feat(apply): add --since/--force for git-history-based deletion sync

.chloggen/feat_sync-action.yaml

@@ -0,0 +1,55 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern (e.g. dashboards, config, apply)
+component: apply
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Add `apply --since <ref>` and `--force` for git-history-based deletion sync"
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [253]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  Deletes assets whose definition existed at `<ref>` but is no longer present in `-f`'s
+  current contents, detected by identifier (id or origin), never by file path. Requires
+  `--experimental`/`-X`. `--dry-run --since` previews the deletion plan, merged with the
+  existing create/update preview into one per-file listing, and now also resolves deleted
+  assets' names from git history instead of only showing their id. Agent mode emits
+  `--dry-run`'s preview as JSON.
+
+  Also, while stabilizing this feature ahead of release:
+  - `--since` now correctly detects an all-deletions run, whether `-f`'s target survives
+    empty or was removed entirely, instead of failing outright.
+  - Deleting a PrometheusRule CRD always cleans up both its check rule and its recording
+    rule, instead of trusting a single git snapshot that could undercount which endpoints
+    the CRD ever used.
+  - A CRD's recording rule is deleted when its last `record:` entry is removed, even
+    though the CRD's own identifier survives via a remaining `alert:` entry.
+  - An asset already deleted by someone else no longer fails the whole run; this no
+    longer requires `--force`, which keeps its own separate job of skipping confirmation
+    prompts.
+  - New `--accept-non-ancestor-ref` flag accepts a non-ancestor `--since` ref (e.g. after
+    a force-push) without also skipping every per-asset deletion confirmation, which
+    `--force` alone used to do together.
+  - A concurrently-deleted asset is now reported once, not as both "already deleted" and
+    "deleted".
+  - Fixed a pre-existing, `--since`-independent bug in `apply`/`check-rules create`: a
+    PrometheusRule CRD with 2+ alerting rules and a `dash0.com/id` label silently
+    collapsed to one check rule (the last alert applied overwrote the rest under the
+    shared id). Each alert now upserts its own derived id. Re-applying an existing
+    multi-alert CRD leaves an orphaned duplicate at the literal `dash0.com/id`; delete it
+    by hand once the new per-alert check rules look correct.
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with "chore" or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Default: '[user]'
+change_logs: []

.chloggen/feat_sync-action_dryrun_output.yaml

@@ -0,0 +1,47 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: breaking
+
+# The name of the component, or a single word describing the area of concern (e.g. dashboards, config, apply)
+component: apply
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "`apply --dry-run` changed its output shape, including without `--since`"
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [253]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  `--since` renders its deletions in the same listing as creates and updates, so that
+  listing had to name each row's operation and order the two kinds of row together. Plain
+  `--dry-run` shares the renderer and therefore changed too, in three ways:
+
+  - Each row is now prefixed with `*` and its operation instead of a per-file ordinal:
+    `1. Dashboard "Production Overview" (a1b2c3d4-...)` becomes
+    `* Apply Dashboard "Production Overview" (a1b2c3d4-...)`.
+  - Rows within a file are ordered by identifier rather than by their position in the
+    file, so a document's row can move relative to its siblings.
+  - In agent mode, `--dry-run` now emits the documented JSON array of
+    `{path, changes: [{op, kind, name, originOrId}]}` instead of the human-readable text,
+    matching every other command's agent-mode contract.
+
+  Separately, `Dash0Team` now renders as `Team` wherever an asset kind is displayed, so
+  `apply` reports `Team "Backend Team" created` instead of `Dash0Team "Backend Team"
+  created`. Every other kind already had a human-readable display name; teams fell
+  through to the raw kind identifier, which also contradicted the `--- Team (before)`
+  header their own update diff printed.
+
+  Scripts that parsed `--dry-run`'s text output, or grepped for `Dash0Team`, need
+  updating. Agent-mode callers should read the JSON rather than parsing text.
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with "chore" or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Default: '[user]'
+change_logs: []

.github/workflows/ci.yml

@@ -31,6 +31,25 @@ jobs:
           path: build/dash0
           retention-days: 1
 
