kdeploy 1.3.5 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca352bd1378382e30e5b258fd620e63a31daafadeb9a4ea54975efc9937b452d
-  data.tar.gz: d49e37b0c7fa428f3dacd0db5abe77388864e0d214bbddfb9bdc71f71385b0d8
+  metadata.gz: 8f48ad2c400882c0c590c830ae5f2a0e2a29d1a5bd2c978100fcd55f7f2df609
+  data.tar.gz: 3490c322e7f539ba8bd2daccd20c3d5176bdfe9e4e03ee051c696a041d57eadc
 SHA512:
-  metadata.gz: 54f4e120d476fa41c117b80bc5918a87be836fe224a19a23b3a32b8581a86e205405ff4c7e9e24495956f39e210d27d8daccd1ab52e5417988a7f7393cce7037
-  data.tar.gz: 49e08ea10d3ceee0887bac60b919dc17cc34258c3ffc5538df45015ad2c081c17019e62b3c96a42583b2ba62481e14e0aa8a1d3632c8ab17e03447e3ee8b39d5
+  metadata.gz: dd89c966452448bc952599312847c7996abd6956e0d6575c6b305b8860bcfaefcf525191819662498b317af58a4378746a882cea0e19a127ae52902a77a8fcf9
+  data.tar.gz: bd1f54080f1ddbdbb27be6ff053e744052d5a5bbda309a02879bb04f88fd51af74179170d7a27e9776fe5e66c55929cdf1ee0579a95f36c724cd3b95bd703f0a

data/CHANGELOG.md

@@ -0,0 +1,80 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.4.1] - 2026-11-12
+
+### Added
+
+- `--report PATH` JSON execution report (`version`, `generated_at`, per-task hosts/steps)
+- `--tags` task filter; `task ..., tags:`
+- `vars` / `--extra-vars` with `%{name}` interpolation in steps
+- `wait_port` / `wait_http` readiness steps (local probes)
+- `on_failure { ... }` cleanup steps after a failed host step
+- CI: Ruby 3.1/3.2/3.3 matrix; lab workflow on `docker/lab` / `lib` PRs
+
+### Changed
+
+- Default `verify_host_key` is `accept_new` (was `never`)
+- Task plans are `{ commands:, on_failure: }` via per-invocation `TaskContext` (parallel-safe)
+
+### Fixed
+
+- Host timeout clock / abort path; sudo multi-line packing; inventory warnings (carry-over from 1.3.5+)
+
+## [1.3.5] - 2026-11-12
+
+### Added
+
+- Open-source packaging: `LICENSE`, `CHANGELOG.md`, `SECURITY.md`
+- CI: RSpec + RuboCop before RubyGems publish; weekly Docker lab workflow
+- Safer timeout handling (`Executor#abort!`), sudo password hardening, inventory warnings
+
+### Changed
+
+- Rakefile default task is `spec` (no longer auto bump/push)
+
+### Fixed
+
+- Missing SSH exit status treated as failure
+- Auth / argument errors no longer retried as transport failures
+- Sudo upload paths escaped; inventory cleared between `execute` loads
+- Host timeout clock starts when work is scheduled
+
+## [1.3.0] - 2026-07-07
+
+### Added
+
+- `docker/lab` multi-distro Compose integration lab
+
+## [1.2.0] - 2026-07-07
+
+### Changed
+
+- Project focused on CLI gem (Web Job Console removed)
+
+## [1.1.0] - 2026-07-07
+
+### Fixed
+
+- Exit code 1 when no hosts match
+- Config load from task directory; `KDEPLOY_*` env overrides
+
+## [1.0.0] - 2026-07-07
+
+### Added
+
+- Initial public CLI: DSL, Runner, SSH/SCP sync, dry-run, JSON output
+
+[Unreleased]: https://github.com/kevin197011/kdeploy/compare/v1.4.1...HEAD
+[1.4.1]: https://github.com/kevin197011/kdeploy/compare/v1.3.5...v1.4.1
+[1.3.5]: https://github.com/kevin197011/kdeploy/compare/v1.3.4...v1.3.5
+[1.3.0]: https://github.com/kevin197011/kdeploy/releases/tag/v1.3.0
+[1.2.0]: https://github.com/kevin197011/kdeploy/releases/tag/v1.2.0
+[1.1.0]: https://github.com/kevin197011/kdeploy/releases/tag/v1.1.0
+[1.0.0]: https://github.com/kevin197011/kdeploy/releases/tag/v1.0.0

