fix(cli): resolve env var templates before validation in list-deps (#5914)

# What does this PR do?

`ogx stack list-deps` passed raw YAML directly to `StackConfig()`,
causing Pydantic validation errors for non-string fields using env var
syntax (e.g. `registry_refresh_interval_seconds` set to
`${env.REGISTRY_REFRESH_INTERVAL_SECONDS:=300}`).

Use `replace_env_vars()` before validation, matching the server startup
path. This also subsumes the manual `auth` `provider_config` nulling
workaround since `replace_env_vars` already handles that.

Distributions like `nvidia` and `postgres-demo` use bare
`${env.INFERENCE_MODEL}` (no default value) in `registered_resources`.
Since these env vars are not set at build/CI time, `replace_env_vars()`
would raise `EnvVarError`. The new `ignore_unresolved` parameter makes
`list-deps` tolerant of these by resolving bare unset env vars to empty
strings, which triggers the existing resource-skip logic. Server startup
behavior is unchanged (still raises on missing env vars).

## Test plan
- [x] Unit tests for `replace_env_vars` pass (37 tests including 4 new
`ignore_unresolved` tests)
- [x] Unit tests for `list-deps` pass (14 tests)
- [x] `ogx stack list-deps nvidia` succeeds without `INFERENCE_MODEL`
set
- [x] `ogx stack list-deps postgres-demo` succeeds without
`INFERENCE_MODEL` set
- [x] Pre-commit checks pass on all changed files
- [x] `mypy` passes

**Upstream issue**:
opendatahub-io/ogx-distribution#429

---------

Signed-off-by: Nathan Weinberg <nweinber@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nathan-weinberg

src/ogx/cli/stack/_list_deps.py

@@ -14,7 +14,7 @@
 from ogx.core.build import get_provider_dependencies
 from ogx.core.datatypes import StackConfig
 from ogx.core.distribution import get_provider_registry
-from ogx.core.stack import run_config_from_dynamic_config_spec
+from ogx.core.stack import replace_env_vars, run_config_from_dynamic_config_spec
 from ogx.log import get_logger
 
 from .utils import add_dependent_providers
@@ -90,15 +90,7 @@ def run_stack_list_deps_command(args: argparse.Namespace) -> None:
             with open(config_file) as f:
                 try:
                     contents = yaml.safe_load(f)
-                    # Remove auth provider_config to avoid validation errors with env var syntax.
-                    # We only need provider dependencies, not auth config (auth has no pip_packages).
-                    # This is simpler than modifying the schema to accept type="" which would require
-                    # removing discriminated union and adding custom validation logic and modifying
-                    # all 4 auth provider config classes (a very invasive change)
-                    if "server" in contents and "auth" in contents["server"]:
-                        if "provider_config" in contents["server"]["auth"]:
-                            contents["server"]["auth"]["provider_config"] = None
-                    config = StackConfig(**contents)
+                    config = StackConfig(**replace_env_vars(contents, ignore_unresolved=True))
                 except Exception as e:
                     cprint(
                         f"Could not parse config file {config_file}: {e}",

src/ogx/core/stack.py

@@ -482,8 +482,15 @@ def _collect(obj: Any, acc: list[str]) -> None:
     return result
 
 
-def replace_env_vars(config: Any, path: str = "") -> Any:
-    """Recursively replace environment variable references in a configuration object."""
+def replace_env_vars(config: Any, path: str = "", ignore_unresolved: bool = False) -> Any:
+    """Recursively replace environment variable references in a configuration object.
+
+    When *ignore_unresolved* is True, bare ``${env.VAR}`` references that cannot
+    be resolved (env var not set, no default) are replaced with an empty string
+    instead of raising :class:`EnvVarError`.  This is used by ``list-deps`` which
+    only needs the structural shape of the config (provider types), not actual
+    runtime values.
+    """
     if isinstance(config, dict):
         # Special handling for auth provider_config with conditional type field
         # This allows auth to be enabled/disabled via environment variables
@@ -493,15 +500,17 @@ def replace_env_vars(config: Any, path: str = "") -> Any:
             if isinstance(provider_cfg, dict) and "type" in provider_cfg:
                 try:
                     # Resolve the type field first to check if auth should be enabled
-                    resolved_type = replace_env_vars(provider_cfg["type"], f"{path}.provider_config.type")
+                    resolved_type = replace_env_vars(
+                        provider_cfg["type"], f"{path}.provider_config.type", ignore_unresolved
+                    )
 
