airbyte-internal-ops 0.2.1__tar.gz → 0.2.3__tar.gz

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/release-drafter.yml

@@ -64,4 +64,5 @@ autolabeler:
       - '/^build\(deps\)\:/i'
   - label: "breaking"
     title:
-      - '/!:\s*$/i'
+      # Match conventional commit breaking change syntax: feat!: or fix!: etc.
+      - '/^[a-zA-Z]+(\([^)]+\))?!:/i'

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/autofix-command.yml

@@ -20,10 +20,9 @@ jobs:
   run-autofix-command:
     runs-on: ubuntu-latest
     steps:
-      - name: Authenticate as GitHub App (if available)
+      - name: Authenticate as GitHub App
         uses: actions/create-github-app-token@v2
         id: get-app-token
-        continue-on-error: true
         with:
           app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
@@ -33,5 +32,5 @@ jobs:
         with:
           pr: ${{ github.event.inputs.pr }}
           comment-id: ${{ github.event.inputs.comment-id }}
-          github-token: ${{ steps.get-app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.get-app-token.outputs.token }}
           command: autofix

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/connector-regression-test.yml

@@ -175,7 +175,7 @@ jobs:
             ARGS+=(--skip-compare)
 
             if [ -n "${{ inputs.override_test_image }}" ]; then
-              ARGS+=(--connector-image "${{ inputs.override_test_image }}")
+              ARGS+=(--test-image "${{ inputs.override_test_image }}")
             fi
           else
             # Comparison mode (default): run target vs control

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/lock-command.yml

@@ -20,10 +20,9 @@ jobs:
   run-lock-command:
     runs-on: ubuntu-latest
     steps:
-      - name: Authenticate as GitHub App (if available)
+      - name: Authenticate as GitHub App
         uses: actions/create-github-app-token@v2
         id: get-app-token
-        continue-on-error: true
         with:
           app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
@@ -33,5 +32,5 @@ jobs:
         with:
           pr: ${{ github.event.inputs.pr }}
           comment-id: ${{ github.event.inputs.comment-id }}
-          github-token: ${{ steps.get-app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.get-app-token.outputs.token }}
           command: lock

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/poe-command.yml

@@ -18,10 +18,9 @@ jobs:
   run-poe-command:
     runs-on: ubuntu-latest
     steps:
-      - name: Authenticate as GitHub App (if available)
+      - name: Authenticate as GitHub App
         uses: actions/create-github-app-token@v2
         id: get-app-token
-        continue-on-error: true
         with:
           app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
@@ -31,4 +30,4 @@ jobs:
         with:
           pr: ${{ github.event.inputs.pr }}
           comment-id: ${{ github.event.inputs.comment-id }}
-          github-token: ${{ steps.get-app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.get-app-token.outputs.token }}

airbyte_internal_ops-0.2.3/.github/workflows/release-drafter.yml

@@ -0,0 +1,23 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: release-drafter
+  cancel-in-progress: false
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v6.0.0
+        with:
+          config-name: release-drafter.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