data/CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing
+
+Thanks for considering a contribution.
+
+## Setup
+
+```bash
+git clone git@github.com:kevin197011/kdeploy.git
+cd kdeploy
+bundle install
+bundle exec rspec
+bundle exec rubocop
+```
+
+Optional multi-host lab:
+
+```bash
+cd docker/lab
+docker compose up -d --build
+docker compose --profile test up --build runner
+```
+
+## Pull requests
+
+1. Use a feature branch.
+2. Keep diffs focused; follow existing style (`frozen_string_literal`, RuboCop).
+3. Add or update RSpec for behavior changes.
+4. Use [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `docs:`, …).
+5. Do **not** run `rake push` / `push.rb` unless you are a maintainer releasing — the default Rake task is `spec`.
+   Maintainer `rake push` runs RuboCop `-A`, RSpec, patch-bumps `lib/kdeploy/version.rb` only, then commit/pull --rebase/push (does **not** `git add .`).
+
+## Scope
+
+Please keep changes aligned with [docs/REQUIREMENTS.md](docs/REQUIREMENTS.md) non-goals
+(no agent, no Chef-style convergence engine, no Web UI).

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 kk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -26,7 +26,7 @@
 - 无代理 SSH 远程执行，多主机并发
 - Ruby DSL：主机、角色、任务；Chef 风格资源（`package`、`service`、`template`、`sync` 等）
 - 文件上传、ERB 模板、目录同步（可选 rsync 快速路径）
-- 试运行、JSON 输出、重试/超时策略
+- 试运行、JSON 输出/`--report`、`--tags` / `--extra-vars`、`wait_*` / `on_failure`、重试/超时策略
 
 **技术栈**：Ruby、Thor、net-ssh、concurrent-ruby
 
@@ -77,17 +77,27 @@ kdeploy execute deploy.rb deploy_web             # 执行
 
 ## 配置
 
-项目根目录可放 `.kdeploy.yml`（从当前目录向上查找）：
+项目根目录可放 `.kdeploy.yml`（从当前目录向上查找）。重试策略示例：`retry_policy.example.json`
+
+## 非目标
+
+Kdeploy **不是** Ansible/Chef 收敛引擎，也 **没有** Web UI / Agent。边界见 [docs/REQUIREMENTS.md](docs/REQUIREMENTS.md)。
+
+## 安全注意
+
+- 默认 `verify_host_key: accept_new`。更严用 `always`；临时 lab 才用 `never`。
+- 优先 SSH 密钥 + NOPASSWD sudo；任务文件若含密码视为机密。
+- 详见 [SECURITY.md](SECURITY.md)
+
+配置示例：
 
 ```yaml
 parallel: 10
 ssh_timeout: 30
-verify_host_key: never
+verify_host_key: accept_new
 retries: 0
 ```
 
