autopkg-wrapper 2026.2.6__tar.gz → 2026.2.9__tar.gz

{autopkg_wrapper-2026.2.6 → autopkg_wrapper-2026.2.9}/.github/workflows/build-publish.yml

@@ -103,7 +103,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup mise
         uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1

{autopkg_wrapper-2026.2.6 → autopkg_wrapper-2026.2.9}/.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@25a224b8085c21d4d61b7fc051468805fc3ac490 # codeql-bundle-v2.24.0

{autopkg_wrapper-2026.2.6 → autopkg_wrapper-2026.2.9}/.github/workflows/dependency-review.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: "Dependency Review"
         uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

{autopkg_wrapper-2026.2.6 → autopkg_wrapper-2026.2.9}/.pre-commit-config.yaml

@@ -14,20 +14,28 @@ repos:
   #   hooks:
   #     - id: gitleaks
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.10
+    rev: v0.14.14
     hooks:
       - id: ruff-check
         args: [--fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
     # uv version.
-    rev: 0.8.13
+    rev: 0.9.28
     hooks:
       - id: uv-lock
       - id: uv-sync
         args: ['--locked', '--all-packages']
+  - repo: local
+    hooks:
+      - id: generate-cli-docs
+        name: Generate CLI docs
+        entry: mise run docs-cli
+        language: system
+        pass_filenames: false
+        files: ^autopkg_wrapper/utils/args\.py$
   - repo: https://github.com/executablebooks/mdformat
-    rev: 0.7.22
+    rev: 1.0.0
     hooks:
       - id: mdformat
         additional_dependencies:

autopkg_wrapper-2026.2.9/.ruff.toml

@@ -0,0 +1,14 @@
+line-length = 88
+target-version = "py314"
+
+[lint]
+select = ["E", "F", "I", "B", "UP", "C4", "SIM"]
+ignore = [
+  "E501",
+]
+
+[format]
+quote-style = "double"
+indent-style = "space"
+line-ending = "lf"
+skip-magic-trailing-comma = false

autopkg_wrapper-2026.2.9/AGENTS.md

@@ -0,0 +1,134 @@
+# autopkg-wrapper Agent Notes
+
+## Overview
+
+This repository provides `autopkg_wrapper`, a CLI for running AutoPkg recipes in CI/CD
+with optional trust verification, batching/ordering, reporting, and notifications.
+
+## Environment
+
+- Python is managed by `mise` (see `mise.toml`).
+- Dependencies are managed by `uv`.
+- Tests are run with `pytest`.
+- Packaging uses `hatchling` via `uv build`.
+- CLI entry point: `autopkg_wrapper/autopkg_wrapper.py`.
+
+## Build / Lint / Test Commands
+
+Setup:
+
+```bash
+mise run install
+```
+
+Run tests:
+
+```bash
+mise run test
+```
+
+Run a single test file:
+
+```bash
+uv run pytest tests/test_order_recipe_list.py -v
+```
+
+Run a single test by name:
+
+```bash
+uv run pytest -k "test_orders_by_type_then_alpha" -v
+```
+
+Lint / format with Ruff:
+
+```bash
+uv run ruff check .
+uv run ruff format .
+```
+
+Build package:
+
+```bash
+mise run build
+```
+
+Regenerate CLI docs:
+
+```bash
+mise run docs-cli
+```
+
+## Code Style Guidelines
+
+Formatting:
+
+- Follow Ruff formatting defaults with project settings in `.ruff.toml`.
+- Line length target is 88; `E501` is ignored but keep lines readable.
+- Use double quotes; spaces for indentation; LF line endings.
+
+Imports:
+
+- Ruff enforces import sorting; keep stdlib, third-party, local separated.
+- Prefer explicit imports over wildcard imports.
+- Use local imports only when needed to avoid optional dependency issues.
+
+Types and typing:
+
+- Target Python 3.14 (`py314`).
+- Use type hints for new functions, especially in utils and models.
+- Prefer `list[str]`, `dict[str, T]`, and `Path` over legacy typing aliases.
+- Use `Protocol` only when you need structural typing (see `recipe_batching.py`).
+
+Naming:
+
+- Modules and functions: `snake_case`.
+- Classes: `PascalCase`.
+- Constants: `UPPER_SNAKE_CASE`.
+- Prefer descriptive variable names for recipes, batches, and paths.
+
+Error handling:
+
+- Use explicit exceptions when failing fast (see `parse_recipe_list`).
+- Log errors with context; avoid swallowing exceptions unless necessary.
+- When catching broad exceptions, add a comment or log explaining why.
+
+Logging:
+
+- Use `logging` from the stdlib.
+- Keep log messages concise and user-actionable.
+- Prefer structured or consistent message patterns for batch operations.
+
+I/O and subprocess:
+
+- Use `Path` for filesystem paths; avoid string path math.
+- When calling subprocesses, capture output and log debug info.
+- Keep command construction explicit for readability and auditability.
+
+Recipes and ordering:
+
+- Keep recipe identifiers as full filenames (e.g. `Foo.upload.jamf`).
+- Ordering logic lives in `autopkg_wrapper/utils/recipe_ordering.py`.
+- Batching logic lives in `autopkg_wrapper/utils/recipe_batching.py`.
+
+Tests:
+
+- Place tests in `tests/` with `test_*.py` naming.
+- Use `pytest` fixtures or `SimpleNamespace` for lightweight args.
+- Mock subprocess calls rather than invoking external tools.
+
+Docs:
+
+- User-facing behavior changes should be reflected in `README.md`.
+
+## Repository Notes
+
+- No Cursor rules or Copilot instructions were found in this repo.
+- If new rules are added under `.cursor/rules/`, `.cursorrules`,
+  or `.github/copilot-instructions.md`, include them here.
+
+## Key Paths
+
+- CLI: `autopkg_wrapper/autopkg_wrapper.py`
+- Recipe model: `autopkg_wrapper/models/recipe.py`
+- Utils: `autopkg_wrapper/utils/`
+- Tests: `tests/`

