boatyard 0.6.0.dev170__py3-none-any.whl

boatyard/score_patch_templates/gpu-cuda.tpl

@@ -0,0 +1,24 @@
+# CUDA device access for GPU-marked workloads (metadata annotation
+# outernet.internal/gpu): `gpus: all` semantics in the long-form device
+# reservation (score-compose's output schema accepts no `gpus` scalar and no
+# `count: all`; an omitted count means every GPU). Per-variant twin of
+# gpu-rocm.tpl — the devkit registers this file exactly when the compose
+# rendering's gpu variant is cuda. Service names are computed from the
+# workload/container pair, never hardcoded.
+{{- $matched := false }}
+{{- range $workloadName, $workload := .Workloads }}
+{{- if eq (dig "metadata" "annotations" "outernet.internal/gpu" "" $workload) "true" }}
+{{- range $containerName, $_ := $workload.containers }}
+{{- $matched = true }}
+- op: set
+  path: services.{{ $workloadName }}-{{ $containerName }}.deploy.resources.reservations.devices
+  value:
+    - driver: nvidia
+      capabilities: [gpu]
+  description: CUDA device access for {{ $workloadName }}-{{ $containerName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/score_patch_templates/gpu-pod.tpl

@@ -0,0 +1,43 @@
+# GPU pod plumbing for workloads marked outernet.internal/gpu, ported from the
+# infra Pulumi prior art: runtimeClassName nvidia, the GPU nodeSelector, and one
+# nvidia.com/gpu per container. Score has no GPU concept, so the annotation on
+# the workload file is the single declaration and this template computes every
+# patch target — nothing is keyed on hardcoded service names. The runtime class,
+# label, and resource name are a seam contract with the cluster tier (device
+# plugin + worker labeling, both Pulumi-side); the annotation is org-namespaced
+# outernet.internal/* while the nodeSelector label stays placeframe.io/gpu —
+# exactly what Pulumi labels GPU nodes with. .Workloads must be captured before
+# the range: inside a range body this template engine resolves the outer dot's
+# map fields to zero values.
+{{- $workloads := .Workloads }}
+{{- $matched := false }}
+{{- range $i, $manifest := .Manifests }}
+{{- if eq $manifest.kind "Deployment" }}
+{{- $workloadName := dig "metadata" "annotations" "k8s.score.dev/workload-name" "" $manifest }}
+{{- if $workloadName }}
+{{- $workload := index $workloads $workloadName }}
+{{- if and $workload (eq (dig "metadata" "annotations" "outernet.internal/gpu" "" $workload) "true") }}
+{{- $matched = true }}
+- op: set
+  path: {{ $i }}.spec.template.spec.runtimeClassName
+  value: nvidia
+  description: NVIDIA runtime class for {{ $workloadName }}
+- op: set
+  path: {{ $i }}.spec.template.spec.nodeSelector
+  value:
+    placeframe.io/gpu: "true"
+  description: GPU node selector for {{ $workloadName }}
+{{- range $containerIndex, $_ := $manifest.spec.template.spec.containers }}
+- op: set
+  path: {{ $i }}.spec.template.spec.containers.{{ $containerIndex }}.resources.limits
+  value:
+    nvidia.com/gpu: "1"
+  description: One NVIDIA GPU for container {{ $containerIndex }} of {{ $workloadName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/score_patch_templates/gpu-rocm.tpl

@@ -0,0 +1,30 @@
+# ROCm device access for GPU-marked workloads (metadata annotation
+# outernet.internal/gpu): the render/video device nodes plus the groups allowed
+# to open them (score-compose's output schema wants DeviceMapping objects and
+# string group ids). Per-variant twin of gpu-cuda.tpl — the devkit registers
+# this file exactly when the compose rendering's gpu variant is rocm.
+{{- $matched := false }}
+{{- range $workloadName, $workload := .Workloads }}
+{{- if eq (dig "metadata" "annotations" "outernet.internal/gpu" "" $workload) "true" }}
+{{- range $containerName, $_ := $workload.containers }}
+{{- $matched = true }}
+- op: set
+  path: services.{{ $workloadName }}-{{ $containerName }}.devices
+  value:
+    - source: /dev/kfd
+      target: /dev/kfd
+    - source: /dev/dri
+      target: /dev/dri
+  description: ROCm device nodes for {{ $workloadName }}-{{ $containerName }}
+- op: set
+  path: services.{{ $workloadName }}-{{ $containerName }}.group_add
+  value:
+    - "44"
+    - "110"
+  description: ROCm render/video group membership for {{ $workloadName }}-{{ $containerName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/score_patch_templates/probe-adapter-healthchecks.tpl

