test(oetf): KIND-safe workflow-labels scenario (D1)

[jiaenren]

Summary

Issue - None

Track D1 of the workflow-labels split (from #1194). Adds the OETF label scenario, based on B9 (#1227) — the current stack tip — so its KIND gate validates the whole label stack (B5–B9) end to end.

test/scenarios/workflow_labels.py is the KIND-safe subset, verified purely through the OSMO API (a sandboxed OETF test has no in-cluster kubeconfig):

• policy gate off / warn / enforce via validation-only submits (no rows, nothing schedules): warn surfaces warnings, enforce rejects with 400 and leaves no row, off accepts anything;
• label-syntax rejection: nested value, invalid key, empty value;
• list filtering: exact label, glob, and no_label;
• end to end: one real labeled workflow runs to COMPLETED, and its labels survive submit → persistence → workflow API + list filtering.

Tagged kind, so it runs in the oetf:deploy_and_run --env kind gate (which --build-locals the whole stack and deploys it to KIND in DB mode). Serial + exclusive because the policy tests mutate labels_config; each restores the baseline in tearDown, and mutation tests skipTest in ConfigMap mode.

Scope note (pod-object verification)

A literal in-cluster pod-label assertion is not reachable from the gate: OETF scenarios run via bazel test with only OETF_URL + auth + OETF_POOL forwarded, so the test can't reach the KIND cluster with kubectl. The end-to-end test therefore verifies the label through the API (submit → run → persisted labels echoed + filterable). The actual pod stamping (apply_workflow_labels) is covered by unit tests (B4) and dev/Orin runs. A true pod-object check would need kubeconfig forwarded into the OETF test env — a small runner change we can add later if wanted.

The heavier lifecycle + ConfigMap-fixture matrix (the prototype's test_ppp_enforcement_matrix) runs on dev/Orin and is out of scope for this KIND smoke.

Verification

• bazel build //test/scenarios:workflow-labels and //test/scenarios:workflow-labels-pylint pass locally.
• Full-stack KIND gate: triggered on this branch via workflow_dispatch (the Local KIND Deployment workflow auto-triggers only on PRs to main; this PR is stacked on B9, so the gate is dispatched manually until the stack retargets main).

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 295872dc-83c8-413f-8191-b2a0d3c15cc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}