Test app data source against Kernel

[IlyaasK]

Summary

• add lookup-only kernel_app acceptance coverage using a release-owned running app version
• require non-secret KERNEL_ACC_APP_NAME and KERNEL_ACC_APP_VERSION repository variables
• test exact app/version lookup under explicit and provider-default project scope
• verify canonical app ID, deployment ID, region, and a no-drift plan
• add the package to the manual workflow and clear the last registered data-source acceptance blocker

Why this is v1 work

Apps are projections of running durable deployments, not independently mutable resources. This PR proves the registered data source against a controlled release fixture without creating a deployment, invoking an action, reading logs, or exposing environment values.

Verification

Before this change, the app data source was the final registered surface without live coverage. After the change, the manual matrix requires exactly one matching running app version and exercises both project-scope paths.

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• git diff --check
• missing-TF_ACC safety run against an unreachable base URL skipped before networking

actionlint was unavailable locally; the workflow expressions were inspected manually and are exercised by hosted GitHub validation.

Live acceptance was not run locally because real credentials and release-owned app fixture selectors are unavailable. One complete manual matrix run remains a v1 tag gate.

Deferred

Deterministic deployment creation remains blocked separately. App invocation, logs, screenshots, live view, environment values, and all other runtime operations remain intentionally unsupported.

---

Note

Low Risk
Test and CI/documentation changes only; no provider runtime or authentication logic is modified.

Overview
Adds live acceptance coverage for the kernel_app data source, clearing the last registered data-source fixture blocker in the v1 matrix.

A new TestAccAppDataSourceExplicitAndProviderDefaultScope test reads a release-owned running app via KERNEL_ACC_APP_NAME and KERNEL_ACC_APP_VERSION (non-secret repo variables). It asserts explicit project_id and provider-default scope resolve the same id, deployment_id, and region, checks app_name / version, and runs a plan-only no-drift step—without creating deployments or invoking actions.

The manual Acceptance workflow gains an App data source matrix job with app_fixture_required, preflight checks for those variables, and env injection on go test. docs/acceptance.md documents the new env vars, updates the matrix row from fixture-blocked to test present, and lists the ninth package command.

^{Reviewed by Cursor Bugbot for commit dcbf871. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 21b0ea2. Configure here.}

[cursor]

Wrong fixture error for project

Low Severity

requireAppFixtureEnv is used to load KERNEL_PROJECT_ID, but its failure text always says the variable must identify the release-owned app fixture. A missing project ID therefore surfaces a misleading message instead of the project-scoped wording used in other data source acceptance tests.

Additional Locations (1)

• internal/datasources/app/datasource_acc_test.go#L61-L62

 

^{Reviewed by Cursor Bugbot for commit 21b0ea2. Configure here.}