bmsdna-devtools 0.2.0__tar.gz

bmsdna_devtools-0.2.0/.github/workflows/python-publish.yml

@@ -0,0 +1,37 @@
+# This workflow will upload a Python Package using Twine when a release is created
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Upload Python Package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/bmsdna-devtools
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Install dependencies
+        run: uv sync --all-extras --all-groups
+      - name: Build package
+        run: uv build
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

bmsdna_devtools-0.2.0/.github/workflows/python-test.yml

@@ -0,0 +1,34 @@
+name: Python Test
+
+on:
+  push:
+    branches: ["main"]
+    paths-ignore: ["README.md", ".github"]
+  pull_request:
+    branches: ["main"]
+    paths-ignore: ["README.md", ".github"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Install project dependencies
+        run: uv sync --all-extras --all-groups
+      - name: Lint (ruff)
+        run: uv run ruff check bmsdna tests
+      - name: Type check (ty)
+        run: uv run ty check bmsdna
+      - name: Test with pytest
+        run: uv run -m pytest --capture=tee-sys --maxfail=3 tests

bmsdna_devtools-0.2.0/.gitignore

@@ -0,0 +1,218 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml

bmsdna_devtools-0.2.0/.python-version

@@ -0,0 +1 @@
+3.12

bmsdna_devtools-0.2.0/PKG-INFO

@@ -0,0 +1,143 @@
+Metadata-Version: 2.4
+Name: bmsdna-devtools
+Version: 0.2.0
+Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
+Requires-Python: >=3.11
+Requires-Dist: requests>=2.32.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: typer>=0.26.7
+Description-Content-Type: text/markdown
+
+# bmsdna-devtools
+
+Shared developer tooling for BMS projects: PR build/check status, PR
+creation, git worktrees, a commit-and-push helper with pre-flight checks,
+and Azure log queries. `bdt pr *` auto-detects whether the current repo's
+`origin` remote is Azure DevOps or GitHub and uses `az`/`gh` accordingly.
+Consolidates near-duplicate scripts that used to be copy-pasted across
+OneSales, ccmt2, and MDMApp into one versioned package with a `bdt` CLI.
+
+Requires `git` always, plus `az` (Azure DevOps commands, and all `bdt logs`
+commands) and/or `gh` (GitHub commands) on PATH as needed — each is checked
+lazily, only when a command actually needs it, with a clear error and an
+install link if missing rather than a raw traceback. Works on Windows: CLI
+shims (e.g. `az.cmd`) are resolved via `shutil.which` (which honors
+`PATHEXT`) rather than shelling out, output is decoded as UTF-8 rather than
+relying on the console's default codepage, and file arguments accept either
+slash style.
+
+## Install
+
+```bash
+uv tool install bmsdna-devtools
+```
+
+Or as a project dependency: `uv add bmsdna-devtools`.
+
+## `bdt pr status`
+
+Find the PR opened from the current branch and report build/check status
+(failed steps print their logs inline). Works against Azure DevOps or
+GitHub — whichever `origin` points at.
+
+```bash
+bdt pr status [--target-branch main] [--wait]
+```
+
+If the PR can't be merged, that's reported immediately instead of polling
+for builds/checks that will never run — e.g. on Azure DevOps:
+`PR #42 ('feat: widgets') has merge conflicts with the target branch (mergeStatus=conflicts)`;
+on GitHub: `PR #42 ('feat: widgets') has merge conflicts with 'main' (mergeable=CONFLICTING)`.
+Exit code 1 either way.
+
+**Azure DevOps**: org/project/repo are auto-detected from
+`git remote get-url origin` (handles SSH, `dev.azure.com` HTTPS, and
+`*.visualstudio.com` HTTPS forms). Auth is an explicit PAT (`--pat` or
+`AZURE_DEVOPS_PAT` env var), falling back to a short-lived token from the
