p, fmt.Sprintf("%s/%s", tmpDir, shell))
+		require.NoError(t, err)
 	}
 
 	executor, err := NewCommandExecutor(".")
diff --git a/libs/flags/json_flag_test.go b/libs/flags/json_flag_test.go
index 77530086a..564d4f813 100644
--- a/libs/flags/json_flag_test.go
+++ b/libs/flags/json_flag_test.go
@@ -62,7 +62,8 @@ func TestJsonFlagFile(t *testing.T) {
 	{
 		f, err := os.Create(path.Join(t.TempDir(), "file"))
 		require.NoError(t, err)
-		f.Write(payload)
+		_, err = f.Write(payload)
+		require.NoError(t, err)
 		f.Close()
 		fpath = f.Name()
 	}
diff --git a/libs/git/fileset_test.go b/libs/git/fileset_test.go
index f4fd931fd..6d239edf5 100644
--- a/libs/git/fileset_test.go
+++ b/libs/git/fileset_test.go
@@ -56,7 +56,8 @@ func TestFileSetAddsCacheDirToGitIgnore(t *testing.T) {
 	projectDir := t.TempDir()
 	fileSet, err := NewFileSetAtRoot(vfs.MustNew(projectDir))
 	require.NoError(t, err)
-	fileSet.EnsureValidGitIgnoreExists()
+	err = fileSet.EnsureValidGitIgnoreExists()
+	require.NoError(t, err)
 
 	gitIgnorePath := filepath.Join(projectDir, ".gitignore")
 	assert.FileExists(t, gitIgnorePath)
@@ -74,7 +75,8 @@ func TestFileSetDoesNotCacheDirToGitIgnoreIfAlreadyPresent(t *testing.T) {
 	err = os.WriteFile(gitIgnorePath, []byte(".databricks"), 0o644)
 	require.NoError(t, err)
 
-	fileSet.EnsureValidGitIgnoreExists()
+	err = fileSet.EnsureValidGitIgnoreExists()
+	require.NoError(t, err)
 
 	b, err := os.ReadFile(gitIgnorePath)
 	require.NoError(t, err)
diff --git a/libs/git/reference_test.go b/libs/git/reference_test.go
index 194d79333..bfa0e50e5 100644
--- a/libs/git/reference_test.go
+++ b/libs/git/reference_test.go
@@ -54,7 +54,8 @@ func TestReferenceLoadingForObjectID(t *testing.T) {
 	f, err := os.Create(filepath.Join(tmp, "HEAD"))
 	require.NoError(t, err)
 	defer f.Close()
-	f.WriteString(strings.Repeat("e", 40) + "\r\n")
+	_, err = f.WriteString(strings.Repeat("e", 40) + "\r\n")
+	require.NoError(t, err)
 
 	ref, err := LoadReferenceFile(vfs.MustNew(tmp), "HEAD")
 	assert.NoError(t, err)
@@ -67,7 +68,8 @@ func TestReferenceLoadingForReference(t *testing.T) {
 	f, err := os.OpenFile(filepath.Join(tmp, "HEAD"), os.O_CREATE|os.O_WRONLY, os.ModePerm)
 	require.NoError(t, err)
 	defer f.Close()
-	f.WriteString("ref: refs/heads/foo\n")
+	_, err = f.WriteString("ref: refs/heads/foo\n")
+	require.NoError(t, err)
 
 	ref, err := LoadReferenceFile(vfs.MustNew(tmp), "HEAD")
 	assert.NoError(t, err)
@@ -80,7 +82,8 @@ func TestReferenceLoadingFailsForInvalidContent(t *testing.T) {
 	f, err := os.OpenFile(filepath.Join(tmp, "HEAD"), os.O_CREATE|os.O_WRONLY, os.ModePerm)
 	require.NoError(t, err)
 	defer f.Close()
-	f.WriteString("abc")
+	_, err = f.WriteString("abc")
+	require.NoError(t, err)
 
