renuo-cli 4.27.0 → 4.28.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b4a37d01ef907f898f0287766c0dd1be73c55a35516e54adda7b1b3c5b798c9
-  data.tar.gz: 12e28effd0aaf9a7aaf52dd297a7ef6412f24514ed3940c34649ecf9b968f27b
+  metadata.gz: 352c9cb95e2c7548026938080ff46625617536757aa4653aa3412ac35dead312
+  data.tar.gz: dc0de5b1c6781136fe7b13d441c823b648a5efa36c3d28c1cc74e1f8ed8c2e2b
 SHA512:
-  metadata.gz: e400a1dd7cc3d3287d478bd4b52ae5964af1dca75138b680368eb5192ae3c57fda3a1924ea168b8c1ec21bd9cc7ca63b23b787d2484361e6e6dfcc9ee8f768ed
-  data.tar.gz: 517ba241db1d5bee9ae502e1a71847e7196447c53e84721cd2ce92e3b1452c1630d3331aae76cc5ae085f22289a67a4a35ad7f85fe48bccb8ca4368e8ee06b06
+  metadata.gz: fe555bad89b04add4100bb6eb259a0194b1f30cb7d245dcd02418a7d65b6b2117c8903a3379747eacee069355060aefe3fd62798b03254d97a885af2d1d24f62
+  data.tar.gz: e77579335bff65754f3871272a7df43eca8b9728c7f1c314b4c39665520bdb8347c5a184868fe81f33d1518d8b66a914fa74a83d50f1fe9bc46057705f0d8da0

