fix(gocd): audit snuba-rs material allowlist

[sentry-junior]

Summary

Audit the snuba-rs GoCD material filter and retain an includes allowlist. GoCD represents allowlisting by inverting a single material filter, so includes and ignore cannot be combined.

Add missing Rust runtime/deployment inputs to both GoCD templates:

• .dockerignore
• docker_entrypoint.py
• gocd/templates/bash/**/*, containing the scripts embedded in GoCD pipeline tasks
• snuba/consumers/consumer_config.py, which resolves configuration passed from Python into Rust

The existing Rust sources, dataset configuration, settings, CLI, Dockerfile, and sentry-options schema paths remain included.

Options considered but not chosen

• ignore: ['snuba/**/*.py']: rejected because it triggers the Rust deploy for many paths the old allowlist intentionally excluded.
• Ignore all of snuba/** with ! exceptions: unsupported; GoCD material filters do not support gitignore-style negation.
• Explicitly blacklist every current snuba/ subtree except the shared Rust paths: rejected because it is brittle and silently changes behavior when new directories appear.
• Combine includes and ignore: unsupported; GoCD has one filter list plus an inversion flag.
• Add pyproject.toml and uv.lock: considered during the audit, then intentionally omitted.
• Add scripts/rust-dummy-build.sh: considered because the Dockerfile copies it, then intentionally omitted.

GoCD references

• Material deny/allow filters
• Configuration reference: invertFilter
• GoCD YAML plugin format: includes instead of ignore
• GoCD material blacklisting/whitelisting overview

Validation

• git diff --check
• verified the GoCD script path is present in both allowlists
• verified pyproject.toml, uv.lock, and scripts/rust-dummy-build.sh are absent from both allowlists

Full Jsonnet rendering was not run locally because jb, jsonnetfmt, jsonnet-lint, jsonnet, and yq are unavailable; CI validates the rendered pipelines.

via Prajjwal Bhandari.

--

View Junior Session [Sentry]

[pbhandari]

we're opting for a different approach. Closing tihs.