putpaws 0.0.9 → 0.1.0

data/lib/putpaws/ecs/tasks/ecs_task.rake

@@ -1,15 +1,23 @@
+require "shellwords"
 require "putpaws/prompt"
 require "putpaws/ecs/task_command"
+require "putpaws/ecs/run_command"
 
 namespace :ecs do
   desc "Set ECS task."
   task :set_task do
     aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
-    ecs_tasks = aws.list_ecs_tasks.map{|t| 
+    ecs_tasks = aws.list_ecs_tasks.map{|t|
       task_id = t.task_arn.split('/').last
       task_def = t.task_definition_arn.split('/').last
-      ["#{task_id} (#{task_def}) #{t.last_status}", t]
+      label = "#{task_id} (#{task_def}) #{t.last_status}"
+      label += " [#{t.group}]" unless t.group.to_s.start_with?('family:')
+      [label, t]
     }.to_h
+    if ecs_tasks.empty?
+      raise "No running ECS tasks found on cluster: #{aws.cluster}" +
+        (aws.task_name_prefix ? " (task_name_prefix: #{aws.task_name_prefix})" : "")
+    end
     prompt = Putpaws::Prompt.safe
     selected = prompt.select("Choose a task you're going to operate", ecs_tasks.keys)
     ecs_task = ecs_tasks[selected]
@@ -23,8 +31,8 @@ namespace :ecs do
     aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
     aws.ecs_task = ecs_task
     cmd = aws.get_attach_command(container: ENV['container'])
-    puts cmd
-    system(cmd)
+    puts Shellwords.join(cmd)
+    system(*cmd)
   end
 
   desc "Run port forwarding session. You need to enable ECS Exec on a specified task and also install session-manager-plugin."
@@ -44,7 +52,106 @@ namespace :ecs do
       remote_port: remote_port,
       local_port: local_port
     )
-    puts cmd
-    system(cmd)
+    puts Shellwords.join(cmd)
+    system(*cmd)
+  end
+
+  desc "Run a command on a temporary ECS task. The task terminates itself when the command finishes. (Ex) cmd='bundle exec rake db:migrate' wait=true"
+  task :run do
+    runner = Putpaws::Ecs::RunCommand.config(fetch(:app))
+    command = ENV['cmd']
+    if command.nil? || command.strip.empty?
+      raise "Please specify a command like: cmd='bundle exec rake db:migrate'"
+    end
+
+    ecs_task = runner.run_ecs_task(
+      command: command,
+      started_by: 'putpaws-run',
+      group: 'putpaws-run',
+      container: ENV['container']
+    )
+    task_id = ecs_task.task_arn.split('/').last
+    puts "Task started: #{task_id} [putpaws-run]"
+
+    if ENV['wait']
+      puts "Waiting for the task to stop..."
+      ecs_task = runner.wait_until_stopped(ecs_task.task_arn)
+      ctn_name = ENV['container'] || runner.container_name
+      ctn = ecs_task.containers.detect{|c| c.name == ctn_name}
+      exit_code = ctn && ctn.exit_code
+      puts "Task stopped: #{ecs_task.stopped_reason}"
+      raise "Command failed with exit code: #{exit_code.inspect}" unless exit_code == 0
+      puts "Command succeeded."
+    else
+      puts "The task terminates itself when the command finishes."
+    end
+  end
+
+  desc "Update ECS service with force new deployment (redeploy). (Ex) desired=2 taskdef=my-family wait=true"
+  task :deploy do
+    aws = Putpaws::Ecs::TaskCommand.config(fetch(:app))
+    service_name = aws.service
+    if service_name.nil?
+      services = aws.list_ecs_services
+      raise "No ECS services found on cluster: #{aws.cluster}" if services.empty?
+      service_name = if services.one?
+        services.first.service_name
+      else
+        prompt = Putpaws::Prompt.safe
+        prompt.select("Choose a service to update", services.map(&:service_name))
+      end
+    end
+
+    svc = aws.update_ecs_service(
+      service: service_name,
+      desired_count: ENV['desired'],
+      task_definition: ENV['taskdef']
+    )
+    task_def = svc.task_definition.to_s.split('/').last
+    puts "Deployment started: service=#{svc.service_name} task_definition=#{task_def} desired_count=#{svc.desired_count}"
+
+    if ENV['wait']
+      puts "Waiting for the service to be stable..."
+      aws.wait_ecs_service_stable(service: service_name)
+      puts "Service is stable."
+    else
+      puts "Check progress with: bundle exec putpaws #{fetch(:app).name} log:tailf"
+    end
+  end
+
+  desc "Launch a temporary ECS task for operation and attach to it. The task terminates itself when ttl passes (default 30m). (Ex) ttl=45m keep=true"
+  task :shell do
+    runner = Putpaws::Ecs::RunCommand.config(fetch(:app))
+    ttl = Putpaws::Ecs::RunCommand.parse_ttl(ENV['ttl'])
+
+    puts "Launching a temporary task which terminates itself after #{ttl} seconds"
+    ecs_task = runner.run_ecs_task(
+      command: "sleep #{ttl}",
+      started_by: 'putpaws-shell',
+      group: 'putpaws-shell'
+    )
+    task_id = ecs_task.task_arn.split('/').last
+    puts "Task started: #{task_id} [putpaws-shell]"
+
+    begin
+      puts "Waiting for the task to be attachable..."
+      ecs_task = runner.wait_until_attachable(ecs_task.task_arn)
+
+      aws = Putpaws::Ecs::TaskCommand.new(
+        region: runner.region,
+        cluster: runner.cluster_name
+      )
+      aws.ecs_task = ecs_task
+      cmd = aws.get_attach_command(container: ENV['container'] || runner.container_name)
+      puts Shellwords.join(cmd)
+      system(*cmd)
+    ensure
+      if ENV['keep']
+        puts "Task #{task_id} keeps running and terminates itself within #{ttl} seconds."
+      else
+        runner.stop_ecs_task(ecs_task.task_arn, reason: 'Stopped by putpaws ecs:shell')
+        puts "Task #{task_id} stopped."
+      end
+    end
   end
 end