data/lib/renuo/cli/commands/review_app/deploy.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Deploy < Actor
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+    include Contracts::Core
+
+    command "review-app:deploy" do |c|
+      c.syntax = "renuo review-app:deploy [options]"
+      c.summary = "Copies the origin Deploio app (matching the origin pattern) and its services " \
+                  "into a target review app for the current branch."
+      c.description = c.summary
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.option "--origin-pattern <pattern>", String, "Name pattern identifying the origin app to copy from"
+      c.option "--start", "Start the app right away instead of waiting for its env variables to be configured"
+      c.option "--keep-envs <categories>", Array,
+               "Copied env categories (build or runtime) to keep instead of dropping " \
+               "(comma-separated): #{Renuo::Cli::Services::Deploio::CopyApp::ENV_CATEGORIES.join(",")}"
+      c.example "renuo review-app:deploy -p renuo-acme --branch feature/42-migrate-to-deploio --origin-pattern develop",
+                "Creates a review app tracking feature/42-migrate-to-deploio, copied from the develop app"
+      c.example "renuo review-app:deploy -p renuo-acme -b fix/1337-we-can-fix-everything111 --origin-pattern develop " \
+                "--keep-envs=#{Renuo::Cli::Services::Deploio::CopyApp::ENV_CATEGORIES.join(",")} --start",
+                "Creates a review app reusing all the origin's env variables and starts it right away"
+      c.action do |_args, options|
+        call(project: options.project, branch: options.branch, origin_pattern: options.origin_pattern,
+             start: options.start, keep_envs: options.keep_envs || [])
+      end
+    end
+
+    input :project,
+          must: { be_given: { is: ->(value) { value }, message: ->(**) { "missing project name" } } }
+    input :branch,
+          must: { be_given: { is: ->(value) { value }, message: ->(**) { "missing branch name" } } }
+    input :origin_pattern,
+          must: { be_given: { is: ->(value) { value }, message: ->(**) { "missing origin pattern name" } } }
+    input :start, default: false
+    input :keep_envs,
+          default: [],
+          must: {
+            be_known_categories: {
+              is: ->(value) { (value - Deploio::CopyApp::ENV_CATEGORIES).empty? },
+              message: (lambda do |value:, **|
+                "unknown env categories: #{(value - Deploio::CopyApp::ENV_CATEGORIES).join(", ")}"
+              end)
+            }
+          }
+
+    output :url
+
+    play :derive_target_app_name,
+         Deploio::InventorizeOriginResources,
+         :print_origin_resources,
+         Deploio::CopyApp
+
+    play Deploio::CreateDatabase,
+         Deploio::CopyDatabaseData,
+         if: ->(inventory) { inventory.origin_database_name }
+
+    play Deploio::CreateKvs,
+         if: ->(inventory) { inventory.origin_key_value_store_name }
+
+    play Deploio::CreateS3,
+         Deploio::CopyS3Data,
+         if: ->(inventory) { inventory.origin_bucket_name }
+
+    play :collect_target_envs,
+         Deploio::UpdateTargetAppEnv
+
+    play Deploio::StartTargetApp,
+         if: ->(result) { result.start }
+
+    play CmdTrail::Print,
+         :print_url
+
+    private
+
+    Contract Contracts::None => SafeReviewAppNameContract
+    def derive_target_app_name
+      result.target_app_name = review_app_name(branch).tap do |name|
+        abort "'#{name}' contains the origin pattern '#{origin_pattern}', aborting" if name.include?(origin_pattern)
+      end
+    end
+
+    def print_origin_resources
+      inventory_value = ->(key) { result.public_send(key) || "none" }
+
+      puts <<~INVENTORY
+        copying origin resources from project '#{result.project}':
+          app: #{result.origin_app_name}
+          database: #{inventory_value[:origin_database_name]}
+          database backup: #{inventory_value[:origin_backup_path]}
+          database backup bucket user: #{inventory_value[:origin_backup_bucket_user]}
+          key-value store: #{inventory_value[:origin_key_value_store_name]}
+          bucket: #{inventory_value[:origin_bucket_name]}
+          bucket user: #{inventory_value[:origin_bucket_user]}
+      INVENTORY
+    end
+
+    def collect_target_envs
+      result.envs = [result.database_env, result.kvs_env, result.s3_env].compact
+    end
+
+    def print_url
+      self.url = Deploio.fetch_resource("app", result.target_app_name, result.project)
+                        .dig("status", "atProvider", "defaultURLs", 0)
+      puts "\nthe review app will run at #{url || "<no URL assigned yet>"}"
+      puts "start it with: renuo review-app:start --project #{project} --branch #{branch}" unless start
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/name.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Name
+    include ReviewAppHelper
+    include Contracts::Core
+
+    command "review-app:name" do |c|
+      c.syntax = "renuo review-app:name [options]"
+      c.summary = "Prints the review app name derived from the branch."
+      c.description = c.summary
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.example "nctl update app $(renuo review-app:name -b add-s3-to-docs) -p renuo-acme --env KEY=value",
+                "Sets an env variable on the branch's review app"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      puts @name
+    end
+
+    private
+
+    def initialize(options)
+      branch = options.branch
+
+      abort "missing branch name" unless branch
+      @name = derive_name(branch)
+    end
+
+    Contract String => SafeReviewAppNameContract
+    def derive_name(branch)
+      review_app_name(branch)
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/purge.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Purge
+    include ReviewAppHelper
+    include Contracts::Core
+    include Contracts::Invariants
+
+    RESOURCE_TYPES = %w[app postgresdatabase kvs bucket bucketuser].freeze
+
+    invariant(:name_pattern) { SafeReviewAppNameContract.valid?(@name_pattern) }
+
+    command "review-app:purge" do |c|
+      c.syntax = "renuo review-app:purge [options]"
+      c.summary = "Deletes all Deploio resources whose name contains the branch's review app name."
+      c.description = c.summary
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.example "renuo review-app:purge -p renuo-acme -b feature/42-migrate-to-deploio",
+                "Deletes all review app resources named after the branch"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      RESOURCE_TYPES.each { |type| purge_matching(type, @name_pattern) }
+      CmdTrail::Print.call
+    end
+
+    private
+
+    def initialize(options)
+      @project = options.project
+      branch = options.branch
+
+      abort "missing project name" unless @project
+      abort "missing branch name" unless branch
+      derive_name_pattern(branch)
+    end
+
+    Contract String => SafeReviewAppNameContract
+    def derive_name_pattern(branch)
+      @name_pattern = review_app_name(branch)
+    end
+
+    Contract Contracts::Enum[*RESOURCE_TYPES], SafeReviewAppNameContract => Contracts::Any
+    def purge_matching(type, name_pattern)
+      names = matching_names(type, name_pattern)
+      return puts "no #{type} matching '#{name_pattern}' found, skipping" if names.empty?
+
+      names.each do |name|
+        puts "deleting #{type} #{name}..."
+        system! "nctl delete #{type} #{name} -p #{@project} --force --wait"
+      end
+    end
+
+    def matching_names(type, name_pattern)
+      nctl_resources("nctl get #{type} -p #{@project} -o yaml").filter_map do |resource|
+        next if resource.dig("metadata", "labels", "nine.ch/owned-by") == "nine"
+
+        name = resource.dig("metadata", "name")
+        name if name.include?(name_pattern)
+      end
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/setup_semaphoreci.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Renuo::Cli::Commands::ReviewApp
+  class SetupSemaphoreci
+    DEPLOY_PIPELINE_TEMPLATE_FILE = File.join(__dir__, "../../templates/semaphore/review-app-deploy.yml.erb")
+    PURGE_PIPELINE_TEMPLATE_FILE = File.join(__dir__, "../../templates/semaphore/review-app-purge.yml.erb")
+
+    DEPLOY_PIPELINE_TARGET_FILE = ".semaphore/review-app-deploy.yml"
+    PURGE_PIPELINE_TARGET_FILE = ".semaphore/review-app-purge.yml"
+
+    attr_reader :project, :origin_pattern
+
+    command "review-app:setup-semaphoreci" do |c|
+      c.syntax = "renuo review-app:setup-semaphoreci [options]"
+      c.summary = "Generates the pipeline files to deploy and purge Deploio review apps."
+      c.description = c.summary
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "--origin-pattern <pattern>", String, "Name pattern identifying the origin app to copy from"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      FileUtils.mkdir_p File.dirname(DEPLOY_PIPELINE_TARGET_FILE)
+      write_or_warn DEPLOY_PIPELINE_TARGET_FILE,
+                    render(DEPLOY_PIPELINE_TEMPLATE_FILE, { project:, origin_pattern:, secret_name: })
+      write_or_warn PURGE_PIPELINE_TARGET_FILE, render(PURGE_PIPELINE_TEMPLATE_FILE, { project:, secret_name: })
+      print_instructions
+    end
+
+    private
+
+    def initialize(options)
+      @project = options.project || abort("missing project name")
+      @origin_pattern = options.origin_pattern || abort("missing origin pattern")
+    end
+
+    def secret_name
+      "nctl-#{project}-review-apps"
+    end
+
+    # Deploio project names are prefixed with the name of their organization.
+    def organization
+      project.split("-").first
+    end
+
+    def print_instructions
+      service_account_name = "review-apps"
+      say <<~INSTRUCTIONS
+
+        Create a service account restricted to the Deploio project #{project}:
+
+          nctl create asa #{service_account_name} --project #{project}
+
+        Register its credentials as the Semaphore secret #{secret_name}, used by both pipelines:
+
+          sem create secret #{secret_name} \\
+            -e NCTL_API_CLIENT_ID="$(nctl get asa #{service_account_name} --project #{project} --print-client-id)" \\
+            -e NCTL_API_CLIENT_SECRET="$(nctl get asa #{service_account_name} --project #{project} --print-client-secret)" \\
+            -e NCTL_ORGANIZATION=#{organization}
+
+        Add these promotions to .semaphore/semaphore.yml (no auto_promote, so they only run on click):
+
+          - name: review-app-deploy
+            pipeline_file: review-app-deploy.yml
+
+          - name: review-app-purge
+            pipeline_file: review-app-purge.yml
+
+        Both buttons appear on every branch workflow in Semaphore. Deploy and purge the review app
+        of a branch by clicking the promotion on that branch's workflow.
+      INSTRUCTIONS
+    end
+
+    def render(template_file, variables)
+      ERB.new(File.read(template_file)).result_with_hash(variables)
+    end
+
+    def write_or_warn(file_path, content)
+      if File.exist?(file_path)
+        warn("#{file_path} exists already. I will not overwrite it.")
+      else
+        File.write(file_path, content)
+        say("#{file_path} added.")
+      end
+    end
+  end
+end

