Anchor alert file_path reads to the bundle root (#5488)

## Why

Found during a full-repo review of the CLI. An alert's `file_path` is
normalized to be relative to the bundle root, but the `.dbalert.json`
file was read with `os.ReadFile`, which resolves relative paths against
the process working directory. Running `bundle validate` or `bundle
deploy` from a subdirectory of the bundle failed with "failed to read
.dbalert.json file ...: no such file or directory", or could silently
read an unrelated file that happens to match the path. Dashboards
already handle this correctly by reading through the bundle's filesystem
root.

## Changes

Before, alert `.dbalert.json` files could only be loaded when the CLI
ran from the bundle root; now they load from any directory within the
bundle. `LoadDBAlertFiles` joins relative `file_path` values with
`b.BundleRootPath` before reading. Absolute paths are kept as-is,
matching how `NormalizePaths` leaves them untouched.

Also fixed a malformed internal error message in the same function that
wrapped a nil error with `%w` (printing `%!w(<nil>)`); it now reports
the actual kind of the value.

## Test plan

- [x] New unit test `TestLoadDBAlertFilesRelativeToBundleRoot` in
`bundle/config/mutator/load_dbalert_files_test.go`; verified it fails
without the fix (the test process working directory is not the bundle
root) and passes with it
- [x] New acceptance test
`acceptance/bundle/resources/alerts/with_file_run_from_subdir` that runs
`bundle validate` from both the bundle root and a subdirectory; verified
it reproduces the bug without the fix and passes with it on both engines
(terraform and direct)
- [x] Existing alerts unit and acceptance tests pass (`go test
./bundle/config/mutator/`, `go test ./acceptance -run
'TestAccept/bundle/resources/alerts'`)
- [x] `./task fmt-q`, `./task lint-q`, and `./task checks` pass

This pull request and its description were written by Isaac.

Author: simonfaltum

acceptance/bundle/resources/alerts/with_file_run_from_subdir/databricks.yml

@@ -0,0 +1,5 @@
+bundle:
+  name: alerts-with-file-run-from-subdir
+
+include:
+  - resources/*.yml

acceptance/bundle/resources/alerts/with_file_run_from_subdir/out.test.toml

@@ -0,0 +1,66 @@
+
+=== validate from the bundle root
+>>> [CLI] bundle validate -o json
+{
+  "custom_summary": "My alert from file",
+  "display_name": "myalert",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "file_path": "resources/alert.dbalert.json",
+  "parent_path": "/Workspace/Users/[USERNAME]/.bundle/alerts-with-file-run-from-subdir/default/resources",
+  "query_text": "select 2\n",
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  },
+  "warehouse_id": "[NUMID]"
+}
+
+=== validate from a subdirectory of the bundle
+>>> [CLI] bundle validate -o json
+{
+  "custom_summary": "My alert from file",
+  "display_name": "myalert",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "file_path": "resources/alert.dbalert.json",
+  "parent_path": "/Workspace/Users/[USERNAME]/.bundle/alerts-with-file-run-from-subdir/default/resources",
+  "query_text": "select 2\n",
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  },
+  "warehouse_id": "[NUMID]"
+}

acceptance/bundle/resources/alerts/with_file_run_from_subdir/output.txt

@@ -0,0 +1,28 @@
+{
+  "custom_summary": "My alert from file",
+  "evaluation": {
+    "comparison_operator": "EQUAL",
+    "notification": {
+      "notify_on_ok": false,
+      "retrigger_seconds": 1
+    },
+    "source": {
+      "aggregation": "MAX",
+      "display": "1",
+      "name": "1"
+    },
+    "threshold": {
+      "value": {
+        "double_value": 2
+      }
+    }
+  },
+  "query_lines": [
+    "select 2"
+  ],
+  "schedule": {
+    "pause_status": "UNPAUSED",
+    "quartz_cron_schedule": "44 19 */1 * * ?",
+    "timezone_id": "Europe/Amsterdam"
+  }
+}

acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.dbalert.json

@@ -0,0 +1,6 @@
+resources:
+  alerts:
+    myalert:
+      warehouse_id: "0123456789012345"
+      display_name: "myalert"
+      file_path: ./alert.dbalert.json

acceptance/bundle/resources/alerts/with_file_run_from_subdir/resources/alert.yml

@@ -0,0 +1,6 @@
+title "validate from the bundle root"
+trace $CLI bundle validate -o json | jq .resources.alerts.myalert
+
+title "validate from a subdirectory of the bundle"
+cd resources
+trace $CLI bundle validate -o json | jq .resources.alerts.myalert

acceptance/bundle/resources/alerts/with_file_run_from_subdir/script

@@ -0,0 +1,3 @@
+Local = true
+RecordRequests = false
+Ignore = [".databricks"]

acceptance/bundle/resources/alerts/with_file_run_from_subdir/test.toml

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
 	"slices"
 	"strings"
 
@@ -63,7 +64,7 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 		// No other fields other than allowedInYAML should be set in the bundle YAML.
 		m, ok := alertV.AsMap()
 		if !ok {
-			return diag.FromErr(fmt.Errorf("internal error: alert value is not a map: %w", err))
+			return diag.FromErr(fmt.Errorf("internal error: alert value is not a map, got %s", alertV.Kind()))
 		}
 
 		for _, p := range m.Pairs() {
@@ -90,7 +91,15 @@ func (m *loadDBAlertFiles) Apply(ctx context.Context, b *bundle.Bundle) diag.Dia
 			}
 		}
 
-		content, err := os.ReadFile(alert.FilePath)
+		// NormalizePaths rewrote file_path to be relative to the bundle root, but the
+		// process working directory can be any directory within the bundle, so anchor
+		// the read to the bundle root. Absolute paths are kept as-is by NormalizePaths.
+		filePath := alert.FilePath
+		if !filepath.IsAbs(filePath) {
+			filePath = filepath.Join(b.BundleRootPath, filePath)
+		}
+
+		content, err := os.ReadFile(filePath)
 		if err != nil {
 			return diag.Diagnostics{
 				{

bundle/config/mutator/load_dbalert_files.go

@@ -79,3 +79,42 @@ func TestLoadDBAlertFiles(t *testing.T) {
 	assert.Equal(t, "abc123", b.Config.Resources.Alerts["my_alert"].WarehouseId)
 	assert.Equal(t, "SELECT * FROM table\nWHERE value > 100\n", b.Config.Resources.Alerts["my_alert"].QueryText)
 }
+
+func TestLoadDBAlertFilesRelativeToBundleRoot(t *testing.T) {
+	dir := t.TempDir()
+
+	alertJSON := `{
+  "query_lines": [
+    "SELECT 1"
+  ]
+}`
+
+	err := os.WriteFile(filepath.Join(dir, "alert.dbalert.json"), []byte(alertJSON), 0o644)
+	require.NoError(t, err)
+
+	b := &bundle.Bundle{
+		BundleRootPath: dir,
+		Config: config.Root{
+			Resources: config.Resources{
+				Alerts: map[string]*resources.Alert{
+					"my_alert": {
+						FilePath: "alert.dbalert.json",
+						AlertV2: sql.AlertV2{
+							DisplayName: "Test Alert",
+							WarehouseId: "abc123",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	bundletest.SetLocation(b, "resources.alerts.my_alert", []dyn.Location{{
+		File: filepath.Join(dir, "databricks.yml"),
+	}})
+
+	diags := bundle.Apply(t.Context(), b, mutator.LoadDBAlertFiles())
+	require.NoError(t, diags.Error())
+
+	assert.Equal(t, "SELECT 1\n", b.Config.Resources.Alerts["my_alert"].QueryText)
+}