Add workflow label list filters

[jiaenren]

Summary

Issue - None

[OSMO-6501] Track B6 of the workflow-labels PR split.

• List endpoint gains repeatable label=key=value and no_label=key query filters (AND semantics across repeats).
• label values support * wildcards and non-nested (a|b) alternation; selectors compile server-side into fixed SQL predicate shapes with bound parameters: exact branches as GIN-indexable @> containment, wildcard branches as LIKE with _/%/escape-char escaping, OR-joined; a bare * collapses to a ? key-existence check. Both keys and values are bound (psycopg2 interpolates client-side, so the planner still sees literals and the GIN index stays eligible). No user-supplied regex — no ReDoS surface.
• no_label=key is NULL-inclusive (labels IS NULL OR NOT labels ? key) so pre-feature and unlabeled rows are counted; the warn-phase soak query depends on this.
• List responses include the labels map.
• Selector syntax and label keys are validated before query construction.

Depends on #1223 (admission). Extracted from prototype #1194.

Testing

• bazel test //src/service/core/workflow/tests:test_helpers (predicate shapes: containment/LIKE/existence, escaping, AND semantics, injection-syntax rejection before query, bound keys)
• bazel test //src/service/core/workflow/tests:test_workflow_label_filters_db (testcontainers Postgres: filters execute against real JSONB; the shipped workflow_labels_gin_idx is planner-eligible, asserted on plan shape since the isolation fixture regenerates index names; NULL-inclusive missing filter)
• bazel test //src/service/core/workflow/tests:test_workflow_service_units

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added workflow listing filters for matching labels, including wildcard and alternation patterns.
  • Added filters for workflows missing specified labels.
  • Workflow list responses now include label information.
  • Added validation with clear errors for invalid label filter expressions.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Workflow label filtering

Layer / File(s)	Summary
API parameters and forwarding src/service/core/workflow/workflow_service.py, src/service/core/workflow/tests/test_workflow_service_units.py	The listing endpoint accepts label and no_label query parameters and forwards them to get_workflows.
Label query construction and response labels src/service/core/workflow/helpers.py, src/service/core/workflow/objects.py, src/service/core/workflow/tests/test_helpers.py	Label selectors are validated and converted into escaped JSONB predicates; missing labels are filtered, and list entries now include labels.
Database and integration validation src/service/core/workflow/tests/BUILD, src/service/core/workflow/tests/test_workflow_label_filters_db.py	PostgreSQL-backed tests cover exact, wildcard, alternation, missing-label, NULL-label, and planner behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant list_workflow
  participant get_workflows
  participant PostgreSQL
  participant ListEntry
  Client->>list_workflow: label and no_label query parameters
  list_workflow->>get_workflows: validated filter inputs
  get_workflows->>PostgreSQL: JSONB label predicates
  PostgreSQL-->>get_workflows: matching workflow rows
  get_workflows->>ListEntry: construct entries with labels
  ListEntry-->>Client: workflow list response

Loading

Suggested reviewers: fernandol-nvidia, svc-osmo-ci

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding workflow list label filters.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jiaenr/osmo-6501-b6-label-filters

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.46%. Comparing base (7dd7977) to head (0ead5e3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1224      +/-   ##
==========================================
+ Coverage   66.42%   66.46%   +0.04%     
==========================================
  Files         201      201              
  Lines       25992    26023      +31     
  Branches     3924     3930       +6     
==========================================
+ Hits        17264    17295      +31     
  Misses       8021     8021              
  Partials      707      707              

Flag	Coverage Δ
backend	69.19% <100.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/service/core/workflow/helpers.py	99.66% <100.00%> (+0.03%)	⬆️
src/service/core/workflow/objects.py	66.28% <100.00%> (+0.05%)	⬆️
src/service/core/workflow/workflow_service.py	94.81% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

🧹 Nitpick comments (2)

src/service/core/workflow/workflow_service.py (1)

610-623: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Query() defaults mirror existing convention; B008 is a known FastAPI false positive.

The Ruff B008 warnings on these new params match the same fastapi.Query(default=...) pattern already used for every other parameter in this signature (e.g. users, statuses, pools). This is the documented FastAPI idiom, and Ruff's flake8-bugbear extend-immutable-calls setting is meant to suppress it for fastapi.Query. Not something to change here since it's consistent with the rest of the file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/service/core/workflow/workflow_service.py` around lines 610 - 623,
Preserve the fastapi.Query defaults and parameter definitions for label_filters
and missing_label_filters; no code change is needed. Treat the Ruff B008
warnings as covered by the existing fastapi.Query convention and configured
immutable-call exception used elsewhere in the same signature.

Source: Linters/SAST tools

src/service/core/workflow/helpers.py (1)

169-172: 🚀 Performance & Scalability | 🔵 Trivial

Missing-label negation can't use the GIN index the way positive filters do.

(workflows.labels IS NULL OR NOT (workflows.labels ? %s)) is a negation, so it likely falls back to a sequential scan even with the GIN index on workflows.labels present — the shipped test_shipped_gin_index_is_planner_eligible test only verifies planner-eligibility for the positive ? and @> predicates, not this negated path. Worth documenting as a known tradeoff, or considering a partial index if no_label filtering becomes a hot path on large tables.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/service/core/workflow/helpers.py` around lines 169 - 172, Document in the
missing_label_keys filtering path that the negated workflows.labels predicate is
not expected to use the GIN index, unlike the positive label predicates, and may
require a sequential scan. Keep the current filtering behavior unchanged; only
consider a partial-index optimization if no_label filtering becomes a measured
large-table hot path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/service/core/workflow/helpers.py`:
- Around line 169-172: Document in the missing_label_keys filtering path that
the negated workflows.labels predicate is not expected to use the GIN index,
unlike the positive label predicates, and may require a sequential scan. Keep
the current filtering behavior unchanged; only consider a partial-index
optimization if no_label filtering becomes a measured large-table hot path.

In `@src/service/core/workflow/workflow_service.py`:
- Around line 610-623: Preserve the fastapi.Query defaults and parameter
definitions for label_filters and missing_label_filters; no code change is
needed. Treat the Ruff B008 warnings as covered by the existing fastapi.Query
convention and configured immutable-call exception used elsewhere in the same
signature.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7d02106c-6a8f-4d99-8586-0a72eeaeb3bd

📥 Commits

Reviewing files that changed from the base of the PR and between 7dd7977 and 0ead5e3.

📒 Files selected for processing (7)

• src/service/core/workflow/helpers.py
• src/service/core/workflow/objects.py
• src/service/core/workflow/tests/BUILD
• src/service/core/workflow/tests/test_helpers.py
• src/service/core/workflow/tests/test_workflow_label_filters_db.py
• src/service/core/workflow/tests/test_workflow_service_units.py
• src/service/core/workflow/workflow_service.py