data/lib/renuo/cli/commands/review_app/start.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "../../helpers/safe_review_app_name_contract"
+
+module Renuo::Cli::Commands::ReviewApp
+  class Start
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+    include Contracts::Core
+    include Contracts::Invariants
+
+    invariant(:target_app_name) { SafeReviewAppNameContract.valid?(@target_app_name) }
+
+    command "review-app:start" do |c|
+      c.syntax = "renuo review-app:start [options]"
+      c.summary = "Starts the branch's review app once its env variables are configured."
+      c.description = c.summary
+      c.option "-p", "--project <name>", String, "The name of the Deploio project"
+      c.option "-b", "--branch <name>", String, "The Git branch"
+      c.example "renuo review-app:start -p renuo-acme -b feature/42-migrate-to-deploio",
+                "Builds and deploys the branch's review app"
+      c.action { |_args, options| new(options).run }
+    end
+
+    def run
+      Deploio::StartTargetApp.call(project: @project, target_app_name: @target_app_name, branch: @branch)
+      CmdTrail::Print.call
+      print_url
+    end
+
+    private
+
+    def print_url
+      url = Deploio.fetch_resource("app", @target_app_name, @project)
+                   .dig("status", "atProvider", "defaultURLs", 0)
+      puts "\nthe review app will run at #{url || "<no URL assigned yet>"}"
+    end
+
+    def initialize(options)
+      @project = options.project
+      @branch = options.branch
+
+      abort "missing project name" unless @project
+      abort "missing branch name" unless @branch
+      derive_target_app_name(@branch)
+    end
+
+    Contract String => SafeReviewAppNameContract
+    def derive_target_app_name(branch)
+      @target_app_name = review_app_name(branch)
+    end
+  end
+end

data/lib/renuo/cli/helpers/actor_contracts.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# Lets service actors state contracts.ruby-style contracts (anything with .valid?) as must: checks.
+module ActorContracts
+  def satisfy(*contracts)
+    contracts.to_h do |contract|
+      raise ArgumentError, "#{contract.inspect} is not a contract (no .valid?)" unless contract.respond_to?(:valid?)
+
+      [:"satisfy_#{contract.name.demodulize.underscore}",
+       { is: ->(value) { contract.valid?(value) },
+         message: ->(value:, **) { "#{value.inspect} is not #{contract}" } }]
+    end
+  end
+end
+
+Actor.extend(ActorContracts)

data/lib/renuo/cli/helpers/cmd_trail.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+# Collects every CLI command a run executes so Print can show how to reproduce it.
+module CmdTrail
+  module_function
+
+  def record(command, env = {})
+    entries << { command: command, env: env }
+  end
+
+  def entries
+    @entries ||= []
+  end
+
+  def clear
+    entries.clear
+  end
+
+  class Print < Actor
+    SENSITIVE_KEY_PATTERN = /KEY|SECRET|TOKEN|PASSWORD/i
+    URL_PASSWORD_PATTERN = %r{(://[^:/@\s]*:)[^@\s]+@}
+
+    def call
+      return if CmdTrail.entries.empty?
+
+      puts "\nexecuted commands (rerun them to reproduce):"
+      CmdTrail.entries.each { |entry| puts "  #{line(entry)}" }
+    end
+
+    private
+
+    def line(entry)
+      [env_prefix(entry[:env]), redact(entry[:command])]
+        .reject(&:empty?).join(" ")
+    end
+
+    def redact(command)
+      command.sub(/--sensitive-env .*/, "--sensitive-env [redacted]").gsub(URL_PASSWORD_PATTERN, '\\1[redacted]@')
+    end
+
+    def env_prefix(env)
+      env.map { |key, value| "#{key}=#{SENSITIVE_KEY_PATTERN.match?(key) ? "[redacted]" : value}" }.join(" ")
+    end
+  end
+end

data/lib/renuo/cli/helpers/review_app_helper.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module ReviewAppHelper
+  HASH_LENGTH = 6
+  MAX_NUMBER_LENGTH = 10
+  NAME_PATTERN = /\Areview-app-(?:\d{1,#{MAX_NUMBER_LENGTH}}-)?\h{#{HASH_LENGTH}}\z/
+  MIN_PATTERN_LENGTH = 3
+
+  def review_app_name(branch)
+    number = branch[/\d+/]&.slice(0, MAX_NUMBER_LENGTH)
+    ["review-app", number, Digest::SHA256.hexdigest(branch)[0, HASH_LENGTH]].compact.join("-")
+  end
+
+  # nctl prints a YAML stream, a YAML list, "[]" or a plain-text banner, depending on version and match count
+  def nctl_resources(command)
+    stdout, = system!(command, quiet: true)
+    return [] if stdout.lines.first.to_s.match?(/No ".+" found/)
+
+    resources = Psych.load_stream(stdout).flatten.compact
+    return resources if resources.all?(Hash)
+
+    abort "'#{command}' printed no nctl resources:\n#{stdout}"
+  rescue Psych::SyntaxError
+    abort "'#{command}' printed no nctl resources:\n#{stdout}"
+  end
+
+  def system!(command, env = {}, quiet: false, abort_on_failure: true)
+    CmdTrail.record(command, env)
+    stdout, stderr, status = Open3.capture3(env, command)
+    puts stdout unless quiet || stdout.empty?
+    if !status.success? && abort_on_failure
+      abort "'#{command.split.first(2).join(" ")}' failed: #{stderr.presence || stdout}"
+    end
+    [stdout, stderr, status]
+  end
+
+  def aws_credentials(access_key, secret_key)
+    {
+      "AWS_ACCESS_KEY_ID" => access_key,
+      "AWS_SECRET_ACCESS_KEY" => secret_key,
+      "AWS_DEFAULT_REGION" => "us-east-1"
+    }
+  end
+end