autopkg_wrapper-2026.2.9/PKG-INFO

@@ -0,0 +1,244 @@
+Metadata-Version: 2.4
+Name: autopkg-wrapper
+Version: 2026.2.9
+Summary: A package used to execute some autopkg functions, primarily within the context of a GitHub Actions runner.
+Project-URL: Repository, https://github.com/smithjw/autopkg-wrapper
+Author-email: James Smith <james@smithjw.me>
+License-Expression: BSD-3-Clause
+License-File: LICENSE
+Requires-Python: ~=3.14.0
+Requires-Dist: chardet
+Requires-Dist: idna
+Requires-Dist: jamf-pro-sdk
+Requires-Dist: pygithub
+Requires-Dist: requests
+Requires-Dist: ruamel-yaml
+Requires-Dist: toml
+Requires-Dist: urllib3
+Description-Content-Type: text/markdown
+
+# autopkg-wrapper
+
+`autopkg_wrapper` is a small package that can be used to run [`autopkg`](https://github.com/autopkg/autopkg) within CI/CD environments such as GitHub Actions.
+
+The easiest way to run it is by installing with pip.
+
+```shell
+pip install autopkg-wrapper
+```
+
+## Development
+
+This project uses `uv` for dependency management and `mise` tasks for common workflows.
+
+```bash
+mise run install
+mise run test
+mise run build
+```
+
+## Command Line Parameters
+
+<!-- CLI-PARAMS-START -->
+
+```shell
+usage: autopkg_wrapper [-h] [--recipe-file RECIPE_FILE |
+                       --recipes [RECIPES ...]]
+                       [--recipe-processing-order [RECIPE_PROCESSING_ORDER ...]]
+                       [--autopkg-bin AUTOPKG_BIN] [--dry-run] [--debug]
+                       [--disable-recipe-trust-check] [--disable-git-commands]
+                       [--concurrency CONCURRENCY]
+                       [--github-token GITHUB_TOKEN]
+                       [--branch-name BRANCH_NAME] [--create-pr]
+                       [--create-issues]
+                       [--overrides-repo-path OVERRIDES_REPO_PATH]
+                       [--post-processors [POST_PROCESSORS ...]]
+                       [--autopkg-prefs AUTOPKG_PREFS] [--process-reports]
+                       [--reports-zip REPORTS_ZIP]
+                       [--reports-extract-dir REPORTS_EXTRACT_DIR]
+                       [--reports-dir REPORTS_DIR]
+                       [--reports-out-dir REPORTS_OUT_DIR]
+                       [--reports-run-date REPORTS_RUN_DATE]
+                       [--reports-strict]
+
+Run autopkg recipes
+
+options:
+  -h, --help            show this help message and exit
+  --recipe-file RECIPE_FILE
+                        Provide the list of recipes to run via a JSON file for
+                        easier management.
+  --recipes [RECIPES ...]
+                        Recipes to run via CLI flag or environment variable.
+                        If the '--recipes' flag is used, simply provide a
+                        space-separated list on the command line: `autopkg-
+                        wrapper --recipes recipe_one.download
+                        recipe_two.download` Alternatively, you can provide a
+                        space/comma-separated list in the 'AW_RECIPES'
+                        environment variable: `export
+                        AW_RECIPES="recipe_one.download recipe_two.download"`
+                        `export AW_RECIPES="recipe_one.pkg,recipe_two.pkg"`
+                        `autopkg-wrapper`
+  --recipe-processing-order [RECIPE_PROCESSING_ORDER ...]
+                        This option comes in handy if you include additional
+                        recipe type names in your overrides and wish them to
+                        be processed in a specific order. We'll specifically
+                        look for these recipe types after the first period (.)
+                        in the recipe name. Order items can be either a full
