SNOW-3202210: Implement snow validate-image CLI command

[sfc-gh-ajiang]

Pre-review checklist

• I've confirmed that instructions included in README.md are still correct after my changes in the codebase.
• I've added or updated automated unit tests to verify correctness of my new code.
• I've added or updated integration tests to verify correctness of my new code.
• I've confirmed that my changes are working by executing CLI's commands manually on MacOS.
• I've confirmed that my changes are working by executing CLI's commands manually on Windows.
• I've confirmed that my changes are up-to-date with the target branch.
• I've described my changes in the release notes.
• I've described my changes in the section below.
• I've described my changes in the documentation.

Changes description

• support configuring the checks in the YAML file

  • entrypoint check
  • env vars check
  • required packages check
  • vulnerability check
  • dependency check

• Test report: https://docs.google.com/document/d/1zQWrq62KWWtRlXTkDRZki7A12lLHkoT4w--KJS0ilpg/edit?tab=t.re7qb17krmd4

[sfc-gh-jijiang]

nit: The image_name is passed as image_hash. This is a bit confusing because it’s not clear whether we expect an image name (e.g. repo:tag) or an image hash/ID. Could we standardize the terminology end-to-end?

[sfc-gh-estevenson]

Why are we checking for vulnerabilities in the validate script? I thought we decided that the customer will own vuln scanning. If we provide this, it implies we are responsible for catching vulns?

[sfc-gh-ajiang]

Thanks for catching up this. I updated the vulnerability check to be the optional check. The default behavior is to skip this check

[graphite-app]

The function signature accepts **options but never uses them, and critical options shown in the help text (--config and --show-all) are not defined. The test snapshots (test_help_messages.ambr lines 4720-4724) show these options exist in the help output, but they're missing from the actual implementation. This mismatch will confuse users who see the options in help but can't use them.

def validate(
    image: str = typer.Argument(...),
    image_type: str = typer.Option("cpu", "--image-type", ...),
    config: Optional[Path] = typer.Option(None, "--config", "-c", ...),
    show_all: bool = typer.Option(False, "--show-all", ...),
) -> CommandResult:

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

[sfc-gh-ajiang]

**options this is required in snowflake-cli framework

[sfc-gh-ajiang]

For the whitelisted packages, I hardcoded them here. This is a public repo. We cannot hardcoded the credentials here to access the snowflake-image-builder. This means we should update the whitelist manually. Any concerns or any suggestions @sfc-gh-wesong

[sfc-gh-ajiang]

we cannot detect the base image via docker primitives. So we do not have any checks on the base image. And for the image type, GPU or CPU, we rely on users' input. If they do not specify the image type in the command, we will assume that the image is a CPU image