data/lib/renuo/cli/helpers/safe_review_app_name_contract.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "contracts"
+
+# Module-wide contract: a name that may address review app resources on Deploio.
+# Commands establish it as a postcondition of name derivation and keep it as a
+# class invariant; the Deploio actors demand it as a precondition before touching
+# any resource. A violation always means a bug, never bad user input.
+class SafeReviewAppNameContract
+  def self.valid?(name)
+    name.is_a?(String) && name.match?(ReviewAppHelper::NAME_PATTERN)
+  end
+
+  def self.to_s
+    "a review app name matching #{ReviewAppHelper::NAME_PATTERN.inspect}"
+  end
+end

data/lib/renuo/cli/services/deploio/copy_app.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+class Renuo::Cli::Services::Deploio
+  class CopyApp < Actor
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+
+    ENV_CATEGORIES = %w[build sensitive-build runtime sensitive-runtime].freeze
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :origin_app_name
+    input :branch
+    input :keep_envs, default: []
+
+    def call
+      if Deploio.resource_exists?("app", target_app_name, project)
+        puts "app #{target_app_name} already exists, skipping copy"
+      else
+        puts "copying app #{origin_app_name} to #{target_app_name}..."
+        system! "nctl copy app #{origin_app_name} -p #{project} --target-name #{target_app_name}"
+        reconfigure_copy
+      end
+    end
+
+    private
+
+    def reconfigure_copy
+      Kernel.sleep(1) # Deploio usually needs a moment to finish reconciling the fresh copy
+      flags = [delete_flag("--delete-env", dropped_keys("config", "env", kind: "runtime")),
+               delete_flag("--delete-build-env", dropped_keys("buildEnv", kind: "build"))].compact
+      dropping = flags.empty? ? "" : " and dropping the copied env variables"
+      puts "pointing #{target_app_name} at branch #{branch}#{dropping}..."
+      system! ["nctl update app #{target_app_name} -p #{project}",
+               "--git-revision #{Shellwords.escape(branch)} --skip-repo-access-check",
+               *flags].join(" ")
+    end
+
+    def delete_flag(flag, keys)
+      "#{flag} #{Shellwords.escape(keys.join(";"))}" unless keys.empty?
+    end
+
+    def dropped_keys(*path, kind:)
+      env = copied_spec.dig(*path) || []
+      env.reject { |variable| keep_envs.include?(variable["sensitive"] ? "sensitive-#{kind}" : kind) }
+         .map { |variable| variable["name"] }
+    end
+
+    def copied_spec
+      @copied_spec ||= Deploio.fetch_resource("app", target_app_name, project).dig("spec", "forProvider") || {}
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/copy_database_data.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+class Renuo::Cli::Services::Deploio
+  class CopyDatabaseData < Actor
+    include ReviewAppHelper
+
+    BACKUP_FILE = File.join(Dir.tmpdir, "review-app-backup.sql.zst")
+    USER_TABLES_QUERY = "SELECT count(*) FROM pg_tables WHERE schemaname NOT IN ('pg_catalog', 'information_schema')"
+
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :database_env
+    input :origin_backup_bucket
+    input :origin_backup_path
+    input :origin_backup_endpoint
+    input :origin_backup_access_key
+    input :origin_backup_secret_key
+
+    def call
+      return warn "no origin database backup found, leaving #{target_app_name} empty" unless origin_backup_path
+      return puts "database #{target_app_name} already holds tables, skipping backup restore" unless database_empty?
+
+      puts "restoring #{origin_backup_path} into #{target_app_name}..."
+      download_backup
+      system! "zstd -dfq #{BACKUP_FILE}"
+      restore_backup
+    ensure
+      FileUtils.rm_f([BACKUP_FILE, BACKUP_FILE.delete_suffix(".zst")])
+    end
+
+    private
+
+    def download_backup
+      system! "aws s3 cp s3://#{origin_backup_bucket}/#{origin_backup_path} #{BACKUP_FILE} " \
+              "--endpoint-url https://#{origin_backup_endpoint}",
+              aws_credentials(origin_backup_access_key, origin_backup_secret_key)
+    end
+
+    def database_empty?
+      stdout, = system!("psql #{database_url} -tAc #{Shellwords.escape(USER_TABLES_QUERY)}", quiet: true)
+      Integer(stdout.strip).zero?
+    end
+
+    # Despite their .sql.zst name, Deploio backups are pg_dump custom-format archives.
+    # A single transaction leaves the database empty on failure, so a rerun restores it again.
+    def restore_backup
+      system! "pg_restore --single-transaction --no-owner --no-privileges --no-comments " \
+              "-d #{database_url} " \
+              "#{BACKUP_FILE.delete_suffix(".zst")}"
+    end
+
+    def database_url
+      Shellwords.escape(database_env.fetch("DATABASE_URL"))
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/copy_s3_data.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require_relative "create_s3"
+
+class Renuo::Cli::Services::Deploio
+  class CopyS3Data < Actor
+    include ReviewAppHelper
+
+    DATA_DIR = File.join(Dir.tmpdir, "review-app-bucket-data")
+    LISTING_ATTEMPTS = 24
+    LISTING_INTERVAL_IN_SECONDS = 5
+
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :s3_env
+    input :origin_bucket_name
+    input :origin_bucket_endpoint
+    input :origin_bucket_access_key
+    input :origin_bucket_secret_key
+
+    def call
+      return puts "bucket #{target_app_name} already holds objects, skipping data copy" unless bucket_empty?
+
+      puts "copying bucket data from #{origin_bucket_name} into #{target_app_name}..."
+      download_data
+      upload_data
+    end
+
+    private
+
+    def download_data
+      system! "aws s3 sync s3://#{origin_bucket_name} #{DATA_DIR} --endpoint-url https://#{origin_bucket_endpoint}",
+              aws_credentials(origin_bucket_access_key, origin_bucket_secret_key)
+    end
+
+    # aws exits non-zero on some empty listings, so only stderr tells a failure apart.
+    def bucket_empty?
+      stdout, stderr = list_target_bucket
+      abort "'aws s3' failed: #{stderr}" unless stderr.strip.empty?
+      stdout.strip.empty?
+    end
+
+    # Deploio reports a fresh bucket ready seconds before its permissions grant access.
+    def list_target_bucket
+      (1..LISTING_ATTEMPTS).each do |attempt|
+        stdout, stderr, = system!("aws s3 ls s3://#{target_app_name} --endpoint-url #{target_endpoint}",
+                                  target_credentials, quiet: true, abort_on_failure: false)
+        return [stdout, stderr] if attempt == LISTING_ATTEMPTS || stderr.exclude?("AccessDenied")
+