data/lib/putpaws/iam/grant_command.rb

@@ -0,0 +1,205 @@
+require 'json'
+require 'uri'
+require 'putpaws/iam/operator_config'
+
+module Putpaws
+  module Iam
+    # Resolves operator managed policies idempotently.
+    # Policy names are derived from the profile name
+    # ({service}-operator-{profile}), so re-running converges to
+    # CREATE / UPDATE (new policy version) / SKIP instead of piling up policies.
+    # The group -> IAM action mapping lives here in code: when putpaws commands
+    # evolve, the next `iam:grant` surfaces the permission diff as an UPDATE.
+    class GrantCommand
+      GROUPS = %w[attach shell deploy logs codebuild scheduler]
+
+      attr_reader :app
+      def initialize(app:, account_id: nil, iam_client: nil, sts_client: nil)
+        @app = app
+        @account_id = account_id
+        @iam_client = iam_client
+        @sts_client = sts_client
+      end
+
+      def iam_client
+        @iam_client ||= begin
+          require 'aws-sdk-iam'
+          Aws::IAM::Client.new(region: app.region)
+        end
+      end
+
+      def sts_client
+        @sts_client ||= Aws::STS::Client.new(region: app.region)
+      end
+
+      def account_id
+        @account_id ||= sts_client.get_caller_identity.account
+      end
+
+      def region
+        app.region
+      end
+
+      def cluster_arn
+        "arn:aws:ecs:#{region}:#{account_id}:cluster/#{app.cluster}"
+      end
+
+      def policy_name(profile)
+        "#{app.name}-operator-#{profile.name}"
+      end
+
+      def policy_arn(profile)
+        "arn:aws:iam::#{account_id}:policy/#{policy_name(profile)}"
+      end
+
+      def build_policy_document(profile)
+        statements = profile.groups.flat_map{|g| statements_for(g.to_s)}
+        statements += (profile.extra_statements || [])
+        {Version: '2012-10-17', Statement: statements}
+      end
+
+      def current_document(profile)
+        policy = iam_client.get_policy(policy_arn: policy_arn(profile)).policy
+        ver = iam_client.get_policy_version(
+          policy_arn: policy_arn(profile),
+          version_id: policy.default_version_id
+        )
+        JSON.parse(URI.decode_www_form_component(ver.policy_version.document))
+      rescue Aws::IAM::Errors::NoSuchEntityException
+        nil
+      end
+
+      def plan(profile)
+        current = current_document(profile)
+        return :create if current.nil?
+        desired = JSON.parse(JSON.generate(build_policy_document(profile)))
+        current == desired ? :skip : :update
+      end
+
+      def apply!(profile)
+        doc = JSON.generate(build_policy_document(profile))
+        if current_document(profile).nil?
+          iam_client.create_policy(
+            policy_name: policy_name(profile),
+            policy_document: doc,
+            description: "putpaws operator policy for #{app.name} (profile: #{profile.name})"
+          )
+        else
+          prune_versions!(profile)
+          iam_client.create_policy_version(
+            policy_arn: policy_arn(profile),
+            policy_document: doc,
+            set_as_default: true
+          )
+        end
+        policy_arn(profile)
+      end
+
+      # Managed policies keep at most 5 versions.
+      def prune_versions!(profile)
+        versions = iam_client.list_policy_versions(policy_arn: policy_arn(profile)).versions
+        return if versions.size < 5
+        oldest = versions.reject(&:is_default_version).min_by(&:create_date)
+        return unless oldest
+        iam_client.delete_policy_version(policy_arn: policy_arn(profile), version_id: oldest.version_id)
+      end
+
+      def statements_for(group)
+        case group
+        when 'attach'
+          [
+            {Sid: 'AttachListTasks', Effect: 'Allow',
+             Action: %w[ecs:ListTasks ecs:DescribeTasks],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'AttachExec', Effect: 'Allow',
+             Action: %w[ecs:ExecuteCommand],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*"},