 	_, err = LoadReferenceFile(vfs.MustNew(tmp), "HEAD")
 	assert.ErrorContains(t, err, "unknown format for git HEAD")
diff --git a/libs/git/repository_test.go b/libs/git/repository_test.go
index 93d9a03dc..474880e27 100644
--- a/libs/git/repository_test.go
+++ b/libs/git/repository_test.go
@@ -27,7 +27,7 @@ func newTestRepository(t *testing.T) *testRepository {
 	require.NoError(t, err)
 	defer f1.Close()
 
-	f1.WriteString(
+	_, err = f1.WriteString(
 		`[core]
 	repositoryformatversion = 0
 	filemode = true
@@ -36,6 +36,7 @@ func newTestRepository(t *testing.T) *testRepository {
 	ignorecase = true
 	precomposeunicode = true
 `)
+	require.NoError(t, err)
 
 	f2, err := os.Create(filepath.Join(tmp, ".git", "HEAD"))
 	require.NoError(t, err)
diff --git a/libs/jsonschema/from_type_test.go b/libs/jsonschema/from_type_test.go
index 174ffad88..cdfdcfd10 100644
--- a/libs/jsonschema/from_type_test.go
+++ b/libs/jsonschema/from_type_test.go
@@ -11,10 +11,10 @@ import (
 
 func TestFromTypeBasic(t *testing.T) {
 	type myStruct struct {
-		S             string      `json:"s"`
-		I             *int        `json:"i,omitempty"`
-		V             interface{} `json:"v,omitempty"`
-		TriplePointer ***int      `json:"triple_pointer,omitempty"`
+		S             string `json:"s"`
+		I             *int   `json:"i,omitempty"`
+		V             any    `json:"v,omitempty"`
+		TriplePointer ***int `json:"triple_pointer,omitempty"`
 
 		// These fields should be ignored in the resulting schema.
 		NotAnnotated     string
@@ -403,7 +403,8 @@ func TestFromTypeError(t *testing.T) {
 	// Maps with non-string keys should panic.
 	type mapOfInts map[int]int
 	assert.PanicsWithValue(t, "found map with non-string key: int", func() {
-		FromType(reflect.TypeOf(mapOfInts{}), nil)
+		_, err := FromType(reflect.TypeOf(mapOfInts{}), nil)
+		require.NoError(t, err)
 	})
 
 	// Unsupported types should return an error.
diff --git a/libs/process/stub_test.go b/libs/process/stub_test.go
index 65f59f817..81afa3a89 100644
--- a/libs/process/stub_test.go
+++ b/libs/process/stub_test.go
@@ -43,8 +43,14 @@ func TestStubCallback(t *testing.T) {
 	ctx := context.Background()
 	ctx, stub := process.WithStub(ctx)
 	stub.WithCallback(func(cmd *exec.Cmd) error {
-		cmd.Stderr.Write([]byte("something..."))
-		cmd.Stdout.Write([]byte("else..."))
+		_, err := cmd.Stderr.Write([]byte("something..."))
+		if err != nil {
+			return err
+		}
+		_, err = cmd.Stdout.Write([]byte("else..."))
+		if err != nil {
+			return err
+		}
 		return fmt.Errorf("yep")
 	})
 
diff --git a/libs/python/interpreters_unix_test.go b/libs/python/interpreters_unix_test.go
index e2b0a5a1c..b5229c2ac 100644
--- a/libs/python/interpreters_unix_test.go
+++ b/libs/python/interpreters_unix_test.go
@@ -34,7 +34,8 @@ func TestFilteringInterpreters(t *testing.T) {
 	rogueBin := filepath.Join(t.TempDir(), "rogue-bin")
 	err := os.Mkdir(rogueBin, 0o777)
 	assert.NoError(t, err)
-	os.Chmod(rogueBin, 0o777)
+	err = os.Chmod(rogueBin, 0o777)
+	assert.NoError(t, err)
 
 	raw, err := os.ReadFile("testdata/world-writeable/python8.4")
 	assert.NoError(t, err)