feat: enable full validation for configs and locks

[dmcilvaney]

Enable full lock validation by default

Removes the AZLDEV_ENABLE_LOCK_VALIDATION env var rollout gate. Lock file validation is now always-on for consumer commands. Missing or stale locks produce a hard error with a fix suggestion.

Validation policy by command

Command	Validation	Reason
build, render, query, prepare-sources, diff-sources	ON	Consumers — locks must exist
update	OFF	Lock writer — creates/refreshes locks
list	OFF	Read-only — always works
changed	OFF	Inspects historical refs

Key changes

Validation always-on:

• AZLDEV_ENABLE_LOCK_VALIDATION env var removed — validation is unconditional
• SkipLockValidation moved from CLI handlers into UpdateComponents, ListComponentConfigs, ChangedComponents so programmatic callers get correct behavior
• --skip-lock-validation hidden on update/list/changed (always overridden internally)
• Per-component snapshot rejection now unconditional (was gated behind same env var)
• All TODO(lockfiles) comments removed

Source provider cleanup:

• Lock shortcut removed from FedoraSourcesProviderImpl.ResolveIdentity — always resolves from upstream
• EffectiveUpstreamCommit fallback to Spec.UpstreamCommit kept for --skip-lock-validation users

Test infrastructure:

• TestEnv.AddUpstreamComponent(t, name) — registers component + writes lock
• TestEnv.WriteDefaultLock(t, name) — writes minimal valid lock for custom configs
• Resolver tests updated to write locks or skip validation as appropriate

Scenario test fix:

• Build scenario test now runs component update -a before build (lock validation requires it)
• WithPreCommand(...string) option added to ProjectTest with shell-safe quoting

[Copilot]

Pull request overview

This PR removes the rollout gating for lock/config validation and makes lock-file consistency checks the default behavior during component resolution, while also renaming the “source identity” APIs to better reflect what they do.

Changes:

• Enable default-on lock validation (removing the prior env-var gate) and adjust commands that should skip validation (e.g., update/list/changed) to do so explicitly.
• Rename identity resolution APIs from Resolve* to Calculate* across SourceManager and upstream providers, updating call sites and mocks.
• Improve synthetic-history behavior by falling back to the on-disk lock when the lock file isn’t yet committed.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/providers/sourceproviders/sourceproviders_test/sourcemanager_mocks.go	Regenerated gomock for SourceManager to reflect CalculateSourceIdentity rename.
internal/providers/sourceproviders/sourcemanager.go	Renames identity APIs and updates upstream identity resolution to call provider CalculateSourceIdentity.
internal/providers/sourceproviders/sourcemanager_test.go	Updates tests to match CalculateSourceIdentity rename.
internal/providers/sourceproviders/rpmcontentsprovider.go	Renames provider method to CalculateSourceIdentity.
internal/providers/sourceproviders/identityprovider_test.go	Updates provider tests and adjusts expectations around locked-data behavior.
internal/providers/sourceproviders/fedorasourceprovider.go	Renames method and changes semantics to always resolve from upstream (no locked short-circuit).
internal/projectconfig/configfile.go	Makes per-component upstream-distro.snapshot rejection unconditional (no env gate).
internal/projectconfig/configfile_test.go	Updates test setup for unconditional snapshot rejection.
internal/projectconfig/component.go	Removes obsolete TODO commentary around lock-validation rollout.
internal/fingerprint/fingerprint.go	Updates documentation strings to reference CalculateSourceIdentity.
internal/app/azldev/core/testutils/testenv.go	Adds helpers to write a minimal lock and register upstream components for tests.
internal/app/azldev/core/sources/synthistory.go	Adds fallback synthetic history behavior using on-disk lock when HEAD lock is missing; removes env-gated error path.
internal/app/azldev/core/components/resolver.go	Removes env-var gating; lock validation is now controlled by SkipLockValidation only.
internal/app/azldev/core/components/resolver_test.go	Updates tests to account for locked data population and new validation behavior.
internal/app/azldev/core/components/filter.go	Changes --skip-lock-validation default to false (validation on).
internal/app/azldev/cmds/component/update.go	Ensures update skips validation at the operation level; switches to CalculateSourceIdentity.
internal/app/azldev/cmds/component/list.go	Ensures list skips validation at the operation level.
internal/app/azldev/cmds/component/changed.go	Ensures changed skips validation at the operation level.
docs/developer/reference/component-identity-and-locking.md	Updates developer documentation to reference CalculateSourceIdentity.

Comments suppressed due to low confidence (1)

internal/projectconfig/configfile.go:126

• This change makes per-component 'upstream-distro.snapshot' unconditionally invalid (no longer gated). Since this is a user-facing config validation change, the user config reference under docs/user/reference/config/ should be updated in the same PR to document that per-component snapshots are disallowed and to point users to distro/group snapshots or 'upstream-commit' pins.

	// Per-component snapshot timestamps are not allowed. Components inherit
	// the snapshot from the distro/group default-component-config or the
	// project's default-distro. Per-component snapshots would create
	// non-deterministic builds that the lock file cannot reliably track.
	// Use an explicit 'upstream-commit' pin instead.

	// Validate overlay configurations for each component.
	for componentName, component := range f.Components {
		for i, overlay := range component.Overlays {
			err := overlay.Validate()
			if err != nil {
				return fmt.Errorf("invalid overlay %d for component %#q:\n%w", i+1, componentName, err)
			}
		}

		// Validate build configuration.
		err := component.Build.Validate()
		if err != nil {
			return fmt.Errorf("invalid build config for component %#q:\n%w", componentName, err)
		}

		if err := validateSourceFiles(component.SourceFiles, componentName); err != nil {
			return err
		}

		if component.Spec.UpstreamDistro.Snapshot != "" {
			return fmt.Errorf(
				"component %#q has a per-component 'snapshot' on 'upstream-distro'; "+
					"snapshots should be set on the distro or group default-component-config, "+
					"or use 'upstream-commit' to pin a specific commit",
				componentName)
		}

[Copilot]

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 30 out of 31 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• internal/providers/sourceproviders/sourceproviders_test/sourcemanager_mocks.go: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

internal/providers/sourceproviders/fedorasourceprovider.go:276

• The PR description (and developer doc update) mention renaming ResolveIdentity → CalculateSourceIdentity, but the codebase still defines/uses ResolveIdentity (provider) and ResolveSourceIdentity (source manager); there are no CalculateSourceIdentity symbols in the repo. Either complete the rename (and regenerate mocks/tests as needed) or update the PR description/docs to match the implemented API.

// ResolveIdentity implements [SourceIdentityProvider] by resolving the upstream
// commit hash for the component from the dist-git repository. This always
// contacts upstream (clone + snapshot/HEAD resolution or pin validation) —
// callers that want the cached locked commit should read
// [projectconfig.ComponentLockData.UpstreamCommit] directly.
func (g *FedoraSourcesProviderImpl) ResolveIdentity(
	ctx context.Context,
	component components.Component,
) (string, error) {
	if component.GetName() == "" {
		return "", errors.New("component name cannot be empty")
	}

	upstreamName := component.GetConfig().Spec.UpstreamName
	if upstreamName == "" {
		upstreamName = component.GetName()
	}

	gitRepoURL, err := fedorasource.BuildDistGitURL(g.distroGitBaseURI, upstreamName)
	if err != nil {
		return "", fmt.Errorf("failed to build dist-git URL for %#q:\n%w", upstreamName, err)
	}

	return g.resolveCommit(ctx, gitRepoURL, upstreamName, component.GetConfig().Spec.UpstreamCommit)
}

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 1 comment.