+                        type suffix (e.g. "upload.jamf") or a partial token
+                        (e.g. "upload", "auto_update"). Partial tokens are
+                        matched against the dot-separated segments after the
+                        first '.' so recipes like "Foo.epz.auto_update.jamf"
+                        will match "auto_update". This can also be provided
+                        via the 'AW_RECIPE_PROCESSING_ORDER' environment
+                        variable as a comma-separated list (e.g.
+                        "upload,self_service,auto_update"). For example, if
+                        you have the following recipes to be processed:
+                        ExampleApp.auto_install.jamf ExampleApp.upload.jamf
+                        ExampleApp.self_service.jamf And you want to ensure
+                        that the .upload recipes are always processed first,
+                        followed by .auto_install, and finally .self_service,
+                        you would provide the following processing order:
+                        `--recipe-processing-order upload.jamf
+                        auto_install.jamf self_service.jamf` This would ensure
+                        that all .upload recipes are processed before any
+                        other recipe types. Within each recipe type, the
+                        recipes will be ordered alphabetically. We assume that
+                        no extensions are provided (but will strip them if
+                        needed - extensions that are stripped include .recipe
+                        or .recipe.yaml).
+  --autopkg-bin AUTOPKG_BIN
+                        Path to the autopkg binary (default:
+                        /usr/local/bin/autopkg). Can also be set via
+                        AW_AUTOPKG_BIN.
+  --dry-run             Show planned actions without executing external
+                        commands
+  --debug               Enable debug logging when running script
+  --disable-recipe-trust-check
+                        If this option is used, recipe trust verification will
+                        not be run prior to a recipe run. This does not set
+                        FAIL_RECIPES_WITHOUT_TRUST_INFO to No. You will need
+                        to set that outside of this application.
+  --disable-git-commands
+                        If this option is used, git commands won't be run
+  --concurrency CONCURRENCY
+                        Number of recipes to run in parallel (default: 1)
+  --github-token GITHUB_TOKEN
+  --branch-name BRANCH_NAME
+                        Branch name to be used recipe overrides have failed
+                        their trust verification and need to be updated. By
+                        default, this will be in the format of
+                        "fix/update_trust_information/YYYY-MM-DDTHH-MM-SS"
+  --create-pr           If enabled, autopkg_wrapper will open a PR for updated
+                        trust information
+  --create-issues       Create a GitHub issue for recipes that fail during
+                        processing
+  --overrides-repo-path OVERRIDES_REPO_PATH
+                        The path on disk to the git repository containing the
+                        autopkg overrides directory. If none is provided, we
+                        will try to determine it for you.
+  --post-processors [POST_PROCESSORS ...]
+                        One or more autopkg post processors to run after each
+                        recipe execution
+  --autopkg-prefs AUTOPKG_PREFS
+                        Path to the autopkg preferences you'd like to use
+  --process-reports     Process autopkg report directories or zip and emit
