Moved create-only to YANG

[bradleymoon-nexthop]

PR Description: Move create-only Fields to YANG Models

Why I did it

Currently, the CreateOnlyFilter inside generic_config_updater/patch_sorter.py utilizes a static, hardcoded list of lists (self.patterns) to identify which table fields are immutable (create-only). This makes the system rigid, difficult to maintain, and divorces schema properties from the validation layer as new tables or attributes are added to SONiC.

To solve this, this PR refactors CreateOnlyFilter to dynamically discover create-only annotations directly from the compiled YANG models using the custom ext:create-only YANG extension introduced in sonic-net/sonic-mgmt-common/pull/234

How I did it

• De-coupled direct libyang dependencies: Avoided direct imports of libyang inside sonic-utilities (conforming to .semgrep/no-direct-libyang.yml isolation guidelines). Instead, delegated all recursive schema-walking logic to the sonic_yang module through the new sy.get_create_only_fields() accessor.
• Transition Floor & Backward Compatibility:
  • Retained the original 26 hardcoded patterns as _CREATE_ONLY_FIELDS_FALLBACK to act as a fallback floor.
  • Rather than completely replacing the fallback, the YANG-discovered patterns are unioned with _CREATE_ONLY_FIELDS_FALLBACK. This ensures that if the system has an incomplete/partially annotated model set (e.g., during separate backports or transition windows on release branches), the baseline create-only protection remains active while logging a warning for any missing annotations.
  • Added an AttributeError catch block in _discover_create_only_fields to safely handle environments where config_wrapper is None (such as bare CLI contexts or unit test runs), defaulting cleanly to the fallback list.
  • Added in-place de-duplication of the final patterns to prevent duplicate runs across duplicate path matches.
• Performance Optimization: Memoized the discovery logic and shared a single PathAddressing instance across the three create-only filtering classes. This ensures that the schema subtree is walked once per process rather than multiple times per patch operation, avoiding FFI/libyang traversal overhead.

How to verify it

• Run the updated and renamed GCU unit tests:

  pytest tests/generic_config_updater/patch_sorter_test.py

• Verified that the test suite exercises the following scenarios:
  1. Parity validation: Confirming the fallback list and YANG-derived fields match expected create-only schemas.
  2. Spec-validated Mock testing: Ensuring the spec=[] mock exercises the fallback-only path safely when get_create_only_fields() is unavailable on-box during the migration window.
  3. No-accessor transition check: Asserting correct fallback engagement without crash when sonic_yang is initialized but the model package hasn't been upgraded.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: bradleymoon-nexthop / name: Bradley Moon (501c037)
• ✅ login: bradleymoon-nexthop / name: bradleymoon-nexthop (937a9cc)

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

Hi, there are workflow run(s) waiting for approval, you may be first-time contributor. I will notify maintainers to help approve once PR is approved. Thanks!

_{---Powered by SONiC BuildBot}