Victoria-aware Lookup File Naming should be detected

[ljstella]

After reviewing the implementation of check_detection_metadata() on the inspect action- we can extend this concept to include warning/errors on lookups changing without the filenames changing between two versions. This causes a big issue with Victoria Experience SplunkCloud deployments where lookup updates are handled differently. Implementing this in the inspect workflow allows us to better catch these, and allows customers utilizing contentctl to also benefit from this.

[ljstella]

Jotting down thoughts here as this is a bit more involved than at first glance- we already validate that lookup yml files point to lookup files that exist- so we can likely avoid parsing the the .conf to fetch those entirely, which saves a ton of work. We need to collect two pieces of information from each package- the filename of the CSV lookup on disk, and a hash of that file. Creating a set of tuples for these could represent each package, and then we simply need to compare based on the filename key- we specifically want to throw errors when the filename has not changed, but the file hash has. Things that are only in the new package are new lookups- whether we want to go back and add validation to enforce datestamping them is separate. Things that are only in the old package set are two things- "Lookups we don't ship anymore" or "old versions of lookups that have had their filename changed" - both of those are fine.

[ljstella]

After discussion w/ @pyth0n1c , documenting an alternative to the above:

• Managed Workflow for Lookups
  • lookups get named like lookup_file.csv
  • the accompanying yml gets some standard metadata fields added, including a date
  • on build, lookup_file.csv gets written out to the app as lookup_file-20241219.csv based on the date in the yaml
  • validation is built around the yaml to ensure dates get modified if the file changes
  • the above mentioned check (comparing filenames + hashes of lookups between two packages) can still be added to inspect