+            {Sid: 'AttachPortForward', Effect: 'Allow',
+             Action: %w[ssm:StartSession],
+             Resource: [
+               "arn:aws:ssm:#{region}::document/AWS-StartPortForwardingSessionToRemoteHost",
+               "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*",
+             ]},
+          ]
+        when 'shell'
+          prefix = app.task_name_prefix || app.name
+          [
+            {Sid: 'ShellRunTask', Effect: 'Allow',
+             Action: %w[ecs:RunTask ecs:StopTask],
+             Resource: [
+               "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{prefix}*",
+               "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{prefix}*:*",
+               "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*",
+             ]},
+            {Sid: 'ShellDescribeTasks', Effect: 'Allow',
+             Action: %w[ecs:DescribeTasks],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'ShellExec', Effect: 'Allow',
+             Action: %w[ecs:ExecuteCommand],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:task/#{app.cluster}/*"},
+            {Sid: 'ShellPassRole', Effect: 'Allow',
+             Action: %w[iam:PassRole],
+             Resource: "arn:aws:iam::#{account_id}:role/#{app.name}-*"},
+          ]
+        when 'deploy'
+          [
+            {Sid: 'DeployListServices', Effect: 'Allow',
+             Action: %w[ecs:ListServices],
+             Resource: '*',
+             Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
+            {Sid: 'DeployUpdateService', Effect: 'Allow',
+             Action: %w[ecs:UpdateService ecs:DescribeServices],
+             Resource: "arn:aws:ecs:#{region}:#{account_id}:service/#{app.cluster}/#{app.service || '*'}"},
+          ]
+        when 'logs'
+          r = app.log_region || region
+          [
+            {Sid: 'LogsDescribeGroups', Effect: 'Allow',
+             Action: %w[logs:DescribeLogGroups],
+             Resource: "arn:aws:logs:#{r}:#{account_id}:log-group:*"},
+            {Sid: 'LogsRead', Effect: 'Allow',
+             Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
+             Resource: [
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.log_group_prefix}*",
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.log_group_prefix}*:*",
+             ]},
+          ]
+        when 'codebuild'
+          r = app.build_region || region
+          [
+            {Sid: 'BuildList', Effect: 'Allow',
+             Action: %w[codebuild:ListProjects],
+             Resource: '*'},
+            {Sid: 'BuildStart', Effect: 'Allow',
+             Action: %w[codebuild:StartBuild codebuild:StopBuild codebuild:BatchGetBuilds codebuild:BatchGetProjects],
+             Resource: "arn:aws:codebuild:#{r}:#{account_id}:project/#{app.build_project_name_prefix}*"},
+            {Sid: 'BuildLogsRead', Effect: 'Allow',
+             Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
+             Resource: [
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.build_log_group_prefix}*",
+               "arn:aws:logs:#{r}:#{account_id}:log-group:#{app.build_log_group_prefix}*:*",
+             ]},
+          ]
+        when 'scheduler'
+          scheduler_role = (app.target && app.target.scheduler_role) ||
+            "arn:aws:iam::#{account_id}:role/#{app.name}-*"
+          [
+            {Sid: 'ScheduleList', Effect: 'Allow',
+             Action: %w[scheduler:ListSchedules],
+             Resource: '*'},
+            {Sid: 'ScheduleManage', Effect: 'Allow',
+             Action: %w[scheduler:GetSchedule scheduler:CreateSchedule scheduler:UpdateSchedule],
+             Resource: "arn:aws:scheduler:#{region}:#{account_id}:schedule/default/*"},
+            {Sid: 'SchedulePassRole', Effect: 'Allow',
+             Action: %w[iam:PassRole],
+             Resource: scheduler_role},
+          ]
+        else
+          raise "Unknown group: #{group} (available: #{GROUPS.join(', ')})"
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/iam/iam_task.rb