+caller's own `az login` — never embed a PAT literal in a script or CI file.
+`--target-branch` selects which PR to look at (ADO's search API needs one).
+
+**GitHub**: uses `gh`'s own auth (`gh auth login`) and always resolves the
+PR opened from the current branch — `gh pr view` has no target-branch
+filter, so `--target-branch` is ignored here; the PR's actual base branch
+is shown in the output. Check status is computed from
+`gh pr view --json statusCheckRollup` rather than `gh pr checks --json`,
+since the latter flag isn't available in all `gh` releases.
+
+## `bdt pr create`
+
+```bash
+bdt pr create --target main   # or --target test
+```
+
+Creates a PR from the current branch into `--target`. On Azure DevOps,
+a thin wrapper around `az repos pr create` (org/project/repo inferred by
+`az` itself from the git remote). On GitHub, `gh pr create --fill` (autofills
+title/body from commit info so it never blocks on an interactive prompt).
+Extra arguments pass through either way, e.g.
+`bdt pr create --target main -- --title "..."`.
+
+## `bdt worktree`
+
+```bash
+bdt worktree my-feature [--base dev] [--env-file .local_env] [--no-submodules] [--install "just install"]
+```
+
+Creates `.worktrees/<name>` branched from `--base`, initializes submodules
+(unless `--no-submodules`), and copies an env file into the new worktree as
+`.env` (auto-detects `.local_env` then `.env` if `--env-file` isn't given).
+
+## `bdt commit`
+
+```bash
+bdt commit "feat(x): add widget support" file1.py file2.py [--json] [--no-verify] [--subrepo database]
+```
+
+Stages, commits, and pushes the given files. Pre-flight checks: files
+exist, commit message looks like `type: description` (skip with
+`--skip-message-check`), not on `main`/`master` (skip with `--allow-main`).
+Retries once (re-`git add`) if a pre-commit hook reformats files. Pass
+`--subrepo <dir>` (repeatable) for repos that vendor a submodule (e.g.
+`database`) — files under that prefix are committed/pushed inside the
+submodule first, then the bump is staged in the parent repo.
+
+Set `IS_BMS_AI_SANDBOX=1` to skip the push step (commit only) — used when
+an AI coding sandbox pushes on its own schedule separately.
+
+`--json` emits a machine-readable result for AI-agent callers:
+
+```json
+{
+  "success": true, "committed": true, "pushed": true,
+  "message": "...", "files": ["..."], "commit_sha": "abc1234",
+  "error": null, "hint": null
+}
+```
+
+## `bdt logs roles` / `bdt logs tail`
+
+Query Application Insights (KQL over `traces`/`exceptions`) via
+`az monitor app-insights query`. No defaults are baked in — pass
+`--resource-group`/`--app-insights` explicitly (or set
+`AZURE_RESOURCE_GROUP`/`AZURE_APP_INSIGHTS`), since which Azure resource
+"this repo" maps to isn't derivable from the git remote.
+
+```bash
+bdt logs roles --resource-group my-rg --app-insights my-app-insights --minutes 60
+bdt logs tail --resource-group my-rg --app-insights my-app-insights --role my-service --level warning
+```
+
+## `bdt logs fetch`
+
+Downloads the App Service log archive for a webapp/slot via
+`az webapp log download`, unzips it, and writes every line matching a
+common error/warning marker (`ERROR`, `CRITICAL`, `WARNING`, tracebacks,
+`4xx`/`5xx`, `FAILED`, `FATAL`) to `<out>/<slot>_errors.log`. Simpler and
+often preferable to the KQL commands above when you just want "what broke
+recently" rather than a queryable trace stream — no defaults are baked in
+here either.
+
+```bash
+bdt logs fetch --webapp my-webapp --resource-group my-rg --slot production
+bdt logs fetch --webapp my-webapp --resource-group my-rg --slot production --out logs/ --keep-archive
+```

