feat: add validation for ng/cz input

[ambermingxin]

Description

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• New Features

  • Enhanced validation for enrollment configuration flags with stricter character format and length requirements.
  • Added pair validation requiring optional configuration flags to be both set or both unset together.

• Bug Fixes

  • Improved metadata persistence to consistently apply all updates without conditional skipping.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d982f25b-5602-4862-90a0-9eb5179e079b

📥 Commits

Reviewing files that changed from the base of the PR and between d16c53c and 1f3e767.

📒 Files selected for processing (1)

• third_party/fleet-intelligence-sdk/pkg/metadata/metadata.go

---

📝 Walkthrough

Walkthrough

This PR tightens enrollment metadata validation and simplifies metadata persistence. The enrollment command now validates --node-group and --compute-zone for reserved names, format, and length, rejects explicit "Unassigned", and enforces that both flags must be provided together or both omitted. SetMetadata switches from conditional read-then-insert/update to a single SQLite upsert, enabling value transitions including empty states.

Changes

Enrollment metadata validation and storage

Layer / File(s)	Summary
Enrollment metadata field validation cmd/fleetint/enroll.go, cmd/fleetint/enroll_test.go	Introduces enrollMetadataNamePattern regex and validatedOptionalMetadataFlagValue helper enforcing unset-vs-explicit-empty semantics, reserved-name rejection, 255-character limit, and format rules. Adds validateReservedPairMetadata to ensure --node-group and --compute-zone are both omitted, both empty, or both non-empty. enrollCommand uses these helpers. Tests cover invalid characters, overlong names, reserved names, pair consistency, and CLI rejection cases.
Metadata storage upsert and transition tests third_party/fleet-intelligence-sdk/pkg/metadata/metadata.go, third_party/fleet-intelligence-sdk/pkg/metadata/metadata_test.go	Replaces conditional read-then-insert/update in SetMetadata with single SQLite INSERT ... ON CONFLICT(key) DO UPDATE upsert. Adds test confirming metadata values can transition from non-empty to empty and back to non-empty.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• NVIDIA/fleet-intelligence-agent#200: Earlier PR threading --nodegroup and --compute-zone into enrollment.EnrollMetadata; this PR adds stricter validation rules (regex, length, reserved pair enforcement) building on that foundation.

Suggested reviewers

• mukilsh

Poem

🐰 Metadata's stricter now, no mischief allowed,
Reserved names forbidden, validation so proud!
Upsert simplifies storage, transitions flow free,
From empty to full and back, no conflicts we see! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title "feat: add validation for ng/cz input" is concise and directly reflects the main changes: adding stricter validation for the optional --node-group and --compute-zone enrollment metadata flags.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-ng-cz-validation

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcc526e5c9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/inventory/sink/backend.go`:
- Line 104: The current log line uses log.Logger.Infow to emit the entire
NodeUpsertRequest (variable req), which may contain sensitive
host/system/network identifiers; change the logging to only include a minimal,
non-sensitive subset (e.g., nodeUUID and a high-level action/status) or a
redacted/sanitized version of req, or demote the full payload to Debug level.
Locate the Infow call that logs "inventory export to backend" and replace it so
it does not print req raw—either construct a small map of safe fields to log
(avoid host/system/network ids) or call log.Logger.Debugw with a scrubbed copy
of req instead. Ensure the unique symbols referenced are log.Logger.Infow, the
message "inventory export to backend", the req variable (NodeUpsertRequest) and
nodeUUID so reviewers can find and update the log correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f3c80ecc-5b65-4e94-8be2-e7f114fc4dd7

📥 Commits

Reviewing files that changed from the base of the PR and between 58eacee and dcc526e.

📒 Files selected for processing (5)

• cmd/fleetint/enroll.go
• cmd/fleetint/enroll_test.go
• internal/inventory/sink/backend.go
• third_party/fleet-intelligence-sdk/pkg/metadata/metadata.go
• third_party/fleet-intelligence-sdk/pkg/metadata/metadata_test.go

[coderabbitai]

🧹 Nitpick comments (1)

cmd/fleetint/enroll.go (1)

163-178: ⚡ Quick win

Add a comment explaining the paired validation business rule.

The function correctly enforces that --node-group and --compute-zone must be both omitted, both empty, or both non-empty, but there's no comment explaining why this pairing constraint exists. Adding documentation will help future maintainers understand the business logic behind this validation.

📝 Suggested documentation

+// validateReservedPairMetadata enforces that node-group and compute-zone are used
+// together as a composite assignment: both must be omitted (no assignment), both
+// empty (clear assignment), or both non-empty (set assignment).
 func validateReservedPairMetadata(nodeGroup, computeZone *string) error {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/fleetint/enroll.go` around lines 163 - 178, Add a concise comment above
the validateReservedPairMetadata function that documents the business rule:
explain that --node-group and --compute-zone form a paired option set and
therefore must be specified together (both omitted, both empty strings, or both
non-empty) because the system treats them as a linked reservation identifier
(nodeGroup + computeZone) and partial values are ambiguous/invalid; reference
the parameter names nodeGroup and computeZone and the function
validateReservedPairMetadata so future maintainers understand the intended
constraint and rationale.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@cmd/fleetint/enroll.go`:
- Around line 163-178: Add a concise comment above the
validateReservedPairMetadata function that documents the business rule: explain
that --node-group and --compute-zone form a paired option set and therefore must
be specified together (both omitted, both empty strings, or both non-empty)
because the system treats them as a linked reservation identifier (nodeGroup +
computeZone) and partial values are ambiguous/invalid; reference the parameter
names nodeGroup and computeZone and the function validateReservedPairMetadata so
future maintainers understand the intended constraint and rationale.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 27730244-7959-4cbb-9a54-bb63c646ddf3

📥 Commits

Reviewing files that changed from the base of the PR and between dcc526e and d16c53c.

📒 Files selected for processing (2)

• cmd/fleetint/enroll.go
• cmd/fleetint/enroll_test.go