airbyte_internal_ops-0.2.3/.github/workflows/semantic-pr-check.yml

@@ -0,0 +1,103 @@
+# Semantic PR Title Validation
+#
+# This workflow validates PR titles follow conventional commit format and applies
+# labels automatically based on the title.
+#
+# Jobs:
+# 1. validate-pr-title - Ensures PR titles follow semantic format (feat:, fix:, etc.)
+# 2. autolabel - Uses Release Drafter's autolabeler to apply labels based on title
+#    (e.g., "feat:" -> enhancement -> minor, "fix:" -> bug -> patch)
+#
+# Note: The autolabeler uses the same release-drafter.yml config but only applies
+# labels when triggered from PR events (it doesn't create/update draft releases).
+
+name: Semantic PR Title Validation
+
+on:
+  pull_request:
+    types: [opened, edited, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  autolabel:
+    name: Auto-label PR
+    # Apply labels based on PR title using Release Drafter's autolabeler.
+    # Skip if 'edited' event but the title wasn't changed (e.g., only description was edited).
+    # Skipping unnecessary runs reduces unlabel-relabel spam on the PR.
+    # Some notification triggers run upon label additions, so this also prevents notification spam.
+    if: >
+      github.event.action != 'edited'
+      || (
+        github.event.changes.title &&
+        github.event.changes.title.from != ''
+      )
+    runs-on: ubuntu-latest
+    steps:
+      # Remove title-derived labels first to make autolabeler idempotent
+      # (e.g., if PR title changes from "fix:" to "ci:", remove old "bug" label)
+      - name: Remove title-derived labels
+        uses: actions-ecosystem/action-remove-labels@v1
+        with:
+          labels: |
+            bug
+            enhancement
+            chore
+            ci
+            docs
+            testing
+            security
+            dependencies
+            breaking
+
+      # Run release-drafter with disable-releaser to only apply labels (not create releases)
+      - uses: release-drafter/release-drafter@v6
+        with:
+          config-name: release-drafter.yml
+          disable-releaser: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  validate-pr-title:
+    name: Validate PR Title
+    # Skip if 'edited' event but the title wasn't changed (e.g., only description was edited)
+    if: >
+      github.event.action != 'edited'
+      || (
+        github.event.changes.title &&
+        github.event.changes.title.from != ''
+      )
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check semantic PR title
+        uses: amannn/action-semantic-pull-request@v5
+        if: ${{ github.event.pull_request.draft == false }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Configure which types are allowed (newline-delimited).
+          # Comparison is case-insensitive, so only lowercase variants are needed.
+          # See: https://github.com/commitizen/conventional-commit-types/blob/master/index.json
+          types: |
+            fix
+            feat
+            docs
+            ci
+            chore
+            build
+            test
+            refactor
+            perf
+            style
+
+      - name: Check for "do not merge" in PR title
+        if: ${{ github.event.pull_request.draft == false }}
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = context.payload.pull_request.title.toLowerCase();
+            if (title.includes('do not merge') || title.includes('do-not-merge')) {
+              core.setFailed('PR title contains "do not merge" or "do-not-merge". Please remove this before merging.');
+            }

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/sentry-apply-command.yml

@@ -73,10 +73,9 @@ jobs:
           fi
         working-directory: .
 
-      - name: Authenticate as GitHub App (if available)
+      - name: Authenticate as GitHub App
         uses: actions/create-github-app-token@v2
         id: get-app-token
-        continue-on-error: true
         with:
           app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
@@ -108,7 +107,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ steps.pr-info.outputs.ref || github.ref }}
-          token: ${{ steps.get-app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          token: ${{ steps.get-app-token.outputs.token }}
 
       - name: Append comment with job run link
         if: github.event.inputs.comment-id

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/.github/workflows/slash-command-dispatch.yml

@@ -16,10 +16,9 @@ jobs:
     if: ${{ github.event.issue.pull_request }}
     runs-on: ubuntu-latest
     steps:
-      - name: Authenticate as GitHub App (if available)
+      - name: Authenticate as GitHub App
         uses: actions/create-github-app-token@v2
         id: get-app-token
-        continue-on-error: true
         with:
           app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
@@ -29,7 +28,7 @@ jobs:
         uses: peter-evans/slash-command-dispatch@v5
         with:
           repository: ${{ github.repository }}
-          token: ${{ steps.get-app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          token: ${{ steps.get-app-token.outputs.token }}
           dispatch-type: workflow
           issue-type: pull-request
           commands: |

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/CONTRIBUTING.md

@@ -99,11 +99,28 @@ gcloud secrets get-iam-policy projects/587336813068/secrets/CONNECTION_RETRIEVER
 
 When running outside of the VPC (without Tailscale), use the Cloud SQL Auth Proxy:
 
