feat(package): redeploy when resolved source digest changes

[ncwade]

Description

Add digest-aware lifecycle handling to uds_package so mutable source references, such as OCI :dev tags, redeploy when their resolved content changes.

The provider now exposes a computed source_digest, resolves it during planning with Zarf's package digest API, pins OCI sources to the planned digest during apply, verifies loaded package content before deployment, and refreshes the digest from deployed cluster state. The configured source remains unchanged.

Related issue

N/A

Type of change

• Bug fix
• New feature
• Documentation
• Refactoring or maintenance

Validation

• uds run build --no-progress
• uds run generate --no-progress
• uds run test-unit --no-progress
• uds run lint:check --no-progress
• uds run test:acc --no-progress
• git diff --check

Checklist

• Tests, documentation, and ADRs were added or updated as needed
• Generated provider documentation is up to date
• I followed the contributor guide

[jasonwashburn]

I think we should stick to the intended behavior of validate_packages_on_plan here. Since this new check would also require the provider to download and inspect the source package, it should be skipped/deferred to apply like the other checks when the user is explicitly opt'ing to disable package validation on plan.

[ncwade]

Should be addressed - thanks Jason!

[jasonwashburn]

@greptileai review

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until digest-triggered updates safely reject or replace package content whose metadata name differs from the currently managed package.

Findings

1.  Mutable rename orphans package ▶

Summary

• Adds the computed source_digest attribute and resolves it during planning.
• Pins OCI package loading and component removal to the planned digest.
• Verifies loaded content before deployment and refreshes the digest from cluster state.
• Adds unit and acceptance coverage plus generated documentation and an example.
• The update path does not safely handle mutable content changing the package name, which can orphan the old deployment.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Terraform plan] --> B[Resolve configured source digest]
  B --> C{Digest differs from state?}
  C -- No --> D[No package redeployment]
  C -- Yes --> E[Mark deployment outputs unknown]
  E --> F[Apply update]
  F --> G[Load source pinned to planned digest]
  G --> H[Read metadata.name from new content]
  H --> I[Remove missing components only]
  I --> J[Deploy newly named package]
  J --> K[Refresh state using new name]
  K --> L[Old differently named package remains untracked]

Loading

[greptile-apps]

Mutable rename orphans package

When a mutable tag resolves to package content with a different metadata.name, the digest change schedules an update without checking package identity. The update deploys the newly named package and points Terraform state at it, but removal only handles missing components and never removes the old package. This leaves the previous Zarf package and its resources deployed but permanently untracked. Reject the name change or replace the old package before updating state.