@@ -0,0 +1 @@
+load File.expand_path("../tasks/iam_task.rake", __FILE__)

data/lib/putpaws/iam/operator_config.rb

@@ -0,0 +1,46 @@
+require 'json'
+require 'pathname'
+
+module Putpaws
+  module Iam
+    # Named operator profiles declared in .putpaws/operators.json.
+    # A profile gives an organization-level name (Ex: developer, viewer)
+    # to a combination of putpaws command groups.
+    class OperatorConfig < Struct.new(:name, :groups, :extra_statements, keyword_init: true)
+      EXAMPLE = {
+        developer: {groups: %w[attach shell deploy logs codebuild]},
+        viewer: {groups: %w[logs]},
+      }
+
+      def self.path(path_prefix: '.putpaws')
+        Pathname.new(path_prefix).join('operators.json')
+      end
+
+      def self.exist?(path_prefix: '.putpaws')
+        path(path_prefix: path_prefix).exist?
+      end
+
+      def self.scaffold!(path_prefix: '.putpaws')
+        p = path(path_prefix: path_prefix)
+        File.write(p, JSON.pretty_generate(EXAMPLE) + "\n")
+        p.to_s
+      end
+
+      def self.load(path_prefix: '.putpaws')
+        p = path(path_prefix: path_prefix)
+        return {} unless p.exist?
+        JSON.parse(File.read(p), symbolize_names: true)
+      end
+
+      def self.all(path_prefix: '.putpaws')
+        load(path_prefix: path_prefix).map{|k, v|
+          new(name: k.to_s, groups: v[:groups] || [], extra_statements: v[:extra_statements] || [])
+        }
+      end
+
+      def self.find(name, path_prefix: '.putpaws')
+        all(path_prefix: path_prefix).detect{|x| x.name == name.to_s}
+      end
+    end
+  end
+end

