Fix resource references not correctly resolved in apps config section (#4964)

## Changes
Fix resource references not correctly resolved in apps config section

## Why
Fixes #4962

## Tests
Added an acceptance test

<!-- If your PR needs to be included in the release notes for next
release,
add a separate entry in NEXT_CHANGELOG.md as part of your PR. -->

Author: andrewnester

NEXT_CHANGELOG.md

@@ -12,6 +12,7 @@
 ### Bundles
 * Added support for lifecycle.started option for apps ([#4672](https://github.com/databricks/cli/pull/4672))
 * engine/direct: Fix permissions for resources.models ([#4941](https://github.com/databricks/cli/pull/4941))
+* Fix resource references not correctly resolved in apps config section ([#4964](https://github.com/databricks/cli/pull/4964))
 * Allow run_as for dashboards with embed_credentials set to false ([#4961](https://github.com/databricks/cli/pull/4961))
 * direct: Pass changed fields into update mask for apps instead of wildcard ([#4963](https://github.com/databricks/cli/pull/4963))
 

acceptance/bundle/resources/apps/resource-refs/app/app.py

@@ -0,0 +1,41 @@
+bundle:
+  name: resource-refs
+
+variables:
+  example_var:
+    default: "example_value"
+
+resources:
+  apps:
+    data_app:
+      name: "data-app"
+      source_code_path: ./app
+      description: "A Streamlit app that uses a SQL warehouse"
+      config:
+        command: ["streamlit", "run", "app.py"]
+        env:
+          - name: MY_EXAMPLE_SCHEMA
+            value: ${resources.schemas.example.catalog_name}
+          - name: MY_EXAMPLE_JOB
+            value: ${resources.jobs.example_job.name}
+          - name: MY_EXAMPLE_JOB_ID
+            value: ${resources.jobs.example_job.id}
+          - name: MY_EXAMPLE_VAR
+            value: ${var.example_var}
+  schemas:
+    example:
+      name: "example_schema"
+      catalog_name: "main"
+
+  jobs:
+    example_job:
+      name: "example_job"
+      tasks:
+        - task_key: "example_task"
+          spark_python_task:
+            python_file: "./app/app.py"
+          environment_key: "default"
+      environments:
+        - environment_key: "default"
+          spec:
+            client: "1"

acceptance/bundle/resources/apps/resource-refs/databricks.yml

@@ -0,0 +1,65 @@
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/resource-refs/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] bundle run data_app
+✓ Getting the status of the app data-app
+✓ App is in RUNNING state
+✓ App compute is in STOPPED state
+✓ Starting the app data-app
+✓ App is starting...
+✓ App is started!
+✓ Deployment succeeded
+You can access the app at data-app-123.cloud.databricksapps.com
+
+>>> print_requests.py //apps
+{
+  "method": "POST",
+  "path": "/api/2.0/apps",
+  "q": {
+    "no_compute": "true"
+  },
+  "body": {
+    "description": "A Streamlit app that uses a SQL warehouse",
+    "name": "data-app"
+  }
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/data-app/start",
+  "body": {}
+}
+{
+  "method": "POST",
+  "path": "/api/2.0/apps/data-app/deployments",
+  "body": {
+    "command": [
+      "streamlit",
+      "run",
+      "app.py"
+    ],
+    "env_vars": [
+      {
+        "name": "MY_EXAMPLE_SCHEMA",
+        "value": "main"
+      },
+      {
+        "name": "MY_EXAMPLE_JOB",
+        "value": "example_job"
+      },
+      {
+        "name": "MY_EXAMPLE_JOB_ID",
+        "value": "[NUMID]"
+      },
+      {
+        "name": "MY_EXAMPLE_VAR",
+        "value": "example_value"
+      }
+    ],
+    "mode": "SNAPSHOT",
+    "source_code_path": "/Workspace/Users/[USERNAME]/.bundle/resource-refs/default/files/app"
+  }
+}

acceptance/bundle/resources/apps/resource-refs/out.test.toml

@@ -0,0 +1,3 @@
+trace $CLI bundle deploy
+trace $CLI bundle run data_app
+trace print_requests.py //apps

acceptance/bundle/resources/apps/resource-refs/output.txt

@@ -0,0 +1,2 @@
+Local = true
+Cloud = false

acceptance/bundle/resources/apps/resource-refs/script

@@ -11,6 +11,9 @@ import (
 	"github.com/databricks/cli/bundle/config/resources"
 	"github.com/databricks/cli/bundle/run/output"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/dyn"
+	"github.com/databricks/cli/libs/dyn/convert"
+	"github.com/databricks/cli/libs/dyn/dynvar"
 	"github.com/databricks/databricks-sdk-go/service/apps"
 	"github.com/spf13/cobra"
 )
@@ -135,10 +138,59 @@ func (a *appRunner) start(ctx context.Context) error {
 
 func (a *appRunner) deploy(ctx context.Context) error {
 	w := a.bundle.WorkspaceClient()
-	deployment := appdeploy.BuildDeployment(a.app.SourceCodePath, a.app.Config, a.app.GitSource)
+	config, err := a.resolvedConfig()
+	if err != nil {
+		return err
+	}
+	deployment := appdeploy.BuildDeployment(a.app.SourceCodePath, config, a.app.GitSource)
 	return appdeploy.Deploy(ctx, w, a.app.Name, deployment)
 }
 
+// resolvedConfig returns the app config with any ${resources.*} variable references
+// resolved against the current bundle state. This is needed because the app runtime
+// configuration (env vars, command) can reference other bundle resources whose
+// properties are known only after the initialization phase.
+func (a *appRunner) resolvedConfig() (*resources.AppConfig, error) {
+	if a.app.Config == nil {
+		return nil, nil
+	}
+
+	root := a.bundle.Config.Value()
+
+	// Normalize the full config so that all typed fields are present, even those
+	// not explicitly set. This allows looking up resource properties by path.
+	normalized, _ := convert.Normalize(a.bundle.Config, root, convert.IncludeMissingFields)
+
+	// Get the app's config section as a dyn.Value to resolve references in it.
+	// The key is of the form "apps.<name>", so the full path is "resources.apps.<name>.config".
+	configPath := dyn.MustPathFromString("resources." + a.Key() + ".config")
+	configV, err := dyn.GetByPath(root, configPath)
+	if err != nil || !configV.IsValid() {
+		return a.app.Config, nil
+	}
+
+	resourcesPrefix := dyn.MustPathFromString("resources")
+
+	// Resolve ${resources.*} references in the app config against the full bundle config.
+	// Other variable types (bundle.*, workspace.*, variables.*) are already resolved
+	// during the initialization phase and are left in place if encountered here.
+	resolved, err := dynvar.Resolve(configV, func(path dyn.Path) (dyn.Value, error) {
+		if !path.HasPrefix(resourcesPrefix) {
+			return dyn.InvalidValue, dynvar.ErrSkipResolution
+		}
+		return dyn.GetByPath(normalized, path)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var config resources.AppConfig
+	if err := convert.ToTyped(&config, resolved); err != nil {
+		return nil, err
+	}
+	return &config, nil
+}
+
 func (a *appRunner) Cancel(ctx context.Context) error {
 	// We should cancel the app by stopping it.
 	app := a.app