bmsdna_devtools-0.2.0/README.md

@@ -0,0 +1,133 @@
+# bmsdna-devtools
+
+Shared developer tooling for BMS projects: PR build/check status, PR
+creation, git worktrees, a commit-and-push helper with pre-flight checks,
+and Azure log queries. `bdt pr *` auto-detects whether the current repo's
+`origin` remote is Azure DevOps or GitHub and uses `az`/`gh` accordingly.
+Consolidates near-duplicate scripts that used to be copy-pasted across
+OneSales, ccmt2, and MDMApp into one versioned package with a `bdt` CLI.
+
+Requires `git` always, plus `az` (Azure DevOps commands, and all `bdt logs`
+commands) and/or `gh` (GitHub commands) on PATH as needed — each is checked
+lazily, only when a command actually needs it, with a clear error and an
+install link if missing rather than a raw traceback. Works on Windows: CLI
+shims (e.g. `az.cmd`) are resolved via `shutil.which` (which honors
+`PATHEXT`) rather than shelling out, output is decoded as UTF-8 rather than
+relying on the console's default codepage, and file arguments accept either
+slash style.
+
+## Install
+
+```bash
+uv tool install bmsdna-devtools
+```
+
+Or as a project dependency: `uv add bmsdna-devtools`.
+
+## `bdt pr status`
+
+Find the PR opened from the current branch and report build/check status
+(failed steps print their logs inline). Works against Azure DevOps or
+GitHub — whichever `origin` points at.
+
+```bash
+bdt pr status [--target-branch main] [--wait]
+```
+
+If the PR can't be merged, that's reported immediately instead of polling
+for builds/checks that will never run — e.g. on Azure DevOps:
+`PR #42 ('feat: widgets') has merge conflicts with the target branch (mergeStatus=conflicts)`;
+on GitHub: `PR #42 ('feat: widgets') has merge conflicts with 'main' (mergeable=CONFLICTING)`.
+Exit code 1 either way.
+
+**Azure DevOps**: org/project/repo are auto-detected from
+`git remote get-url origin` (handles SSH, `dev.azure.com` HTTPS, and
+`*.visualstudio.com` HTTPS forms). Auth is an explicit PAT (`--pat` or
+`AZURE_DEVOPS_PAT` env var), falling back to a short-lived token from the
+caller's own `az login` — never embed a PAT literal in a script or CI file.
+`--target-branch` selects which PR to look at (ADO's search API needs one).
+
+**GitHub**: uses `gh`'s own auth (`gh auth login`) and always resolves the
+PR opened from the current branch — `gh pr view` has no target-branch
+filter, so `--target-branch` is ignored here; the PR's actual base branch
+is shown in the output. Check status is computed from
+`gh pr view --json statusCheckRollup` rather than `gh pr checks --json`,
+since the latter flag isn't available in all `gh` releases.
+
+## `bdt pr create`
+
+```bash
+bdt pr create --target main   # or --target test
+```
+
+Creates a PR from the current branch into `--target`. On Azure DevOps,
+a thin wrapper around `az repos pr create` (org/project/repo inferred by
+`az` itself from the git remote). On GitHub, `gh pr create --fill` (autofills
+title/body from commit info so it never blocks on an interactive prompt).
+Extra arguments pass through either way, e.g.
+`bdt pr create --target main -- --title "..."`.
+
+## `bdt worktree`
+
+```bash
+bdt worktree my-feature [--base dev] [--env-file .local_env] [--no-submodules] [--install "just install"]
+```
+
+Creates `.worktrees/<name>` branched from `--base`, initializes submodules
+(unless `--no-submodules`), and copies an env file into the new worktree as
+`.env` (auto-detects `.local_env` then `.env` if `--env-file` isn't given).
+
+## `bdt commit`
+
+```bash
+bdt commit "feat(x): add widget support" file1.py file2.py [--json] [--no-verify] [--subrepo database]
+```
+
+Stages, commits, and pushes the given files. Pre-flight checks: files
+exist, commit message looks like `type: description` (skip with
+`--skip-message-check`), not on `main`/`master` (skip with `--allow-main`).
+Retries once (re-`git add`) if a pre-commit hook reformats files. Pass
+`--subrepo <dir>` (repeatable) for repos that vendor a submodule (e.g.
+`database`) — files under that prefix are committed/pushed inside the
+submodule first, then the bump is staged in the parent repo.
+
+Set `IS_BMS_AI_SANDBOX=1` to skip the push step (commit only) — used when
+an AI coding sandbox pushes on its own schedule separately.
+
+`--json` emits a machine-readable result for AI-agent callers:
+
+```json
+{
+  "success": true, "committed": true, "pushed": true,
+  "message": "...", "files": ["..."], "commit_sha": "abc1234",
+  "error": null, "hint": null
+}
+```
+
+## `bdt logs roles` / `bdt logs tail`
+
+Query Application Insights (KQL over `traces`/`exceptions`) via
+`az monitor app-insights query`. No defaults are baked in — pass
+`--resource-group`/`--app-insights` explicitly (or set
+`AZURE_RESOURCE_GROUP`/`AZURE_APP_INSIGHTS`), since which Azure resource
+"this repo" maps to isn't derivable from the git remote.
+
+```bash
+bdt logs roles --resource-group my-rg --app-insights my-app-insights --minutes 60
+bdt logs tail --resource-group my-rg --app-insights my-app-insights --role my-service --level warning
+```
+
+## `bdt logs fetch`
+
+Downloads the App Service log archive for a webapp/slot via
+`az webapp log download`, unzips it, and writes every line matching a
+common error/warning marker (`ERROR`, `CRITICAL`, `WARNING`, tracebacks,
+`4xx`/`5xx`, `FAILED`, `FATAL`) to `<out>/<slot>_errors.log`. Simpler and
+often preferable to the KQL commands above when you just want "what broke
+recently" rather than a queryable trace stream — no defaults are baked in
+here either.
+
+```bash
+bdt logs fetch --webapp my-webapp --resource-group my-rg --slot production
+bdt logs fetch --webapp my-webapp --resource-group my-rg --slot production --out logs/ --keep-archive
+```