data/lib/putpaws/iam/tasks/iam_task.rake

@@ -0,0 +1,65 @@
+require "json"
+require "fileutils"
+require "putpaws/prompt"
+require "putpaws/iam/operator_config"
+require "putpaws/iam/grant_command"
+
+namespace :iam do
+  desc "Resolve operator managed policies for this service from .putpaws/operators.json profiles. Idempotent. (Ex) profile=developer all=true"
+  task :grant do
+    app = fetch(:app)
+
+    unless Putpaws::Iam::OperatorConfig.exist?
+      path = Putpaws::Iam::OperatorConfig.scaffold!
+      puts "Generated #{path} with example profiles."
+      puts "Review and edit it, then run `putpaws #{app.name} iam:grant` again."
+      next
+    end
+
+    profiles = Putpaws::Iam::OperatorConfig.all
+    raise "No profiles defined in #{Putpaws::Iam::OperatorConfig.path}" if profiles.empty?
+
+    selected = if ENV['all']
+      profiles
+    elsif ENV['profile']
+      p = Putpaws::Iam::OperatorConfig.find(ENV['profile'])
+      raise "Profile not found: #{ENV['profile']} (available: #{profiles.map(&:name).join(', ')})" unless p
+      [p]
+    elsif profiles.one?
+      profiles
+    else
+      prompt = Putpaws::Prompt.safe
+      name = prompt.select("Choose a profile to grant", profiles.map(&:name))
+      [profiles.detect{|x| x.name == name}]
+    end
+
+    prompt = Putpaws::Prompt.safe
+    cmd = Putpaws::Iam::GrantCommand.new(app: app)
+    puts "Service: #{app.name} / Account: #{cmd.account_id} / Region: #{app.region}"
+
+    selected.each do |profile|
+      policy_name = cmd.policy_name(profile)
+      action = cmd.plan(profile)
+      if action == :skip
+        puts "SKIP     #{policy_name}"
+        next
+      end
+
+      doc = cmd.build_policy_document(profile)
+      puts ""
+      puts "=== #{action.to_s.upcase} managed policy: #{policy_name} ==="
+      puts JSON.pretty_generate(doc)
+      unless prompt.yes?("Apply this content as policy #{policy_name}?")
+        puts "Skipped #{policy_name}"
+        next
+      end
+
+      arn = cmd.apply!(profile)
+      copy_dir = File.join('.putpaws', 'provisioning', app.name, 'policies')
+      FileUtils.mkdir_p(copy_dir)
+      File.write(File.join(copy_dir, "operator-#{profile.name}.json"), JSON.pretty_generate(doc) + "\n")
+      puts "Applied: #{arn}"
+      puts "Attach example: aws iam attach-user-policy --user-name <USER> --policy-arn #{arn}"
+    end
+  end
+end

data/lib/putpaws/info.rb

@@ -0,0 +1 @@
+load File.expand_path("../tasks/info.rake", __FILE__)

data/lib/putpaws/provision/all.rb

@@ -0,0 +1,29 @@
+require 'putpaws/provision/util'
+require 'putpaws/provision/preset'
+require 'putpaws/provision/provision_config'
+require 'putpaws/provision/state'
+require 'putpaws/provision/aws_clients'
+require 'putpaws/provision/policy_generator'
+require 'putpaws/provision/config_writer'
+require 'putpaws/provision/runner'
+
+module Putpaws
+  module Provision
+    # Resolve which service to operate on: ENV['service'], the only one,
+    # or an interactive selection.
+    def self.resolve_config(path_prefix: '.putpaws')
+      name = ENV['service']
+      if Util.blank?(name)
+        services = ProvisionConfig.services(path_prefix: path_prefix)
+        raise "No provisioned service found. Please run `putpaws ready` first." if services.empty?
+        name = if services.one?
+          services.first
+        else
+          require 'putpaws/prompt'
+          Putpaws::Prompt.safe.select("Choose a service", services)
+        end
+      end
+      ProvisionConfig.load(name, path_prefix: path_prefix)
+    end
+  end
+end