+                        markdown summaries
+  --reports-zip REPORTS_ZIP
+                        Path to an autopkg_report-*.zip to extract and process
+  --reports-extract-dir REPORTS_EXTRACT_DIR
+                        Directory to extract the zip into (default:
+                        autopkg_reports_summary/reports)
+  --reports-dir REPORTS_DIR
+                        Directory of reports to process (if no zip provided)
+  --reports-out-dir REPORTS_OUT_DIR
+                        Directory to write markdown outputs (default:
+                        autopkg_reports_summary/summary)
+  --reports-run-date REPORTS_RUN_DATE
+                        Run date string to include in the summary
+  --reports-strict      Exit non-zero if any errors are detected in processed
+                        reports
+```
+
+<!-- CLI-PARAMS-END -->
+
+## Examples
+
+Run recipes (serial):
+
+```bash
+autopkg_wrapper --recipes Foo.download Bar.download
+```
+
+Run 3 recipes concurrently and process reports afterward:
+
+```bash
+autopkg_wrapper \
+  --recipe-file /path/to/recipe_list.txt \
+  --concurrency 3 \
+  --disable-git-commands \
+  --process-reports \
+  --reports-out-dir /tmp/autopkg_reports_summary \
+  --reports-strict
+```
+
+Process a reports zip explicitly (no recipe run):
+
+```bash
+autopkg_wrapper \
+  --process-reports \
+  --reports-zip /path/to/autopkg_report-2026-02-02.zip \
+  --reports-extract-dir /tmp/autopkg_reports \
+  --reports-out-dir /tmp/autopkg_reports_summary
+```
+
+## Recipe Processing Flow
+
+```mermaid
+flowchart TD
+    start([Start]) --> args[Parse CLI args]
+    args --> load[Load recipes list]
+    load --> order{Processing order provided?}
+    order -- Yes --> batches[Build recipe batches by type]
+    order -- No --> all[Single batch of all recipes]
+    batches --> log[Log each batch type and identifiers]
+    all --> log
+    log --> run[Run batch recipes concurrently within batch]
+    run --> next{More batches?}
+    next -- Yes --> log
+    next -- No --> git[Apply git updates serially]
+    git --> notify[Send notifications]
+    notify --> pr{Create PR?}
+    pr -- Yes --> createPR[Open trust update PR]
+    pr -- No --> issues{Create issues?}
+    createPR --> issues
+    issues -- Yes --> createIssue[Open failures issue]
+    issues -- No --> reports{Process reports?}
+    createIssue --> reports
+    reports -- Yes --> process[Process reports output]
+    reports -- No --> done([Done])
+    process --> done
+```
+
+Related code:
+
+- `autopkg_wrapper/autopkg_wrapper.py`
+- `autopkg_wrapper/utils/recipe_batching.py`
+- `autopkg_wrapper/utils/recipe_ordering.py`
+- `autopkg_wrapper/utils/report_processor.py`
+- `autopkg_wrapper/notifier/slack.py`
+
+Notes:
+
+- During recipe runs, per‑recipe plist reports are written to `/private/tmp/autopkg`.
+- Log output references full recipe identifiers (for example, `Foo.upload.jamf`) and batch logs list recipe identifiers grouped by type.
+- When `--process-reports` is supplied without `--reports-zip` or `--reports-dir`, the tool processes `/private/tmp/autopkg`.
+- If `AUTOPKG_JSS_URL`, `AUTOPKG_CLIENT_ID`, and `AUTOPKG_CLIENT_SECRET` are set, uploaded package rows are enriched with Jamf package links.
+  - No extra CLI flag is required; enrichment runs automatically when all three env vars are present.
+
+An example folder structure and GitHub Actions Workflow is available within the [`actions-demo`](actions-demo)
+
+## Credits
+
+- [`autopkg_tools` from Facebook](https://github.com/facebook/IT-CPE/tree/main/legacy/autopkg_tools)
+- [`autopkg_tools` from Facebook, modified by Gusto](https://github.com/Gusto/it-cpe-opensource/tree/main/autopkg)