+        puts "waiting for access to bucket #{target_app_name}..."
+        Kernel.sleep(LISTING_INTERVAL_IN_SECONDS)
+      end
+    end
+
+    def upload_data
+      system! "aws s3 sync #{DATA_DIR} s3://#{target_app_name} --endpoint-url #{target_endpoint}", target_credentials
+    end
+
+    def target_endpoint
+      s3_env.fetch(target_schema[:endpoint])
+    end
+
+    def target_credentials
+      aws_credentials(s3_env.fetch(target_schema[:access_key]), s3_env.fetch(target_schema[:secret_key]))
+    end
+
+    def target_schema
+      CreateS3::ENV_SCHEMAS_IN_THE_WILD.find { |candidate| s3_env.key?(candidate[:secret_key]) }
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/create_database.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+class Renuo::Cli::Services::Deploio
+  class CreateDatabase < Actor
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :origin_database_location, allow_nil: true, default: nil
+    input :origin_database_version, allow_nil: true, default: nil
+    input :origin_database_collation, allow_nil: true, default: nil
+
+    output :database_env
+
+    def call
+      if Deploio.resource_exists?("postgresdatabase", target_app_name, project)
+        puts "database #{target_app_name} already exists, skipping creation"
+      else
+        create_database
+      end
+      self.database_env = { "DATABASE_URL" => database_url }
+    end
+
+    private
+
+    def create_database
+      puts "creating database #{target_app_name}..."
+      system! ["nctl create postgresdatabase #{target_app_name} -p #{project}",
+               *origin_flags,
+               "--backup-schedule=disabled --wait"].join(" ")
+    end
+
+    def origin_flags
+      { "--location" => origin_database_location,
+        "--postgres-database-version" => origin_database_version,
+        "--collation" => origin_database_collation }
+        .filter_map { |flag, value| "#{flag} #{Shellwords.escape(value)}" if value }
+    end
+
+    def database_url
+      stdout, = system!("nctl get postgresdatabase #{target_app_name} -p #{project} --print-connection-string",
+                        quiet: true)
+      stdout.strip
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/create_kvs.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+class Renuo::Cli::Services::Deploio
+  class CreateKvs < Actor
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :origin_key_value_store_location, allow_nil: true, default: nil
+
+    output :kvs_env
+
+    def call
+      if Deploio.resource_exists?("kvs", target_app_name, project)
+        puts "key-value store #{target_app_name} already exists, skipping creation"
+      else
+        create_kvs
+      end
+      self.kvs_env = { "REDIS_URL" => redis_url }
+    end
+
+    private
+
+    def create_kvs
+      system! ["nctl create kvs #{target_app_name} -p #{project}", location_flag, "--wait"].compact.join(" ")
+    end
+
+    def location_flag
+      "--location #{Shellwords.escape(origin_key_value_store_location)}" if origin_key_value_store_location
+    end
+
+    def redis_url
+      token, = system!("nctl get kvs #{target_app_name} -p #{project} --print-token", quiet: true)
+      fqdn = Deploio.fetch_resource("kvs", target_app_name, project).dig("status", "atProvider", "fqdn")
+      "rediss://:#{token.strip}@#{fqdn}:6379"
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/create_s3.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+class Renuo::Cli::Services::Deploio
+  class CreateS3 < Actor
+    include ReviewAppHelper
+    include Renuo::Cli::Services
+
+    DEFAULT_BUCKET_LOCATION = "nine-es34"
+    ENV_SCHEMAS_IN_THE_WILD = [
+      {
+        name: "DEPLOIO_BUCKET_NAME",
+        endpoint: "DEPLOIO_BUCKET_ENDPOINT",
+        access_key: "DEPLOIO_BUCKET_ACCESS_KEY",
+        secret_key: "DEPLOIO_BUCKET_SECRET_KEY"
+      },
+      {
+        name: "DEPLOIO_BUCKET",
+        endpoint: "DEPLOIO_ENDPOINT",
+        access_key: "DEPLOIO_ACCESS_KEY",
+        secret_key: "DEPLOIO_SECRET_KEY"
+      }
+    ].freeze
+    SENSITIVE_ENV_KEYS = ENV_SCHEMAS_IN_THE_WILD.flat_map { |schema| schema.values_at(:access_key, :secret_key) }.freeze
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :template, default: {}
+
+    output :s3_env
+
+    def call
+      location = template[:bucket_location] || DEFAULT_BUCKET_LOCATION
+      create_bucket_user(location)
+      create_bucket(location)
+      self.s3_env = bucket_env
+    end
+
+    private
+
+    def app_env?(key)
+      (template[:app_env] || []).any? { |variable| variable["name"] == key }
+    end
+
+    def create_bucket_user(location)
+      return if Deploio.resource_exists?("bucketuser", target_app_name, project)
+
+      system! "nctl create bucketuser #{target_app_name} -p #{project} --location #{location} --wait"
+    end
+
+    def create_bucket(location)
+      if Deploio.resource_exists?("bucket", target_app_name, project)
+        return puts "bucket #{target_app_name} already exists, skipping creation"
+      end
+
+      system! "nctl create bucket #{target_app_name} -p #{project} --location #{location} " \
+              "--permissions \"reader=#{target_app_name};writer=#{target_app_name}\" --wait"
+    end
+
+    def bucket_env
+      schema = env_schema
+      {
+        schema[:name] => target_app_name,
+        schema[:endpoint] => "https://#{bucket_endpoint}",
+        schema[:access_key] => bucket_credential("--print-access-key"),
+        schema[:secret_key] => bucket_credential("--print-secret-key")
+      }
+    end
+
+    def bucket_endpoint
+      Deploio.fetch_resource("bucket", target_app_name, project).dig("status", "atProvider", "endpoint")
+    end
+
+    def bucket_credential(flag)
+      stdout, = system!("nctl get bucketuser #{target_app_name} -p #{project} #{flag}", quiet: true)
+      stdout.strip
+    end
+
+    def env_schema
+      ENV_SCHEMAS_IN_THE_WILD.find { |schema| app_env?(schema[:secret_key]) } || ENV_SCHEMAS_IN_THE_WILD.first
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/inventorize_origin_resources.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+class Renuo::Cli::Services::Deploio
+  class InventorizeOriginResources < Actor # rubocop:disable Metrics/ClassLength
+    include ReviewAppHelper
+
+    input :project
+    input :origin_pattern,
+          must: {
+            be_specific_enough: {
+              is: ->(pattern) { pattern.to_s.length >= ReviewAppHelper::MIN_PATTERN_LENGTH },
+              message: (lambda do |value:, **|
+                "origin pattern '#{value}' must be at least #{ReviewAppHelper::MIN_PATTERN_LENGTH} " \
+                  "characters long, aborting"
