Validate that resource keys do not contain variable references

[andrewnester]

Changes

Validate that resource keys do not contain variable references

Why

Fixes #5098

Tests

Added an acceptance test, failed with panic before the fix

runtime/debug.Stack()
        runtime/debug/stack.go:26 +0x5e
github.com/databricks/cli/cmd/root.Execute.func1()
        github.com/databricks/cli/cmd/root/root.go:117 +0xb4
panic({0x7ff66a649480?, 0x7ff66bad51a0?})
        runtime/panic.go:783 +0x132
github.com/databricks/cli/bundle/direct/dresources.(*ResourceSchema).PrepareState(0x0?, 0x0?)
        github.com/databricks/cli/bundle/direct/dresources/schema.go:22
reflect.Value.call({0xc0001294a0?, 0xc000988ea8?, 0xc0006ae848?}, {0x7ff66a9b6321, 0x4}, {0xc0000d1bf0, 0x2, 0xc0006e4e18?})
        reflect/value.go:581 +0xcc6
reflect.Value.Call({0xc0001294a0?, 0xc000988ea8?, 0x4?}, {0xc0000d1bf0?, 0x0?, 0x5?})
        reflect/value.go:365 +0xb9
github.com/databricks/cli/libs/calladapt.(*BoundCaller).call(0xc000b93e00, {0xc0006aeab8?, 0x1, 0xc0006e4e0a?})
        github.com/databricks/cli/libs/calladapt/calladapt.go:71 +0x765
github.com/databricks/cli/libs/calladapt.(*BoundCaller).Call(0xc000b93e00, {0xc0006aeab8?, 0x7ff66a9c3172?, 0xc?})
        github.com/databricks/cli/libs/calladapt/calladapt.go:78 +0x2f
github.com/databricks/cli/bundle/direct/dresources.(*Adapter).PrepareState(0xc000421df8?, {0x0?, 0x0?})
        github.com/databricks/cli/bundle/direct/dresources/adapter.go:374 +0x37
github.com/databricks/cli/bundle/direct.(*DeploymentBundle).makePlan(0xc000421df8, {0xc00014ea80?, 0x3e?}, 0xc000421858, 0xc000421e08)
        github.com/databricks/cli/bundle/direct/bundle_plan.go:837 +0x7fd
github.com/databricks/cli/bundle/direct.(*DeploymentBundle).CalculatePlan(0xc000421df8, {0x7ff66acfa188, 0xc000b140c0}, 0xc000150908, 0xc000421858, {0xc00014ea80, 0x3e})
        github.com/databricks/cli/bundle/direct/bundle_plan.go:124 +0xf0
github.com/databricks/cli/bundle/phases.RunPlan({0x7ff66acfa188, 0xc000b140c0}, 0xc000421808, {0x7ff66a9b8320?, 0x1000000000100?})
        github.com/databricks/cli/bundle/phases/deploy.go:218 +0xf4
github.com/databricks/cli/cmd/bundle.newPlanCommand.func1(0xc00056cf08, {0xc000370be0?, 0x4?, 0x7ff66a9b6115?})
        github.com/databricks/cli/cmd/bundle/plan.go:65 +0x1e5
github.com/spf13/cobra.(*Command).execute(0xc00056cf08, {0xc000370bc0, 0x2, 0x2})
        github.com/spf13/cobra@v1.10.2/command.go:1015 +0xb02
github.com/spf13/cobra.(*Command).ExecuteC(0xc000394608)
        github.com/spf13/cobra@v1.10.2/command.go:1148 +0x465
github.com/spf13/cobra.(*Command).ExecuteContextC(...)
        github.com/spf13/cobra@v1.10.2/command.go:1080
github.com/databricks/cli/cmd/root.Execute({0x7ff66acfa150, 0x7ff66bb62640}, 0xc000394608)
        github.com/databricks/cli/cmd/root/root.go:149 +0x176
main.main()
        github.com/databricks/cli/main.go:13 +0x3b

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

4 files changed
Suggested: @denik
Also eligible: @pietern, @shreyas-goenka, @lennartkats-db, @janniklasrose, @anton-107

/bundle/ - needs approval

Files: bundle/config/mutator/mutator.go, bundle/config/validate/no_variable_reference_in_resource_key.go
Suggested: @denik
Also eligible: @pietern, @shreyas-goenka, @lennartkats-db, @janniklasrose, @anton-107

General files (require maintainer)

Files: NEXT_CHANGELOG.md
Based on git history:

• @denik -- recent work in ./, bundle/config/validate/, bundle/config/mutator/

_{Any maintainer (@anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.}

[denik]

Could you add as a comment or on PR description what output this test had before this PR?

[denik]

I see from #5098 that it's panic stacktrace, but good to confirm.

[andrewnester]

It did fail with the same error before the fix

[simonfaltum]

Ran cursor-agent (gpt-5.5 1M Extra High) over this. The diagnostic is much nicer than the panic, thanks for landing it. One important issue and a couple of suggestions inline.

One thing not in the diff: the underlying nil-deref in bundle/direct/dresources/schema.go:22 (reached via calladapt's typed-nil conversion) is still reachable in theory. The validator catches the user-facing path, but if any other code path lands a nil at GetResourceConfig, we panic again. I think adding a defensive guard there to surface it as an internal error is worth doing as a follow-up, not blocking this PR.