autopkg_wrapper-2026.2.9/README.md

@@ -0,0 +1,225 @@
+# autopkg-wrapper
+
+`autopkg_wrapper` is a small package that can be used to run [`autopkg`](https://github.com/autopkg/autopkg) within CI/CD environments such as GitHub Actions.
+
+The easiest way to run it is by installing with pip.
+
+```shell
+pip install autopkg-wrapper
+```
+
+## Development
+
+This project uses `uv` for dependency management and `mise` tasks for common workflows.
+
+```bash
+mise run install
+mise run test
+mise run build
+```
+
+## Command Line Parameters
+
+<!-- CLI-PARAMS-START -->
+
+```shell
+usage: autopkg_wrapper [-h] [--recipe-file RECIPE_FILE |
+                       --recipes [RECIPES ...]]
+                       [--recipe-processing-order [RECIPE_PROCESSING_ORDER ...]]
+                       [--autopkg-bin AUTOPKG_BIN] [--dry-run] [--debug]
+                       [--disable-recipe-trust-check] [--disable-git-commands]
+                       [--concurrency CONCURRENCY]
+                       [--github-token GITHUB_TOKEN]
+                       [--branch-name BRANCH_NAME] [--create-pr]
+                       [--create-issues]
+                       [--overrides-repo-path OVERRIDES_REPO_PATH]
+                       [--post-processors [POST_PROCESSORS ...]]
+                       [--autopkg-prefs AUTOPKG_PREFS] [--process-reports]
+                       [--reports-zip REPORTS_ZIP]
+                       [--reports-extract-dir REPORTS_EXTRACT_DIR]
+                       [--reports-dir REPORTS_DIR]
+                       [--reports-out-dir REPORTS_OUT_DIR]
+                       [--reports-run-date REPORTS_RUN_DATE]
+                       [--reports-strict]
+
+Run autopkg recipes
+
+options:
+  -h, --help            show this help message and exit
+  --recipe-file RECIPE_FILE
+                        Provide the list of recipes to run via a JSON file for
+                        easier management.
+  --recipes [RECIPES ...]
+                        Recipes to run via CLI flag or environment variable.
+                        If the '--recipes' flag is used, simply provide a
+                        space-separated list on the command line: `autopkg-
+                        wrapper --recipes recipe_one.download
+                        recipe_two.download` Alternatively, you can provide a
+                        space/comma-separated list in the 'AW_RECIPES'
+                        environment variable: `export
+                        AW_RECIPES="recipe_one.download recipe_two.download"`
+                        `export AW_RECIPES="recipe_one.pkg,recipe_two.pkg"`
+                        `autopkg-wrapper`
+  --recipe-processing-order [RECIPE_PROCESSING_ORDER ...]
+                        This option comes in handy if you include additional
+                        recipe type names in your overrides and wish them to
+                        be processed in a specific order. We'll specifically
+                        look for these recipe types after the first period (.)
+                        in the recipe name. Order items can be either a full
+                        type suffix (e.g. "upload.jamf") or a partial token
+                        (e.g. "upload", "auto_update"). Partial tokens are
+                        matched against the dot-separated segments after the
+                        first '.' so recipes like "Foo.epz.auto_update.jamf"
+                        will match "auto_update". This can also be provided
+                        via the 'AW_RECIPE_PROCESSING_ORDER' environment
+                        variable as a comma-separated list (e.g.
+                        "upload,self_service,auto_update"). For example, if
+                        you have the following recipes to be processed:
+                        ExampleApp.auto_install.jamf ExampleApp.upload.jamf
+                        ExampleApp.self_service.jamf And you want to ensure
+                        that the .upload recipes are always processed first,
+                        followed by .auto_install, and finally .self_service,
+                        you would provide the following processing order:
+                        `--recipe-processing-order upload.jamf
+                        auto_install.jamf self_service.jamf` This would ensure
+                        that all .upload recipes are processed before any
+                        other recipe types. Within each recipe type, the
+                        recipes will be ordered alphabetically. We assume that
+                        no extensions are provided (but will strip them if
+                        needed - extensions that are stripped include .recipe
+                        or .recipe.yaml).
+  --autopkg-bin AUTOPKG_BIN
+                        Path to the autopkg binary (default:
+                        /usr/local/bin/autopkg). Can also be set via
+                        AW_AUTOPKG_BIN.
+  --dry-run             Show planned actions without executing external
+                        commands
+  --debug               Enable debug logging when running script
+  --disable-recipe-trust-check
+                        If this option is used, recipe trust verification will
+                        not be run prior to a recipe run. This does not set
