config-remote-sync: skip permissions/grants sub-resources instead of failing

[ilyakuz-db]

Changes

Syncing permissions back is not yet supported, so these sub-resources are now skipped in ExtractChanges instead of failing the whole run.

bundle config-remote-sync (used by DABs in the Workspace to write remote resource changes back to YAML) failed the entire sync when a job/pipeline had permissions or grants. These are emitted by the plan as their own sub-resources (resources.<type>.<name>.permissions / .grants), which config-remote-sync cannot write back — the server-populated object_id field has no YAML source location, and bundle-level permissions have no per-resource YAML node at all. This surfaced as either failed to find location for resource ...permissions for a field object_id or a selector-parse crash on permissions.[user_name='...'].

Why

One malformed sub-resource change was aborting the sync for the whole bundle, so users with permissions on any resource could never sync any UI edit back to config.

Tests

Unit test for the skip in ExtractChanges (both engines) and an acceptance test that reproduces the exact failure without the fix.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 742d04e

Run: 29752898137

	Env	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux	4	4	227	1126	3:01
💚​	aws windows	4	4	229	1124	2:42
💚​	aws-ucws linux	4	4	314	1043	5:34
💚​	aws-ucws windows	4	4	316	1041	3:56
💚​	azure linux	4	4	227	1125	3:09
💚​	azure windows	4	4	229	1123	2:31
💚​	azure-ucws linux	4	4	316	1040	5:48
💚​	azure-ucws windows	4	4	318	1038	3:33
💚​	gcp linux	4	4	226	1127	2:42
💚​	gcp windows	4	4	228	1125	2:20

8 interesting tests: 4 RECOVERED, 4 SKIP

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

5 files changed
Suggested: @denik
Also eligible: @andrewnester, @anton-107, @janniklasrose, @lennartkats-db, @pietern, @shreyas-goenka

/bundle/ - needs approval

Files: bundle/configsync/diff.go, bundle/configsync/diff_test.go
Suggested: @denik
Also eligible: @andrewnester, @anton-107, @janniklasrose, @lennartkats-db, @pietern, @shreyas-goenka

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db) can approve all areas.
See OWNERS for ownership rules.}