feat(cli): add apply command

[Piskoo]

Adds a chainloop apply -f <file|dir> command that applies contracts from YAML files or directories.

All succeeded

$ chainloop apply -f ./contracts
WRN API contacted in insecure mode
INF 2 contracts applied

1 failed

$ chainloop apply -f ./contracts
WRN API contacted in insecure mode
ERR parsing file /home/ubuntu/Desktop/contracts/contract2.yml: missing 'metadata.name' field in YAML document of kind "Contract"
exit status 1

Closes #2803

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/cli/pkg/action/apply.go">

<violation number="1" location="app/cli/pkg/action/apply.go:122">
P1: Bug: All `Describe` errors are treated as "not found", causing incorrect fallthrough to `Create`. If the server returns a permission error, network timeout, or internal error, the code will silently attempt to create a new contract instead of reporting the failure. You should check for the specific gRPC `NotFound` status code before falling through to Create.</violation>

<violation number="2" location="app/cli/pkg/action/apply.go:214">
P2: Missing validation: `metadata.name` is not checked for empty. If a YAML document omits the `name` field, the code will attempt to create/update a contract with an empty name, leading to a confusing downstream error.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 10 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/controlplane/internal/service/workflowcontract.go">

<violation number="1" location="app/controlplane/internal/service/workflowcontract.go:294">
P1: The creation path in `Apply` bypasses the RBAC project-scope enforcement that the `Create` method has. When RBAC is enabled, `Create` requires a project reference (`rbacEnabled(ctx) && !req.ProjectReference.IsSet()`), but `Apply` skips this check entirely and never sets `ProjectID` in `WorkflowContractCreateOpts`. This creates an authorization bypass where users can create global contracts through `Apply` even when the system requires project-scoped contracts.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[jiparis]

Since OSS only supports declarative workflow contracts, I think this command should be placed in chainloop wf contract apply.

[Piskoo]

We already have wf contract apply, this one is there to expose generic apply for all resources in chainloop, it will be extended in CLI EE. We can refactor wf contract apply in a separate task so it uses the new endpoint, although if we do that, we will lose the capability scoping contracts per project. We don't support projects in the schema

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="app/cli/pkg/action/apply.go">

<violation number="1" location="app/cli/pkg/action/apply.go:75">
P2: The `Error` field on `ApplyResult` is now dead code. Since both error paths early-return from `Run()` instead of populating `result.Error`, no result will ever have a non-nil `Error`. The caller in `cmd/apply.go` has an unreachable `r.Error != nil` branch (lines 48-57) as a consequence. Either remove the `Error` field and the dead caller logic, or restore the accumulate-and-continue pattern if partial failure reporting is desired.

(Based on your team's feedback about removing unused code, methods, and variables.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}