+**Option A: Using the CLI (Recommended)**
+
+Pre-install the CLI tool:
+```bash
+uv tool install airbyte-internal-ops
+airbyte-ops cloud db start-proxy --port=5433
+```
+
+Or use as a single-step command:
+```bash
+uvx --from=airbyte-internal-ops airbyte-ops cloud db start-proxy --port=5433
+```
+
+**Option B: Manual startup**
+
 ```bash
-# Start the proxy (use a non-conflicting port if 5432 is in use)
+# Start the proxy on port 5433 (avoids conflicts with default PostgreSQL port 5432)
 cloud-sql-proxy prod-ab-cloud-proj:us-west3:prod-pgsql-replica --port=5433
+```
 
-# Set environment variables for your application
+Then set environment variables for your application:
+```bash
 export USE_CLOUD_SQL_PROXY=1
 export DB_PORT=5433
 export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airbyte-internal-ops
-Version: 0.2.1
+Version: 0.2.3
 Summary: MCP and API interfaces that let the agents do the admin work
 Author-email: Aaron Steers <aj@airbyte.io>
 Keywords: admin,airbyte,api,mcp
@@ -121,7 +121,23 @@ Some tools (like `list_org_connections_by_source_type_db`) require access to the
    gcloud auth application-default login
    ```
 
-2. Start Cloud SQL Proxy:
+2. Start Cloud SQL Proxy using one of the following methods:
+
+   **Option A: Using the CLI (Recommended)**
+   
+   Pre-install the CLI tool:
+   ```bash
+   uv tool install airbyte-internal-ops
+   airbyte-ops cloud db start-proxy --port=15432
+   ```
+   
+   Or use as a single-step command:
+   ```bash
+   uvx --from=airbyte-internal-ops airbyte-ops cloud db start-proxy --port=15432
+   ```
+
+   **Option B: Manual startup**
+   
    ```bash
    cloud-sql-proxy prod-ab-cloud-proj:us-west3:prod-pgsql-replica --port=15432
    ```

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/README.md

@@ -82,7 +82,23 @@ Some tools (like `list_org_connections_by_source_type_db`) require access to the
    gcloud auth application-default login
    ```
 