                     # If type is empty/None, disable auth by setting provider_config to None
                     # This prevents validation errors on the discriminated union
                     if resolved_type is None or resolved_type == "":
                         # Process rest of config normally but exclude provider_config from expansion
                         # to avoid EnvVarError from bare env vars (e.g., ${env.KEYCLOAK_URL})
                         result = {
-                            k: replace_env_vars(v, f"{path}.{k}" if path else k)
+                            k: replace_env_vars(v, f"{path}.{k}" if path else k, ignore_unresolved)
                             for k, v in config.items()
                             if k != "provider_config"
                         }
@@ -518,7 +527,7 @@ def replace_env_vars(config: Any, path: str = "") -> Any:
         result = {}
         for k, v in config.items():
             try:
-                result[k] = replace_env_vars(v, f"{path}.{k}" if path else k)
+                result[k] = replace_env_vars(v, f"{path}.{k}" if path else k, ignore_unresolved)
             except EnvVarError as e:
                 raise EnvVarError(e.var_name, e.path) from None
         return result
@@ -533,7 +542,9 @@ def replace_env_vars(config: Any, path: str = "") -> Any:
                 # is disabled so that we can skip config env variable expansion and avoid validation errors
                 if isinstance(v, dict) and "provider_id" in v:
                     try:
-                        resolved_provider_id = replace_env_vars(v["provider_id"], f"{path}[{i}].provider_id")
+                        resolved_provider_id = replace_env_vars(
+                            v["provider_id"], f"{path}[{i}].provider_id", ignore_unresolved
+                        )
                         if resolved_provider_id == "__disabled__":
                             logger.debug(
                                 "Skipping config env variable expansion for disabled provider",
@@ -551,7 +562,9 @@ def replace_env_vars(config: Any, path: str = "") -> Any:
                     for id_field in RESOURCE_ID_FIELDS:
                         if id_field in v:
                             try:
-                                resolved_id = replace_env_vars(v[id_field], f"{path}[{i}].{id_field}")
+                                resolved_id = replace_env_vars(
+                                    v[id_field], f"{path}[{i}].{id_field}", ignore_unresolved
+                                )
                                 if resolved_id is None or resolved_id == "":
                                     logger.debug(
                                         "Skipping [] with empty (conditional env var not set)",
@@ -575,7 +588,7 @@ def replace_env_vars(config: Any, path: str = "") -> Any:
 
                 # Normal processing
                 # result is a list here, but mypy sees it could be dict/str
-                result.append(replace_env_vars(v, f"{path}[{i}]"))  # type: ignore[attr-defined]
+                result.append(replace_env_vars(v, f"{path}[{i}]", ignore_unresolved))  # type: ignore[attr-defined]
             except EnvVarError as e:
                 raise EnvVarError(e.var_name, e.path) from None
         return result
@@ -620,6 +633,8 @@ def get_env_var(match: re.Match):
                     value = ""
             else:  # No operator case: ${env.FOO}
                 if not env_value:
+                    if ignore_unresolved:
+                        return ""
                     raise EnvVarError(env_var, path)
                 value = env_value
 

tests/unit/server/test_replace_env_vars.py

@@ -42,6 +42,40 @@ def test_simple_replacement_raises_when_not_set(setup_env_vars):
     assert exc_info.value.var_name == "NOT_SET"
 
 
+def test_ignore_unresolved_returns_empty_for_bare_env_var(setup_env_vars):
+    result = replace_env_vars("${env.NOT_SET}", ignore_unresolved=True)
+    assert result is None
+
+
+def test_ignore_unresolved_still_resolves_set_vars(setup_env_vars):
+    assert replace_env_vars("${env.TEST_VAR}", ignore_unresolved=True) == "test_value"
+
+
+def test_ignore_unresolved_skips_resource_with_bare_env_var(setup_env_vars):
+    """Bare ${env.VAR} in a model_id should skip the item when ignore_unresolved=True."""
+    data = {
+        "models": [
+            {"model_id": "${env.INFERENCE_MODEL}", "provider_id": "nvidia"},
+            {"model_id": "always-present", "provider_id": "other"},
+        ]
+    }
+    result = replace_env_vars(data, ignore_unresolved=True)
+    assert len(result["models"]) == 1
+    assert result["models"][0]["model_id"] == "always-present"
+
+
+def test_ignore_unresolved_preserves_defaults_and_conditionals(setup_env_vars):
+    data = {
+        "url": "${env.BASE_URL:=https://example.com}",
+        "key": "${env.API_KEY:=}",
+        "opt": "${env.OPTIONAL:+enabled}",
+    }
+    result = replace_env_vars(data, ignore_unresolved=True)
+    assert result["url"] == "https://example.com"
+    assert result["key"] is None
+    assert result["opt"] is None
+
+
 def test_default_value_when_not_set(setup_env_vars):
     assert replace_env_vars("${env.NOT_SET:=default}") == "default"