-重试策略示例：`retry_policy.example.json`
-
 ## 示例
 
 ```bash
@@ -110,11 +120,11 @@ bundle exec rubocop
 
 ## 贡献
 
-Fork → 功能分支 → 测试通过 → PR。提交信息遵循 [Conventional Commits](https://www.conventionalcommits.org/)。
+见 [CONTRIBUTING.md](CONTRIBUTING.md)。Fork → 功能分支 → 测试通过 → PR。提交信息遵循 [Conventional Commits](https://www.conventionalcommits.org/)。
 
 ## 许可证
 
-[MIT](https://opensource.org/licenses/MIT)
+[MIT](LICENSE) · [变更记录](CHANGELOG.md) · [安全策略](SECURITY.md) · [贡献指南](CONTRIBUTING.md)
 
 ## 链接
 

data/README_EN.md

@@ -26,7 +26,7 @@ Define hosts and tasks in Ruby DSL; execute deployments and configuration across
 - Agentless SSH execution with multi-host concurrency
 - Ruby DSL: hosts, roles, tasks; Chef-style resources (`package`, `service`, `template`, `sync`, etc.)
 - File upload, ERB templates, directory sync (optional rsync fast path)
-- Dry-run, JSON output, retry/timeout policies
+- Dry-run, JSON output/`--report`, `--tags` / `--extra-vars`, `wait_*` / `on_failure`, retry/timeout policies
 
 **Stack**: Ruby, Thor, net-ssh, concurrent-ruby
 
@@ -77,17 +77,28 @@ Common flags: `--limit web01`, `--parallel 5`, `--format json`, `--retries 3`. S
 
 ## Configuration
 
-Place `.kdeploy.yml` in your project (walks up from CWD):
+Place `.kdeploy.yml` in your project (walks up from CWD). Retry policy examples: `retry_policy.example.json`
+
+## Non-goals
+
+Kdeploy is **not** an Ansible/Chef convergence engine and has **no** Web UI / agent. See [docs/REQUIREMENTS.md](docs/REQUIREMENTS.md).
+
+## Security
+
+- Default `verify_host_key` is `accept_new`. Prefer `always` for locked fleets; use `never` only for ephemeral labs.
+- Prefer SSH keys and NOPASSWD sudo; treat task files with passwords as secrets.
+- See [SECURITY.md](SECURITY.md)
+
+Example:
 
 ```yaml
 parallel: 10
 ssh_timeout: 30
-verify_host_key: never
+# Production:
+verify_host_key: accept_new
 retries: 0
 ```
 
-Retry policy examples: `retry_policy.example.json`
-
 ## Samples
 
 ```bash
@@ -110,11 +121,11 @@ Requirements and acceptance criteria: [docs/REQUIREMENTS.md](docs/REQUIREMENTS.m
 
 ## Contributing
 
-Fork → feature branch → tests pass → PR. Use [Conventional Commits](https://www.conventionalcommits.org/).
+See [CONTRIBUTING.md](CONTRIBUTING.md). Fork → feature branch → tests pass → PR. Use [Conventional Commits](https://www.conventionalcommits.org/).
 
 ## License
 
-[MIT](https://opensource.org/licenses/MIT)
+[MIT](LICENSE) · [Changelog](CHANGELOG.md) · [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md)
 
 ## Links
 

data/SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.4.x   | Yes       |
+| 1.3.x   | Best-effort |
+| < 1.3   | Best-effort only |
+
+## Reporting a vulnerability
+
+Please open a [GitHub Security Advisory](https://github.com/kevin197011/kdeploy/security/advisories/new)
+or email the maintainer listed in the gemspec. Do **not** file a public issue for
+unfixed vulnerabilities that could lead to remote code execution or credential theft.
+
+We aim to acknowledge reports within 7 days.
+
+## Important defaults
+
+Kdeploy defaults `verify_host_key` to `accept_new` (first-seen host keys are
+recorded). For locked-down fleets prefer `always`. Use `never` only on ephemeral
+lab hosts:
+
+```yaml
+verify_host_key: accept_new   # default
+# verify_host_key: always
+# verify_host_key: never      # labs only
+```
+
+Also prefer SSH keys and NOPASSWD sudo over embedding `password` / `sudo_password`
+in task files. Treat deploy task files as secrets if they contain credentials.
+
+## Scope
+
+Kdeploy executes operator-supplied shell over SSH. Malicious task files are out of
+scope; protect who can edit and run your deploy definitions.

data/lib/kdeploy/cli/cli.rb

@@ -57,14 +57,19 @@ module Kdeploy
     method_option :step_timeout, type: :numeric, desc: 'Per-step execution timeout seconds (default: none)'
     method_option :retry_policy, type: :string, desc: 'Retry policy JSON to override config file'
     method_option :retry_policy_file, type: :string, desc: 'Retry policy JSON file to override config file'
+    method_option :report, type: :string, desc: 'Write JSON execution report to PATH'
+    method_option :tags, type: :string, desc: 'Only run tasks with these tags (comma-separated)'
+    method_option :extra_vars, type: :string, desc: 'Extra vars key=value,key2=value2 (overrides DSL vars)'
     def execute(task_file, task_name = nil)
       @task_file_dir = File.dirname(File.expand_path(task_file))
       Configuration.load_for_execute(task_dir: @task_file_dir)
       show_banner_once
       load_task_file(task_file)
+      apply_extra_vars!
 
