[RAPTOR-18973] feat(workload): manifest package core: parse, locate, compile

[wojtekwdr]

RATIONALE

dr workload up deploys from one committed file: .datarobot.yaml at the repository root, the exact spec dr workload create --spec-file accepts today plus two CLI-managed conveniences. This PR adds the package that owns that file. It is the remaining blocker for the config wizard (RAPTOR-18975) and the up core (RAPTOR-18976). No command surface changes; nothing user-visible ships.

There are deliberately no typed spec structs: the workload-api schema moves faster than any struct would, so unknown blocks pass through untouched and platform additions need no CLI release. The file parses once into a yaml.Node tree and everything derives from it, which is what makes line-anchored errors and comment-preserving writes possible.

This is the first of two stacked PRs for the ticket, split to keep each at about 1k lines: this one carries the read path (parse, locate, compile); the stacked follow-up carries the validation ledger and the workloadId write-back. Part of RAPTOR-18973.

CHANGES

New package internal/workload/manifest; no existing files are touched.

Parse and locate (manifest.go, node.go, keys.go)

• Load / Parse: one YAML parse; JSON content parses too, since the manifest is whatever the create endpoint accepts and YAML is a superset of JSON. Empty, comment-only, non-mapping and foreign files (none of the recognized top-level keys present) are rejected rather than deployed as an all-defaults workload.
• Locate searches upward from the working directory the way git finds its repository root, stopping after the home directory or the filesystem root. ErrNotFound is errors.Is-able so up can fall into the wizard instead of failing.
• WorkloadID() and Name() accessors for the two fields the CLI itself reads.
• node.go holds the nil-safe yaml.Node accessors the whole package chains lookups with; keys.go names the manifest-level fields once.

Error types (errors.go)

• FieldError carries the YAML path and manifest line of one finding; ValidationError collects every finding for a file in one pass. Compile uses them for credential syntax errors now; the stacked ledger PR reports through the same types.

Compile (compile.go)

• Compile lowers the tree to the JSON create payload: strips workloadId, expands the dr-credential:<credential-id>/<key> value shorthand into the API's credential-backed object form (the object form is accepted in the file as well), and passes unknown blocks through untouched. The environmentVars walk is shape-agnostic, so the shorthand works wherever the spec puts variables. A malformed shorthand is refused rather than sent to the API as a literal value.
• Returns CredentialRefs so callers can verify each referenced credential with a GET before anything mutates; the credential lookup client lands with RAPTOR-18977.

Tests

• Load/Parse rejection cases, Locate walk semantics (ancestor hit, not-found, a directory named .datarobot.yaml skipped), shorthand expansion locked against workload.EnvironmentVar's JSON tags so a drifted field name fails in CI instead of at the API, unknown-key passthrough, and the compiled payload asserted to be valid workload.ValidateWorkloadCreateRequest input (the down-payment on the end-to-end smoke property in RAPTOR-18971).

NOTES

Stacked follow-up (same ticket): the validation ledger (Validate with the full line-anchored rule set) and WriteWorkloadID (the comment-preserving write-back). Deferred beyond that, as the ticket allows: the ancestor-manifest warning (RAPTOR-18975 builds it on Locate), the full-file write for the wizard (RAPTOR-18975), and the credential lookup client (RAPTOR-18977).

PR Automation

Comment-Commands: Trigger CI by commenting on the PR:

• /trigger-smoke-test or /trigger-test-smoke - Run smoke tests
• /trigger-install-test or /trigger-test-install - Run installation tests

Labels: Apply labels to trigger workflows:

• run-smoke-tests or go - Run smoke tests on demand (only works for non-forked PRs)

Important

For Forked PRs: The run-smoke-tests label won't work. A required Smoke Tests check will block merge until a maintainer acts:

• A maintainer uses /approve-smoke-tests to run smoke tests (results will set the check)
• A maintainer uses /skip-smoke-tests to bypass the check without running tests

Please comment requesting a maintainer review if you need smoke tests to run.

[datarobot-pr-review-router]

🎫 Jira: RAPTOR-18973 — 2. dr workload manifest: root .datarobot.yaml as the workload-create spec