+                        FAIL_RECIPES_WITHOUT_TRUST_INFO to No. You will need
+                        to set that outside of this application.
+  --disable-git-commands
+                        If this option is used, git commands won't be run
+  --concurrency CONCURRENCY
+                        Number of recipes to run in parallel (default: 1)
+  --github-token GITHUB_TOKEN
+  --branch-name BRANCH_NAME
+                        Branch name to be used recipe overrides have failed
+                        their trust verification and need to be updated. By
+                        default, this will be in the format of
+                        "fix/update_trust_information/YYYY-MM-DDTHH-MM-SS"
+  --create-pr           If enabled, autopkg_wrapper will open a PR for updated
+                        trust information
+  --create-issues       Create a GitHub issue for recipes that fail during
+                        processing
+  --overrides-repo-path OVERRIDES_REPO_PATH
+                        The path on disk to the git repository containing the
+                        autopkg overrides directory. If none is provided, we
+                        will try to determine it for you.
+  --post-processors [POST_PROCESSORS ...]
+                        One or more autopkg post processors to run after each
+                        recipe execution
+  --autopkg-prefs AUTOPKG_PREFS
+                        Path to the autopkg preferences you'd like to use
+  --process-reports     Process autopkg report directories or zip and emit
+                        markdown summaries
+  --reports-zip REPORTS_ZIP
+                        Path to an autopkg_report-*.zip to extract and process
+  --reports-extract-dir REPORTS_EXTRACT_DIR
+                        Directory to extract the zip into (default:
+                        autopkg_reports_summary/reports)
+  --reports-dir REPORTS_DIR
+                        Directory of reports to process (if no zip provided)
+  --reports-out-dir REPORTS_OUT_DIR
+                        Directory to write markdown outputs (default:
+                        autopkg_reports_summary/summary)
+  --reports-run-date REPORTS_RUN_DATE
+                        Run date string to include in the summary
+  --reports-strict      Exit non-zero if any errors are detected in processed
+                        reports
+```
+
+<!-- CLI-PARAMS-END -->
+
+## Examples
+
+Run recipes (serial):
+
+```bash
+autopkg_wrapper --recipes Foo.download Bar.download
+```
+
+Run 3 recipes concurrently and process reports afterward:
+
+```bash
+autopkg_wrapper \
+  --recipe-file /path/to/recipe_list.txt \
+  --concurrency 3 \
+  --disable-git-commands \
+  --process-reports \
+  --reports-out-dir /tmp/autopkg_reports_summary \
+  --reports-strict
+```
+
+Process a reports zip explicitly (no recipe run):
+
+```bash
+autopkg_wrapper \
+  --process-reports \
+  --reports-zip /path/to/autopkg_report-2026-02-02.zip \
+  --reports-extract-dir /tmp/autopkg_reports \
+  --reports-out-dir /tmp/autopkg_reports_summary
+```
+
+## Recipe Processing Flow
+
+```mermaid
+flowchart TD
+    start([Start]) --> args[Parse CLI args]
+    args --> load[Load recipes list]
+    load --> order{Processing order provided?}
+    order -- Yes --> batches[Build recipe batches by type]
+    order -- No --> all[Single batch of all recipes]
+    batches --> log[Log each batch type and identifiers]
+    all --> log
+    log --> run[Run batch recipes concurrently within batch]
+    run --> next{More batches?}
+    next -- Yes --> log
+    next -- No --> git[Apply git updates serially]
+    git --> notify[Send notifications]
+    notify --> pr{Create PR?}
+    pr -- Yes --> createPR[Open trust update PR]
+    pr -- No --> issues{Create issues?}
+    createPR --> issues
+    issues -- Yes --> createIssue[Open failures issue]
+    issues -- No --> reports{Process reports?}
+    createIssue --> reports
+    reports -- Yes --> process[Process reports output]
+    reports -- No --> done([Done])
+    process --> done
+```
+
+Related code:
+
+- `autopkg_wrapper/autopkg_wrapper.py`
+- `autopkg_wrapper/utils/recipe_batching.py`
+- `autopkg_wrapper/utils/recipe_ordering.py`
+- `autopkg_wrapper/utils/report_processor.py`
+- `autopkg_wrapper/notifier/slack.py`
+
+Notes:
+
+- During recipe runs, per‑recipe plist reports are written to `/private/tmp/autopkg`.
+- Log output references full recipe identifiers (for example, `Foo.upload.jamf`) and batch logs list recipe identifiers grouped by type.
+- When `--process-reports` is supplied without `--reports-zip` or `--reports-dir`, the tool processes `/private/tmp/autopkg`.
+- If `AUTOPKG_JSS_URL`, `AUTOPKG_CLIENT_ID`, and `AUTOPKG_CLIENT_SECRET` are set, uploaded package rows are enriched with Jamf package links.
+  - No extra CLI flag is required; enrichment runs automatically when all three env vars are present.
+
+An example folder structure and GitHub Actions Workflow is available within the [`actions-demo`](actions-demo)
+
+## Credits
+
+- [`autopkg_tools` from Facebook](https://github.com/facebook/IT-CPE/tree/main/legacy/autopkg_tools)
+- [`autopkg_tools` from Facebook, modified by Gusto](https://github.com/Gusto/it-cpe-opensource/tree/main/autopkg)