+              end)
+            }
+          }
+
+    output :origin_app_name
+    output :origin_database_name
+    output :origin_database_location
+    output :origin_database_version
+    output :origin_database_collation
+    output :origin_backup_bucket
+    output :origin_backup_path
+    output :origin_backup_endpoint
+    output :origin_backup_bucket_user
+    output :origin_backup_access_key
+    output :origin_backup_secret_key
+    output :origin_key_value_store_name
+    output :origin_key_value_store_location
+    output :origin_bucket_name
+    output :origin_bucket_endpoint
+    output :origin_bucket_user
+    output :origin_bucket_access_key
+    output :origin_bucket_secret_key
+
+    def call
+      inventorize_app
+      inventorize_database
+      inventorize_backup
+      inventorize_key_value_store
+      inventorize_bucket
+      ensure_required_tools
+    end
+
+    private
+
+    def inventorize_app
+      self.origin_app_name = origin_app_name!
+    end
+
+    def inventorize_database
+      database = origin_resource("PostgresDatabase")
+      self.origin_database_name = database&.dig("metadata", "name")
+      self.origin_database_location, self.origin_database_version, self.origin_database_collation =
+        %w[location version collation].map { |key| database&.dig("spec", "forProvider", key)&.to_s }
+    end
+
+    def inventorize_backup
+      self.origin_backup_bucket = backup_bucket_name
+      self.origin_backup_path = latest_backup_path
+      backup_bucket = bucket_resource(origin_backup_bucket)
+      self.origin_backup_endpoint = backup_bucket&.dig("status", "atProvider", "endpoint")
+      self.origin_backup_bucket_user = bucket_user(backup_bucket)
+      self.origin_backup_access_key, self.origin_backup_secret_key =
+        bucketuser_credentials(origin_backup_bucket_user)
+    end
+
+    def bucket_user(bucket)
+      return nil unless bucket
+
+      bucket_reader_user(bucket) || abort("no bucket user for '#{bucket.dig("metadata", "name")}' in #{project}")
+    end
+
+    # Bucket users are not necessarily named like their bucket; the bucket's permissions reference them.
+    def bucket_reader_user(bucket)
+      permissions = bucket.dig("spec", "forProvider", "permissions") || []
+      permission = permissions.find { |candidate| candidate["role"] == "reader" } || permissions.first
+      permission&.dig("userRefs", 0, "name")
+    end
+
+    # Fetched eagerly (even for re-deploys that copy no data) so no origin-side nctl calls remain after inventory.
+    def bucketuser_credentials(user)
+      return [nil, nil] unless user
+
+      %w[--print-access-key --print-secret-key].map do |flag|
+        stdout, = system!("nctl get bucketuser #{user} -p #{project} #{flag}", quiet: true)
+        stdout.strip
+      end
+    end
+
+    def inventorize_key_value_store
+      key_value_store = origin_resource("KeyValueStore")
+      self.origin_key_value_store_name = key_value_store&.dig("metadata", "name")
+      self.origin_key_value_store_location = key_value_store&.dig("spec", "forProvider", "location")
+    end
+
+    def inventorize_bucket
+      bucket = origin_resource("Bucket")
+      self.origin_bucket_name = bucket&.dig("metadata", "name")
+      self.origin_bucket_endpoint = bucket&.dig("status", "atProvider", "endpoint")
+      self.origin_bucket_user = bucket_user(bucket)
+      self.origin_bucket_access_key, self.origin_bucket_secret_key = bucketuser_credentials(origin_bucket_user)
+    end
+
+    def ensure_required_tools
+      missing = required_tools.reject { |tool| installed?(tool) }
+      abort "missing #{missing.join(", ")} to copy the origin data, install them and rerun" if missing.any?
+    end
+
+    def required_tools
+      tools = []
+      tools += %w[aws pg_restore psql zstd] if origin_backup_path
+      tools += %w[aws] if origin_bucket_name
+      tools.uniq
+    end
+
+    def installed?(tool)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).any? { |dir| File.executable?(File.join(dir, tool)) }
+    end
+
+    def resources
+      # nctl hides the whole listing behind its no-resources banner when the project holds
+      # no nine-owned resources; the plain listing still contains everything else.
+      @resources ||= nctl_resources("nctl get all -p #{project} --include-nine-resources -o yaml").presence ||
+                     nctl_resources("nctl get all -p #{project} -o yaml")
+    end
+
+    def origin_resources
+      @origin_resources ||= resources.select do |resource|
+        resource.dig("metadata", "labels", "nine.ch/owned-by") != "nine" &&
+          resource.dig("metadata", "name").include?(origin_pattern)
+      end
+    end
+
+    def origin_app_name!
+      abort "project '#{project}' holds no resources, is its name right?" if resources.empty?
+
+      origin_resource("Application")&.dig("metadata", "name") ||
+        abort("no origin app (name containing '#{origin_pattern}') found in #{project}")
+    end
+
+    def origin_resource(kind)
+      origin_resources.find { |resource| resource["kind"] == kind }
+    end
+
+    def resources_of(kind)
+      resources.select { |resource| resource["kind"] == kind }
+    end
+
+    def backup_bucket_name
+      return nil unless origin_database_name
+
+      resources_of("DatabaseBackupSchedule")
+        .find { |schedule| schedule.dig("spec", "forProvider", "source", "name") == origin_database_name }
+        &.dig("status", "atProvider", "targetBucket", "name")
+    end
+
+    def latest_backup_path
+      return nil unless origin_backup_bucket
+
+      resources_of("DatabaseBackup")
+        .select { |backup| backup.dig("spec", "forProvider", "bucket", "name") == origin_backup_bucket }
+        .select { |backup| backup.dig("status", "atProvider", "state") == "succeeded" }
+        .max_by { |backup| backup.dig("status", "atProvider", "end").to_s }
+        &.dig("status", "atProvider", "path")
+    end
+
+    def bucket_resource(name)
+      name && resources_of("Bucket").find { |bucket| bucket.dig("metadata", "name") == name }
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/start_target_app.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "shellwords"
+
+class Renuo::Cli::Services::Deploio
+  class StartTargetApp < Actor
+    include ReviewAppHelper
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :branch
+
+    def call
+      puts "starting app #{target_app_name}..."
+      system! "nctl update app #{target_app_name} -p #{project} --git-revision #{Shellwords.escape(branch)} " \
+              "--skip-repo-access-check --no-pause"
+    end
+  end
+end