@@ -0,0 +1,55 @@
+# score-compose validates and drops workload httpGet probes (httpGet is not a
+# supported compose concept), so the generated compose would gate nothing on
+# workload health while the k8s rendering emits real probes. This patch-template
+# class closes that drift for workloads declaring a probe adapter
+# (outernet.internal/probe-adapter): it converts the workload's readinessProbe,
+# else livenessProbe, into a compose healthcheck against the computed
+# <workload>-<container> service name. The adapter picks the exec spell the
+# image runtime can run — python-urllib (python-based workloads shipping
+# neither wget nor curl) or bash-http (workloads whose image ships bash and
+# nothing else, spelling HTTP over /dev/tcp); a workload declaring an httpGet
+# probe without the adapter refuses at generation (devkit code — templates are
+# data).
+{{- $matched := false }}
+{{- range $workloadName, $workload := .Workloads }}
+{{- $adapter := dig "metadata" "annotations" "outernet.internal/probe-adapter" "" $workload }}
+{{- if or (eq $adapter "python-urllib") (eq $adapter "bash-http") }}
+{{- range $containerName, $container := $workload.containers }}
+{{- $probe := $container.readinessProbe.httpGet }}
+{{- if not $probe }}
+{{- $probe = $container.livenessProbe.httpGet }}
+{{- end }}
+{{- with $probe }}
+{{- $matched = true }}
+- op: set
+  path: services.{{ $workloadName }}-{{ $containerName }}.healthcheck
+  value:
+    {{- if eq $adapter "python-urllib" }}
+    test:
+      [
+        "CMD",
+        "python",
+        "-c",
+        "import urllib.request; urllib.request.urlopen('http://localhost:{{ .port }}{{ .path }}')",
+      ]
+    {{- else }}
+    test:
+      [
+        "CMD",
+        "bash",
+        "-c",
+        "exec 3<>/dev/tcp/127.0.0.1/{{ .port }} && printf 'GET {{ .path }} HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && read -r status <&3 && case $$status in *200*) exit 0;; *) exit 1;; esac",
+      ]
+    {{- end }}
+    interval: 5s
+    start_period: 5s
+    timeout: 5s
+    retries: 3
+  description: Healthcheck from httpGet probe for {{ $workloadName }}-{{ $containerName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/score_patch_templates/restart.tpl

@@ -0,0 +1,21 @@
+# Restart policy for workloads declaring outernet.internal/restart — the
+# workload file carrying the one sanctioned exception to the no-restart-policies
+# law where its reader lives. The value is validated against the compose
+# restart-policy enum by devkit code before generation (templates are data and
+# cannot refuse); presence is the trigger, the annotation value the policy.
+{{- $matched := false }}
+{{- range $workloadName, $workload := .Workloads }}
+{{- $restart := dig "metadata" "annotations" "outernet.internal/restart" "" $workload }}
+{{- if $restart }}
+{{- range $containerName, $_ := $workload.containers }}
+{{- $matched = true }}
+- op: set
+  path: services.{{ $workloadName }}-{{ $containerName }}.restart
+  value: {{ $restart }}
+  description: Restart the {{ $workloadName }}-{{ $containerName }} service {{ $restart }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/score_patch_templates/scale-to-zero.tpl

@@ -0,0 +1,30 @@
+# KEDA owns /spec/replicas for workloads declaring a keda-scaled-object resource, so
+# the rendered Deployment starts at zero: no queue means no pods, and a fresh apply
+# must not boot a GPU worker before the operator is watching. Argo's selfHeal fights
+# KEDA over this field unless the Application carries ignoreDifferences — infra-side
+# configuration, not artifact content. .Workloads is captured before the range (see
+# gpu-pod.tpl).
+{{- $workloads := .Workloads }}
+{{- $matched := false }}
+{{- range $i, $manifest := .Manifests }}
+{{- if eq $manifest.kind "Deployment" }}
+{{- $workloadName := dig "metadata" "annotations" "k8s.score.dev/workload-name" "" $manifest }}
+{{- if $workloadName }}
+{{- $workload := index $workloads $workloadName }}
+{{- if $workload }}
+{{- range $_, $resource := $workload.resources }}
+{{- if eq $resource.type "keda-scaled-object" }}
+{{- $matched = true }}
+- op: set
+  path: {{ $i }}.spec.replicas
+  value: 0
+  description: Scale-to-zero start for KEDA-managed {{ $workloadName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if not $matched }}
+[]
+{{- end }}

boatyard/temp.py

@@ -0,0 +1,5 @@
+import re
+
+PLATFORM_PATTERN = re.compile(r"^[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*$")
+
+SHA256_DIGEST_REGEX = r"sha256:[a-f0-9]{64}"