+  test-e2e:
+    # Real dash0 binary + real git binary inside a container, proving
+    # --since's git-shell-out path works across a real process boundary --
+    # something in-process unit/integration tests can't cover. GitHub-hosted
+    # ubuntu-latest runners have a working Docker daemon natively, so no
+    # special runner capability (unlike self-hosted Docker-in-Docker) is
+    # needed here.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run end-to-end tests
+        run: make test-e2e
+
   lint-go:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -17,6 +17,9 @@ bin/
 # Built binaries
 build/
 
+# Cross-compiled binary for the test-e2e Docker image (see test/e2e/setup_test.go)
+test/e2e/dash0
+
 # Tools binaries
 .tools/
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build clean test test-unit test-integration test-roundtrip install lint lint-install lint-go-install lint-sh-install lint-go lint-sh chlog-install chlog-new chlog-validate chlog-preview chlog-update update-vendor-hash update-flake-lock skill-bundle skill-validate
+.PHONY: all build clean test test-unit test-integration test-roundtrip test-e2e install lint lint-install lint-go-install lint-sh-install lint-go lint-sh chlog-install chlog-new chlog-validate chlog-preview chlog-update update-vendor-hash update-flake-lock skill-bundle skill-validate
 
 all: lint test
 
@@ -17,7 +17,7 @@ CHLOGGEN=$(TOOLS_BIN_DIR)/chloggen
 build:
 	(mkdir -p $(BUILD_DIR) || true) && go build -o $(BUILD_DIR)/$(BINARY_NAME) ./cmd/dash0
 
-test: test-unit test-integration test-roundtrip
+test: test-unit test-integration test-e2e test-roundtrip
 
 test-unit:
 	go test -v ./...
@@ -28,6 +28,21 @@ test-integration:
 test-roundtrip: build
 	bash test/roundtrip/run_all.sh
 
+# End-to-end tests: the real dash0 binary + the real git binary inside a
+# container, proving --since's git-shell-out path works across a real
+# process boundary (in-process unit/integration tests can't). Gated behind
+# Docker being available and kept separate from test-unit/test-integration
+# given the added runtime cost and the Docker dependency.
+#
+# Colima users: testcontainers-go's Docker auto-detection doesn't recognize
+# colima's non-standard socket forwarding. Export these first:
+#   export DOCKER_HOST="unix://$$HOME/.colima/default/docker.sock"
+#   export TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE="/var/run/docker.sock"
+test-e2e:
+	@command -v docker >/dev/null 2>&1 || { echo "Error: docker is required for test-e2e" >&2; exit 1; }
+	@docker version >/dev/null 2>&1 || { echo "Error: docker daemon is not reachable (is it running?)" >&2; exit 1; }
+	go test -v -tags=e2e ./test/e2e/...
+
 install: build
 	cp $(BUILD_DIR)/$(BINARY_NAME) $(GOPATH)/bin/
 

README.md

@@ -136,6 +136,10 @@ docker run ghcr.io/dash0hq/cli:latest [command]
 
 Multi-architecture images (`linux/amd64`, `linux/arm64`) are published to GitHub Container Registry.
 
+> [!NOTE]
+> This image is built `FROM scratch` and has no shell or other tools installed, including `git`.
+> Commands that shell out to `git` (currently `apply --since`) are unavailable from it.
+
 ### Nix / NixOS
 
 The repository is a Nix flake that builds the CLI with `buildGoModule` and installs shell completions for Bash, Zsh, and Fish.
@@ -373,6 +377,14 @@ Validate without applying:
 dash0 apply -f assets.yaml --dry-run
 ```
 
+Sync a directory to match its state as of a git ref, deleting assets removed since then (experimental, requires `-X`):
+
+```bash
+dash0 -X apply -f dashboards/ --since HEAD~1 --force
+```
+
+See [Command Reference](docs/commands.md#apply---since-experimental) for the full `--since` reference, including the ref-resolution edge cases and the GitHub Actions invocation pattern.
+
 **Note:** In Dash0, dashboards, views, synthetic checks and check rules are called "assets", rather than the more common "resources".
 The reason for this is that the word "resource" is overloaded in OpenTelemetry, where it describes "where telemetry comes from".