data/lib/renuo/cli/services/deploio/update_target_app_env.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "create_s3"
+
+class Renuo::Cli::Services::Deploio
+  class UpdateTargetAppEnv < Actor
+    include ReviewAppHelper
+
+    SENSITIVE_ENV_KEYS = (%w[DATABASE_URL REDIS_URL] + CreateS3::SENSITIVE_ENV_KEYS).freeze
+
+    input :project
+    input :target_app_name, must: satisfy(SafeReviewAppNameContract)
+    input :envs
+
+    def call
+      return if env.empty?
+
+      puts "updating env of app #{target_app_name}..."
+      system! ["nctl update app #{target_app_name} -p #{project}",
+               env_flag("--env", env.except(*SENSITIVE_ENV_KEYS)),
+               env_flag("--sensitive-env", env.slice(*SENSITIVE_ENV_KEYS))].compact.join(" ")
+    end
+
+    private
+
+    def env
+      @env ||= envs.reduce({}, :merge)
+    end
+
+    def env_flag(flag, variables)
+      return if variables.empty?
+
+      "#{flag} #{Shellwords.escape(variables.map { |key, value| "#{key}=#{value}" }.join(";"))}"
+    end
+  end
+end

data/lib/renuo/cli/services/deploio.rb

@@ -3,7 +3,21 @@
 require "shellwords"
 
 class Renuo::Cli::Services::Deploio
+  extend ReviewAppHelper
+
   class << self
+    # A named nctl get that misses searches every project of the organization,
+    # which project-scoped service accounts are forbidden to do.
+    def resource_exists?(type, name, project)
+      nctl_resources("nctl get #{type} -p #{project} -o yaml").any? do |resource|
+        resource.dig("metadata", "name") == name
+      end
+    end
+
+    def fetch_resource(type, name, project)
+      nctl_resources("nctl get #{type} #{name} -p #{project} -o yaml").first
+    end
+
     def fetch_apps
       active_org, available_orgs = fetch_whoami_orgs
 
@@ -33,9 +47,7 @@ class Renuo::Cli::Services::Deploio
     end
 
     def fetch_vms
-      fetch_vms_cmd = %(nctl get cloudvm -A -o yaml)
-      stdout, stderr, status = Open3.capture3 fetch_vms_cmd
-      raise "Error fetching Deploio app list: #{stderr}" unless status.success?
+      stdout, = run_nctl_command(%(nctl get cloudvm -A -o yaml))
 
       YAML.load_stream(stdout).map do |app|
         {
@@ -61,7 +73,7 @@ class Renuo::Cli::Services::Deploio
     end
 
     def run_nctl_command(cmd)
-      stdout, stderr, status = Open3.capture3(cmd)
+      stdout, stderr, status = system!(cmd, quiet: true, abort_on_failure: false)
       raise "Error fetching Deploio app list: #{stderr}" unless status.success?
 
       [stdout, stderr, status]

data/lib/renuo/cli/templates/semaphore/review-app-deploy.yml.erb

@@ -0,0 +1,44 @@
+version: v1.0
+name: review-app-deploy
+
+agent:
+  machine:
+    type: e1-standard-2
+    os_image: ubuntu2404
+
+blocks:
+  - name: review-app-deploy
+    execution_time_limit:
+      minutes: 30
+    task:
+      secrets:
+        - name: <%= secret_name %>
+      jobs:
+        - name: deploying
+          commands:
+            - gem i -q renuo-cli
+            - renuo ci setup
+            # pg_restore rejects backups dumped by a newer PostgreSQL, so match or exceed the origin database's version.
+            - sudo apt-get install -qq postgresql-common
+            - sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
+            - sudo apt-get install -qq postgresql-client-18
+            - export PATH=/usr/lib/postgresql/18/bin:$PATH
+            - renuo review-app:deploy --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --origin-pattern <%= origin_pattern %>
+            # Make sure your review apps have the right environment variables. We don't copy from origin.
+            #
+            # -| nctl update app $(renuo review-app:name --branch $SEMAPHORE_GIT_WORKING_BRANCH) --project <%= project %> \
+            #      --env "KEY=value" --sensitive-env "SECRET=$FROM_SEMAPHORE_SECRET" \
+            #      --build-env "KEY=value" --sensitive-build-env "KEY=value"
+            #
+            # To find out which env variables a previously existing app uses, inspect its spec:
+            #
+            # - nctl get app existing-app --project <%= project %> -o yaml
+            #
+            # The runtime env is at .spec.forProvider.config.env, the build env at .spec.forProvider.buildEnv.
+            #
+            # If the origin's env variables are safe to reuse on review apps, you can replace this whole
+            # block (deploy, env setup, and start) with a single command:
+            #
+            # - renuo review-app:deploy --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH --origin-pattern <%= origin_pattern %> --keep-envs=build,sensitive-build,runtime,sensitive-runtime --start
+            - renuo review-app:start --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH
+            - renuo ci check-deploio-status $(renuo review-app:name --branch $SEMAPHORE_GIT_WORKING_BRANCH) --project <%= project %>