-2. Start Cloud SQL Proxy:
+2. Start Cloud SQL Proxy using one of the following methods:
+
+   **Option A: Using the CLI (Recommended)**
+   
+   Pre-install the CLI tool:
+   ```bash
+   uv tool install airbyte-internal-ops
+   airbyte-ops cloud db start-proxy --port=15432
+   ```
+   
+   Or use as a single-step command:
+   ```bash
+   uvx --from=airbyte-internal-ops airbyte-ops cloud db start-proxy --port=15432
+   ```
+
+   **Option B: Manual startup**
+   
    ```bash
    cloud-sql-proxy prod-ab-cloud-proj:us-west3:prod-pgsql-replica --port=15432
    ```

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/src/airbyte_ops_mcp/cli/registry.py

@@ -5,6 +5,7 @@ This module provides CLI wrappers for registry operations. The core logic
 lives in the `airbyte_ops_mcp.registry` capability module.
 
 Commands:
+    airbyte-ops registry connector compute-prerelease-tag - Compute prerelease version tag
     airbyte-ops registry connector publish-prerelease - Publish connector prerelease
     airbyte-ops registry connector publish - Publish connector (apply/rollback version override)
     airbyte-ops registry image inspect - Inspect Docker image on DockerHub
@@ -12,9 +13,12 @@ Commands:
 
 from __future__ import annotations
 
+import contextlib
+import sys
 from pathlib import Path
 from typing import Annotated
 
+import yaml
 from cyclopts import App, Parameter
 
 from airbyte_ops_mcp.cli._base import app
@@ -24,8 +28,15 @@ from airbyte_ops_mcp.cli._shared import (
     print_json,
     print_success,
 )
+from airbyte_ops_mcp.github_actions import (
+    get_file_contents_at_ref,
+    resolve_github_token,
+)
 from airbyte_ops_mcp.mcp.github import get_docker_image_info
-from airbyte_ops_mcp.mcp.prerelease import publish_connector_to_airbyte_registry
+from airbyte_ops_mcp.mcp.prerelease import (
+    compute_prerelease_docker_image_tag,
+    publish_connector_to_airbyte_registry,
+)
 from airbyte_ops_mcp.registry import (
     ConnectorPublishResult,
     PublishAction,
@@ -47,6 +58,111 @@ image_app = App(name="image", help="Docker image operations.")
 registry_app.command(image_app)
 
 
+AIRBYTE_REPO_OWNER = "airbytehq"
+AIRBYTE_REPO_NAME = "airbyte"
+CONNECTOR_PATH_PREFIX = "airbyte-integrations/connectors"
+
+
+def _get_connector_version_from_github(
+    connector_name: str,
+    ref: str,
+    token: str | None = None,
+) -> str | None:
+    """Fetch connector version from metadata.yaml via GitHub API.
+
+    Args:
+        connector_name: Connector name (e.g., "source-github")
+        ref: Git ref (commit SHA, branch name, or tag)
+        token: GitHub API token (optional for public repos)
+
+    Returns:
+        Version string from metadata.yaml, or None if not found.
+    """
+    path = f"{CONNECTOR_PATH_PREFIX}/{connector_name}/metadata.yaml"
+    contents = get_file_contents_at_ref(
+        owner=AIRBYTE_REPO_OWNER,
+        repo=AIRBYTE_REPO_NAME,
+        path=path,
+        ref=ref,
+        token=token,
+    )
+    if contents is None:
+        return None
+
+    metadata = yaml.safe_load(contents)
+    return metadata.get("data", {}).get("dockerImageTag")
+
+
+@connector_app.command(name="compute-prerelease-tag")
+def compute_prerelease_tag(
+    connector_name: Annotated[
+        str,
+        Parameter(help="Connector name (e.g., 'source-github')."),
+    ],
+    sha: Annotated[
+        str,
+        Parameter(help="Git commit SHA (full or at least 7 characters)."),
+    ],
+    base_version: Annotated[
+        str | None,
+        Parameter(
+            help="Base version override. If not provided, fetched from metadata.yaml at the given SHA."
+        ),
+    ] = None,
+) -> None:
+    """Compute the pre-release docker image tag.
+
+    Outputs the version tag to stdout for easy capture in shell scripts.
+    This is the single source of truth for pre-release version format.
+
+    The command fetches the connector's metadata.yaml from GitHub at the given SHA
+    to determine the base version. It also compares against the master branch and
+    prints a warning to stderr if no version bump is detected.
+
+    If --base-version is provided, it is used directly instead of fetching from GitHub.
+
+    Example:
+        airbyte-ops registry connector compute-prerelease-tag --connector-name source-github --sha abcdef1234567
+        # Output: 1.2.3-preview.abcdef1
+
+        airbyte-ops registry connector compute-prerelease-tag --connector-name source-github --sha abcdef1234567 --base-version 1.2.3
+        # Output: 1.2.3-preview.abcdef1 (uses provided version, skips GitHub API)
+    """
+    # Try to get a GitHub token (optional, but helps avoid rate limiting)
+    # Token resolution may fail if no token is configured, which is fine for public repos
+    token: str | None = None
+    with contextlib.suppress(ValueError):
+        token = resolve_github_token()
+
+    # Determine base version
+    version: str
+    if base_version:
+        version = base_version
+    else:
+        # Fetch version from metadata.yaml at the given SHA
+        fetched_version = _get_connector_version_from_github(connector_name, sha, token)