       tasks_to_run = determine_tasks(task_name)
       all_results = execute_tasks(tasks_to_run)
+      write_report_file(all_results) if options[:report]
 
       # Exit non-zero if any executed host failed or a task could not run.
       exit 1 if any_failed?(all_results) || @task_errors
@@ -82,6 +87,8 @@ module Kdeploy
 
     def load_task_file(file)
       validate_task_file(file)
+      # Avoid leaking hosts/roles/tasks across execute invocations in one process.
+      self.class.clear_inventory!
       # Use module_eval with top-level binding to keep heredoc compatible
       self.class.module_eval(File.read(file), file)
     rescue StandardError => e
@@ -125,7 +132,8 @@ module Kdeploy
     end
 
     def print_dry_run_for_host(name, config, task_name, formatter)
-      commands = self.class.kdeploy_tasks[task_name][:block].call
+      plan = Kdeploy::DSL.normalize_plan(self.class.kdeploy_tasks[task_name][:block].call)
+      commands = plan[:commands]
       output = commands.map { |cmd| formatter.format_command_for_dry_run(cmd) }.join("\n")
       title = "#{name} (#{config[:ip]})"
       puts formatter.format_dry_run_box(title, output)
@@ -184,7 +192,7 @@ module Kdeploy
         formatter.format_template_steps(steps, shown)
       when :sync
         formatter.format_sync_steps(steps, shown)
-      when :run
+      when :run, :wait_port, :wait_http
         formatter.format_run_steps(steps, shown)
       else
         []
@@ -228,14 +236,26 @@ module Kdeploy
     end
 
     def determine_tasks(task_name)
-      if task_name
-        sym = task_name.to_sym
-        raise TaskNotFoundError, task_name unless self.class.kdeploy_tasks.key?(sym)
+      selected =
+        if task_name
+          sym = task_name.to_sym
+          raise TaskNotFoundError, task_name unless self.class.kdeploy_tasks.key?(sym)
 
-        [sym]
-      else
-        self.class.kdeploy_tasks.keys
+          [sym]
+        else
+          self.class.kdeploy_tasks.keys
+        end
+
+      return selected unless options[:tags]
+
+      wanted = options[:tags].split(',').map(&:strip)
+      tagged = self.class.tasks_matching_tags(wanted)
+      filtered = selected.select { |name| tagged.include?(name) }
+      if filtered.empty?
+        puts Kdeploy::Banner.show_error("No tasks matched tags: #{wanted.join(', ')}")
+        @task_errors = true
       end
+      filtered
     end
 
     def execute_tasks(tasks_to_run)
@@ -366,7 +386,8 @@ module Kdeploy
 
     def print_dry_run_json(hosts, task_name)
       tasks = self.class.kdeploy_tasks
-      commands = tasks[task_name][:block].call
+      plan = Kdeploy::DSL.normalize_plan(tasks[task_name][:block].call)
+      commands = plan[:commands]
 
       payload = {
         task: task_name.to_s,
@@ -393,6 +414,7 @@ module Kdeploy
         command: step[:command],
         duration: step[:duration]
       }
+      out[:error] = step[:error] if step[:error]
 