data/lib/renuo/cli/templates/semaphore/review-app-purge.yml.erb

@@ -0,0 +1,21 @@
+version: v1.0
+name: review-app-purge
+
+agent:
+  machine:
+    type: e1-standard-2
+    os_image: ubuntu2404
+
+blocks:
+  - name: review-app-purge
+    execution_time_limit:
+      minutes: 15
+    task:
+      secrets:
+        - name: <%= secret_name %>
+      jobs:
+        - name: purging
+          commands:
+            - gem i -q renuo-cli
+            - renuo ci setup
+            - renuo review-app:purge --project <%= project %> --branch $SEMAPHORE_GIT_WORKING_BRANCH

data/lib/renuo/cli/version.rb

@@ -3,7 +3,7 @@
 # simplecov:disable
 module Renuo
   class Cli
-    VERSION = "4.27.0"
+    VERSION = "4.28.0"
     NAME = "renuo-cli"
   end
 end

data/lib/renuo/cli.rb

@@ -10,11 +10,21 @@ require "net/http"
 require "open3"
 require "psych"
 require "securerandom"
+require "service_actor"
 require "tmpdir"
 require "uri"
 require "renuo/cli/version"
 
+module Renuo
+  class Cli
+    module Commands; end
+    module Services; end
+  end
+end
+
 Dir[File.expand_path("cli/helpers/*.rb", __dir__)].each { |f| require f }
+require_relative "cli/services/deploio"
+Dir[File.expand_path("cli/services/deploio/*.rb", __dir__)].each { |f| require f }
 
 def agree(question)
   question += " [y/n]" if question

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: renuo-cli
 version: !ruby/object:Gem::Version
-  version: 4.27.0
+  version: 4.28.0
 platform: ruby
 authors:
 - Renuo AG
@@ -51,6 +51,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: contracts
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
+- !ruby/object:Gem::Dependency
+  name: service_actor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.9'
 description: The Renuo CLI automates some commonly used workflows by providing a command
   line interface.
 email:
@@ -89,25 +117,45 @@ files:
 - lib/renuo/cli/commands/heroku_users.rb
 - lib/renuo/cli/commands/list_large_git_files.rb
 - lib/renuo/cli/commands/release.rb
+- lib/renuo/cli/commands/review_app/deploy.rb
+- lib/renuo/cli/commands/review_app/name.rb
+- lib/renuo/cli/commands/review_app/purge.rb
+- lib/renuo/cli/commands/review_app/setup_semaphoreci.rb
+- lib/renuo/cli/commands/review_app/start.rb
 - lib/renuo/cli/commands/setup_autocompletion.rb
 - lib/renuo/cli/commands/setup_uptimerobot.rb
 - lib/renuo/cli/commands/upgrade_laptop.rb
 - lib/renuo/cli/credentials.yml.enc
+- lib/renuo/cli/helpers/actor_contracts.rb
+- lib/renuo/cli/helpers/cmd_trail.rb
 - lib/renuo/cli/helpers/command_helper.rb
 - lib/renuo/cli/helpers/commander_introspector.rb
 - lib/renuo/cli/helpers/credentials_helper.rb
 - lib/renuo/cli/helpers/environments.rb
 - lib/renuo/cli/helpers/renuo_version.rb
+- lib/renuo/cli/helpers/review_app_helper.rb
+- lib/renuo/cli/helpers/safe_review_app_name_contract.rb
 - lib/renuo/cli/helpers/zsh_completion_script.rb
 - lib/renuo/cli/services/cache.rb
 - lib/renuo/cli/services/cloudfront_config_service.rb
 - lib/renuo/cli/services/deploio.rb
+- lib/renuo/cli/services/deploio/copy_app.rb
+- lib/renuo/cli/services/deploio/copy_database_data.rb
+- lib/renuo/cli/services/deploio/copy_s3_data.rb
+- lib/renuo/cli/services/deploio/create_database.rb
+- lib/renuo/cli/services/deploio/create_kvs.rb
+- lib/renuo/cli/services/deploio/create_s3.rb
+- lib/renuo/cli/services/deploio/inventorize_origin_resources.rb
+- lib/renuo/cli/services/deploio/start_target_app.rb
+- lib/renuo/cli/services/deploio/update_target_app_env.rb
 - lib/renuo/cli/services/heroku.rb
 - lib/renuo/cli/services/hetzner.rb
 - lib/renuo/cli/services/renuo_cli_config.rb
 - lib/renuo/cli/templates/semaphore/bin/cache_restore.erb
 - lib/renuo/cli/templates/semaphore/bin/cache_store.erb
 - lib/renuo/cli/templates/semaphore/notification.yml.erb
+- lib/renuo/cli/templates/semaphore/review-app-deploy.yml.erb
+- lib/renuo/cli/templates/semaphore/review-app-purge.yml.erb
 - lib/renuo/cli/templates/semaphore/semaphore-deploy.yml.erb
 - lib/renuo/cli/templates/semaphore/semaphore.yml.erb
 - lib/renuo/cli/templates/slidev/README.md.erb