+        if fetched_version is None:
+            print(
+                f"Error: Could not fetch metadata.yaml for {connector_name} at ref {sha}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+        version = fetched_version
+
+    # Compare with master branch version and warn if no bump detected
+    master_version = _get_connector_version_from_github(connector_name, "master", token)
+    if master_version and master_version == version:
+        print(
+            f"Warning: No version bump detected for {connector_name}. "
+            f"Version {version} matches master branch.",
+            file=sys.stderr,
+        )
+
+    # Compute and output the prerelease tag
+    tag = compute_prerelease_docker_image_tag(version, sha)
+    print(tag)
+
+
 @connector_app.command(name="publish-prerelease")
 def publish_prerelease(
     connector_name: Annotated[

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/src/airbyte_ops_mcp/constants.py

@@ -3,7 +3,9 @@
 
 from __future__ import annotations
 
-from enum import Enum
+from enum import Enum, StrEnum
+
+from airbyte.exceptions import PyAirbyteInputError
 
 MCP_SERVER_NAME = "airbyte-internal-ops"
 """The name of the MCP server."""
@@ -59,6 +61,64 @@ CLOUD_REGISTRY_URL = (
 )
 """URL for the Airbyte Cloud connector registry."""
 
+# =============================================================================
+# Organization ID Aliases
+# =============================================================================
+
+
+class OrganizationAliasEnum(StrEnum):
+    """Organization ID aliases that can be used in place of UUIDs.
+
+    Each member's name is the alias (e.g., "@airbyte-internal") and its value
+    is the actual organization UUID. Use `OrganizationAliasEnum.resolve()` to
+    resolve aliases to actual IDs.
+    """
+
+    AIRBYTE_INTERNAL = "664c690e-5263-49ba-b01f-4a6759b3330a"
+    """The Airbyte internal organization for testing and internal operations.
+
+    Alias: @airbyte-internal
+    """
+
+    @classmethod
+    def resolve(cls, org_id: str | None) -> str | None:
+        """Resolve an organization ID alias to its actual UUID.
+
+        Accepts either an alias string (e.g., "@airbyte-internal") or an
+        OrganizationAliasEnum enum member, and returns the actual UUID.
+
+        Returns:
+            The resolved organization ID (UUID), or None if input is None.
+            If the input doesn't start with "@", it is returned unchanged.
+
+        Raises:
+            PyAirbyteInputError: If the input starts with "@" but is not a recognized alias.
+        """
+        if org_id is None:
+            return None
+
+        # Handle OrganizationAliasEnum enum members directly
+        if isinstance(org_id, cls):
+            return org_id.value
+
+        # If it doesn't look like an alias, return as-is (assume it's a UUID)
+        if not org_id.startswith("@"):
+            return org_id
+
+        # Handle alias strings or raise an error if invalid
+        alias_mapping = {
+            "@airbyte-internal": cls.AIRBYTE_INTERNAL.value,
+        }
+        if org_id not in alias_mapping:
+            raise PyAirbyteInputError(
+                message=f"Unknown organization alias: {org_id}",
+                context={
+                    "valid_aliases": list(alias_mapping.keys()),
+                },
+            )
+        return alias_mapping[org_id]
+
+
 CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS_SECRET_ID = (
     "projects/587336813068/secrets/CONNECTION_RETRIEVER_PG_CONNECTION_DETAILS"
 )

{airbyte_internal_ops-0.2.1 → airbyte_internal_ops-0.2.3}/src/airbyte_ops_mcp/github_actions.py

@@ -106,6 +106,51 @@ class WorkflowJobInfo:
     """ISO 8601 timestamp when the job completed"""
 
 
+def get_file_contents_at_ref(
+    owner: str,
+    repo: str,
+    path: str,
+    ref: str,
+    token: str | None = None,
+) -> str | None:
+    """Fetch file contents from GitHub at a specific ref.
+
+    Uses the GitHub Contents API to retrieve file contents at a specific
+    commit SHA, branch, or tag. This allows reading files without having
+    the repository checked out locally.
+
+    Args:
+        owner: Repository owner (e.g., "airbytehq")
+        repo: Repository name (e.g., "airbyte")
+        path: Path to the file within the repository
+        ref: Git ref (commit SHA, branch name, or tag)
+        token: GitHub API token (optional for public repos, but recommended
+            to avoid rate limiting)
+
+    Returns:
+        File contents as a string, or None if the file doesn't exist.
+
+    Raises:
+        requests.HTTPError: If API request fails (except 404).
+    """
+    url = f"{GITHUB_API_BASE}/repos/{owner}/{repo}/contents/{path}"
+    headers = {
+        "Accept": "application/vnd.github.raw+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+
+    params = {"ref": ref}
+
+    response = requests.get(url, headers=headers, params=params, timeout=30)
+    if response.status_code == 404:
+        return None
+    response.raise_for_status()
+
+    return response.text
+
+
 def get_workflow_jobs(
     owner: str,
     repo: str,