       if step[:output].is_a?(Hash)
         out[:stdout] = step[:output][:stdout]
@@ -423,6 +445,10 @@ module Kdeploy
           fast: cmd[:fast],
           parallel: cmd[:parallel]
         }
+      when :wait_port
+        { type: 'wait_port', port: cmd[:port], timeout: cmd[:timeout], interval: cmd[:interval] }
+      when :wait_http
+        { type: 'wait_http', url: cmd[:url], timeout: cmd[:timeout], interval: cmd[:interval], code: cmd[:code] }
       else
         { type: cmd[:type].to_s }
       end
@@ -489,5 +515,34 @@ module Kdeploy
     rescue JSON::ParserError, Psych::SyntaxError => e
       raise ArgumentError, "retry_policy parse error: #{e.message}"
     end
+
+    def apply_extra_vars!
+      raw = options[:extra_vars]
+      return if raw.nil? || raw.strip.empty?
+
+      self.class.merge_extra_vars!(parse_extra_vars(raw))
+    end
+
+    def parse_extra_vars(raw)
+      raw.split(',').each_with_object({}) do |pair, acc|
+        key, value = pair.split('=', 2)
+        raise ArgumentError, "Invalid --extra-vars pair: #{pair}" if key.nil? || value.nil?
+
+        acc[key.strip.to_sym] = value.strip
+      end
+    end
+
+    def write_report_file(all_results)
+      path = options[:report]
+      payload = {
+        version: Kdeploy::VERSION,
+        generated_at: Time.now.utc.strftime('%Y-%m-%dT%H:%M:%SZ'),
+        tasks: all_results.transform_keys(&:to_s).transform_values do |task_results|
+          task_results.transform_values { |r| serialize_host_result(r) }
+        end
+      }
+      File.write(path, JSON.pretty_generate(payload))
+      warn "Report written: #{path}" unless options[:format] == 'json'
+    end
   end
 end

data/lib/kdeploy/cli/help_formatter.rb

@@ -35,6 +35,9 @@ module Kdeploy
         #{@pastel.dim('    --retries N')}                Retry count for network operations (default: 0; overridden by .kdeploy.yml)
         #{@pastel.dim('    --retry-delay SECONDS')}      Retry delay seconds (default: 1; overridden by .kdeploy.yml)
         #{@pastel.dim('    --retry-on-nonzero')}         Retry commands on nonzero exit status (default: false; overridden by .kdeploy.yml)
+        #{@pastel.dim('    --report PATH')}              Write JSON report to PATH
+        #{@pastel.dim('    --tags TAGS')}                Only run tasks matching tags
+        #{@pastel.dim('    --extra-vars K=V,...')}       Set/override DSL vars
         #{@pastel.dim('    --timeout SECONDS')}          Per-host execution timeout seconds (default: none; overridden by .kdeploy.yml)
         #{@pastel.dim('    --step-timeout SECONDS')}     Per-step execution timeout seconds (default: none; overridden by .kdeploy.yml)
         #{@pastel.dim('    --retry-policy JSON')}        Retry policy JSON (overrides .kdeploy.yml)
@@ -68,6 +71,9 @@ module Kdeploy
         #{@pastel.dim('# Machine-readable output')}
         #{@pastel.bright_cyan('kdeploy execute deploy.rb deploy_web --format json --no-banner')}
 
+        #{@pastel.dim('# Tags, vars, and JSON report')}
+        #{@pastel.bright_cyan('kdeploy execute deploy.rb --tags web --extra-vars app=demo --report out.json')}
+
         #{@pastel.dim('# Retry transient network failures')}
         #{@pastel.bright_cyan('kdeploy execute deploy.rb deploy_web --retries 3 --retry-delay 1')}
       EXAMPLES

data/lib/kdeploy/config/configuration.rb

@@ -7,7 +7,7 @@ module Kdeploy
   class Configuration
     DEFAULT_PARALLEL = 10
     DEFAULT_SSH_TIMEOUT = 30
-    DEFAULT_VERIFY_HOST_KEY = :never
+    DEFAULT_VERIFY_HOST_KEY = :accept_new
     DEFAULT_RETRIES = 0
     DEFAULT_RETRY_DELAY = 1
     DEFAULT_HOST_TIMEOUT = nil
@@ -49,7 +49,12 @@ module Kdeploy
         config_path ||= find_config_file
         return unless config_path && File.exist?(config_path)
 
-        config = YAML.safe_load_file(config_path, permitted_classes: [Symbol])
+        raw = File.read(config_path)
+        config = begin
+          YAML.safe_load(raw, permitted_classes: [Symbol])
+        rescue ArgumentError
+          YAML.safe_load(raw, [Symbol])
+        end
         apply_config(config)
       rescue StandardError => e
         warn "Warning: Failed to load config from #{config_path}: #{e.message}"