bmsdna_devtools-0.2.0/bmsdna/devtools/ado_auth.py

@@ -0,0 +1,37 @@
+"""Azure DevOps auth: explicit PAT, or fall back to the caller's `az` login."""
+
+from __future__ import annotations
+
+import base64
+import subprocess
+import sys
+
+from .cli_tools import require_az
+
+# Well-known Azure DevOps resource ID for `az account get-access-token`.
+ADO_RESOURCE_ID = "499b84ac-1321-427f-aa17-267ca6975798"
+
+
+def get_az_devops_token() -> str:
+    az = require_az()
+    result = subprocess.run(
+        [az, "account", "get-access-token", "--resource", ADO_RESOURCE_ID, "--query", "accessToken", "-o", "tsv"],
+        capture_output=True,
+        encoding="utf-8",
+    )
+    if result.returncode != 0:
+        sys.exit(f"az login required and no PAT provided.\n{result.stderr.strip()}")
+    return result.stdout.strip()
+
+
+def auth_header(pat: str | None) -> dict[str, str]:
+    """Basic-auth header for an explicit PAT, else Bearer via `az` token.
+
+    Never hardcode a PAT literal in a caller — pass it in from an env var
+    (e.g. AZURE_DEVOPS_PAT) or a CLI flag, or omit it and let `az` supply a
+    short-lived token from the operator's own login.
+    """
+    if pat:
+        token = base64.b64encode(f":{pat}".encode()).decode()
+        return {"Authorization": f"Basic {token}"}
+    return {"Authorization": f"Bearer {get_az_devops_token()}"}

bmsdna_devtools-0.2.0/bmsdna/devtools/app_service_logs.py

@@ -0,0 +1,76 @@
+"""Download an Azure App Service log archive and filter it for errors/warnings.
+
+Pulls the log zip via `az webapp log download`, unpacks it in memory, and
+writes every line matching common error/warning markers to a filtered file.
+The webapp/resource-group/slot for a given `--env` come from the consuming
+repo's pyproject.toml (see env_config.py) rather than being baked in here.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import re
+import subprocess
+import sys
+import zipfile
+
+from .cli_tools import require_az
+
+# Matches common error/warning markers across granian, uvicorn, and python tracebacks.
+ERROR_RE = re.compile(r"\b(ERROR|CRITICAL|WARNING|Traceback|Exception|\b[45]\d\d\b|FAILED|FATAL)\b")
+
+
+def run_az(args: list[str]) -> str:
+    az = require_az()
+    proc = subprocess.run([az, *args], capture_output=True, encoding="utf-8")
+    if proc.returncode != 0:
+        sys.exit(proc.stderr.strip() or proc.stdout.strip())
+    return proc.stdout
+
+
+def download_logs(webapp: str, resource_group: str, slot: str, archive: pathlib.Path) -> None:
+    print(f"Downloading logs for {webapp}/{slot}...", flush=True)
+    run_az([
+        "webapp", "log", "download",
+        "--name", webapp,
+        "--resource-group", resource_group,
+        "--slot", slot,
+        "--log-file", str(archive),
+    ])
+
+
+def extract_errors(archive: pathlib.Path, error_file: pathlib.Path) -> int:
+    """Unzip the archive and write all matching lines to error_file. Returns count."""
+    count = 0
+    with zipfile.ZipFile(archive) as zf, error_file.open("w") as out:
+        for member in zf.namelist():
+            if member.endswith("/"):
+                continue
+            with zf.open(member) as fh:
+                for raw in fh:
+                    line = raw.decode("utf-8", "replace")
+                    if ERROR_RE.search(line):
+                        out.write(f"{member}: {line}")
+                        count += 1
+    return count
+
+
+def fetch(
+    webapp: str,
+    resource_group: str,
+    slot: str,
+    out_dir: pathlib.Path,
+    keep_archive: bool = False,
+) -> pathlib.Path:
+    out_dir.mkdir(parents=True, exist_ok=True)
+    archive = out_dir / f"{slot}_logs.zip"
+    error_file = out_dir / f"{slot}_errors.log"
+
+    download_logs(webapp, resource_group, slot, archive)
+    count = extract_errors(archive, error_file)
+
+    if not keep_archive:
+        archive.unlink()
+
+    print(f"✓ {count} error/warning lines → {error_file}")
+    return error_file