data/lib/putpaws/provision/aws_clients.rb

@@ -0,0 +1,59 @@
+module Putpaws
+  module Provision
+    # Lazy client factory. Clients can be injected for testing.
+    class AwsClients
+      attr_reader :region
+      def initialize(region:, ec2: nil, ecs: nil, logs: nil, codebuild: nil, ssm: nil, iam: nil)
+        @region = region
+        @ec2 = ec2
+        @ecs = ecs
+        @logs = logs
+        @codebuild = codebuild
+        @ssm = ssm
+        @iam = iam
+      end
+
+      def iam
+        @iam ||= begin
+          require 'aws-sdk-iam'
+          Aws::IAM::Client.new(region: region)
+        end
+      end
+
+      def ec2
+        @ec2 ||= begin
+          require 'aws-sdk-ec2'
+          Aws::EC2::Client.new(region: region)
+        end
+      end
+
+      def ecs
+        @ecs ||= begin
+          require 'aws-sdk-ecs'
+          Aws::ECS::Client.new(region: region)
+        end
+      end
+
+      def logs
+        @logs ||= begin
+          require 'aws-sdk-cloudwatchlogs'
+          Aws::CloudWatchLogs::Client.new(region: region)
+        end
+      end
+
+      def codebuild
+        @codebuild ||= begin
+          require 'aws-sdk-codebuild'
+          Aws::CodeBuild::Client.new(region: region)
+        end
+      end
+
+      def ssm
+        @ssm ||= begin
+          require 'aws-sdk-ssm'
+          Aws::SSM::Client.new(region: region)
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/config_writer.rb

@@ -0,0 +1,88 @@
+require 'json'
+require 'fileutils'
+require 'pathname'
+require 'putpaws/provision/util'
+
+module Putpaws
+  module Provision
+    # Reflects provisioned resources into .putpaws/application.json and
+    # .putpaws/infra.json. Only the keys of the target service are touched.
+    # Shows a diff and asks for confirmation before writing.
+    class ConfigWriter
+      attr_reader :config, :state, :prompt, :io
+      def initialize(config:, state:, prompt:, io: $stdout)
+        @config = config
+        @state = state
+        @prompt = prompt
+        @io = io
+      end
+
+      def application_entry
+        {
+          region: config.region,
+          cluster: config.cluster_name,
+          service: config.service_name,
+          task_name_prefix: config.service_name,
+          log_group_prefix: config.log_group,
+          build_log_group_prefix: config.build_log_group,
+          build_project_name_prefix: config.build_project_name,
+          network: config.service_name,
+          target: config.service_name,
+        }
+      end
+
+      def network_entry
+        {
+          subnets: config.base[:subnets],
+          security_groups: state.resources[:security_group_ids] || [],
+          assign_public_ip: config.settings[:assign_public_ip] || 'DISABLED',
+        }
+      end
+
+      def target_entry
+        {
+          # Used by EventBridge Scheduler (scheduler:deploy).
+          scheduler_role: config.roles[:scheduler_role_arn],
+          cluster: state.resources[:cluster_arn],
+          # Revision-less on purpose: always run the latest ACTIVE revision.
+          task_definition: config.service_task_definition_family,
+          container_name: config.service_container_name,
+        }
+      end
+
+      def apply!
+        write_key(path('application.json'), [config.service_name.to_sym], application_entry)
+        write_key(path('infra.json'), [:network, config.service_name.to_sym], network_entry)
+        write_key(path('infra.json'), [:target, config.service_name.to_sym], target_entry)
+      end
+
+      private
+
+      def path(basename)
+        Pathname.new(config.path_prefix).join(basename)
+      end
+
+      def write_key(file, keys, entry)
+        data = file.exist? ? JSON.parse(File.read(file), symbolize_names: true) : {}
+        current = keys.reduce(data){|d, k| d.is_a?(Hash) ? d[k] : nil}
+        return if current == entry
+
+        io.puts "=== #{file} : #{keys.join('.')} ==="
+        io.puts "--- before"
+        io.puts current ? JSON.pretty_generate(current) : "(none)"
+        io.puts "+++ after"
+        io.puts JSON.pretty_generate(entry)
+        unless prompt.yes?("Update #{file}?")
+          io.puts "Skipped updating #{file}"
+          return
+        end
+
+        FileUtils.cp(file, "#{file}.bak") if file.exist?
+        parent = keys[0..-2].reduce(data){|d, k| d[k] ||= {}}
+        parent[keys.last] = entry
+        Util.write_json(file, data)
+        io.puts "Updated #{file}"
+      end
+    end
+  end
+end