boatyard/verbs/build.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from boatyard.build import run_build
+from boatyard.config.config import ConfigFile
+from boatyard.paths import DEFAULT_CONFIG_PATH
+
+app = typer.Typer()
+
+
+@app.command()
+def build(
+    push: Annotated[
+        bool, typer.Option("--push", help="Push images and registry caches to the repository declared in the config.")
+    ] = False,
+    push_to: Annotated[
+        str | None,
+        typer.Option("--push-to", help="Push images and registry caches to this registry address instead."),
+    ] = None,
+    targets: Annotated[
+        list[str] | None,
+        typer.Option(
+            "--targets",
+            "-t",
+            help="Build these targets: bare name for an axis-less service, name/variant when it declares variants.",
+        ),
+    ] = None,
+    no_cache: Annotated[bool, typer.Option("--no-cache", help="Force rebuild by disabling cache usage.")] = False,
+) -> None:
+    root = Path.cwd()
+    config = ConfigFile.load(root / DEFAULT_CONFIG_PATH)
+
+    if push and push_to is not None:
+        raise typer.BadParameter(
+            "--push and --push-to are mutually exclusive: --push targets the config's repository, --push-to targets that address"
+        )
+
+    if push_to is not None:
+        registry_host = push_to.partition("/")[0]
+        if "://" in push_to or push_to.endswith("/") or ("." not in registry_host and ":" not in registry_host):
+            raise typer.BadParameter(
+                f"--push-to destination {push_to!r} must be a registry address (localhost:5000, ghcr.io/org) "
+                "with no scheme and no trailing slash"
+            )
+
+    if push and config.repository is None:
+        raise typer.BadParameter("--push targets the config's repository; repository is required")
+
+    targets = [address for value in targets or [] for address in value.split()] or None
+    run_build(config=config, push=push, push_to=push_to, targets=targets, no_cache=no_cache)

boatyard/verbs/down.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from contextlib import ExitStack
+from pathlib import Path
+from tempfile import NamedTemporaryFile
+from typing import Annotated
+
+import typer
+import yaml
+from bashrun.bash import bash_handoff
+
+from boatyard.compose import compose_command
+from boatyard.config.config import ConfigFile
+from boatyard.paths import DEFAULT_CONFIG_PATH
+
+app = typer.Typer()
+
+
+@app.command()
+def down(
+    volumes: Annotated[bool, typer.Option("--volumes", "-v", help="Remove named volumes.")] = False,
+) -> None:
+    root = Path.cwd()
+    config = ConfigFile.load(root / DEFAULT_CONFIG_PATH)
+
+    # Tear down by project name alone; the name-only root consumes no values, lock, or selection.
+    with ExitStack() as stack:
+        with NamedTemporaryFile(
+            "w", suffix=".yaml", prefix="devkit-assembly-", delete=False, encoding="utf-8"
+        ) as handle:
+            handle.write(yaml.safe_dump({"name": config.project_name}, sort_keys=False, default_flow_style=False))
+            assembly_root = Path(handle.name)
+        stack.callback(assembly_root.unlink, missing_ok=True)
+
+        command = compose_command(root, assembly_root, "down", "--remove-orphans")
+        if volumes:
+            command += " -v"
+
+        bash_handoff(command)

boatyard/verbs/lock.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from boatyard.config.config import ConfigFile
+from boatyard.lock import relock
+from boatyard.paths import DEFAULT_CONFIG_PATH
+
+app = typer.Typer()
+
+
+@app.command()
+def lock(
+    upgrade: Annotated[
+        bool,
+        typer.Option("--upgrade", "-u", help="Re-resolve every declaration instead of freezing unchanged entries."),
+    ] = False,
+    check: Annotated[
+        bool,
+        typer.Option("--check", help="Assert the committed lock is fresh instead of writing it."),
+    ] = False,
+) -> None:
+    config_path = Path.cwd() / DEFAULT_CONFIG_PATH
+    if not config_path.is_file():
+        print("no boatyard.yml; no lock declarations to relock")
+        return
+    config = ConfigFile.load(config_path)
+    if not config.base_images and not config.declared_charts and not config.remote_declared_entries():
+        print("no lock declarations (none of base_images, k8s.charts, service refs); nothing to relock")
+        return
+    relock(config, upgrade=upgrade, check=check)

boatyard/verbs/matrix.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from boatyard.config.config import ConfigFile
+from boatyard.paths import DEFAULT_CONFIG_PATH
+
+app = typer.Typer()
+
+
+@app.command()
+def docker_build_matrix() -> None:
+    config_path = Path.cwd() / DEFAULT_CONFIG_PATH
+    config = ConfigFile.load(config_path) if config_path.is_file() else None
+    if config is None:
+        print(json.dumps([]))
+        return
+    # Partition the services into dependency closures x variants.
+    services = config.service_builds
+    parent = {service: service for service in services}
+
+    for name, service in services.items():
+        for dependency in service.contexts:
+            left, right = _find(parent, name), _find(parent, dependency)
+            if left != right:
+                parent[right] = left
+
+    members: dict[str, list[str]] = {}
+    for service in services:
+        members.setdefault(_find(parent, service), []).append(service)
+
+    entries_by_variant: dict[tuple[str | None, str], list[str]] = {}
+    for group in sorted(sorted(member_list) for member_list in members.values()):
+        for name in group:
+            for variant in services[name].variants or [None]:
+                partition = variant if variant is not None else "common"
+                address = f"{name}/{variant}" if variant is not None else name
+                entries_by_variant.setdefault((services[name].axis, partition), []).append(address)
+
+    print(
+        json.dumps([
+            {"targets": " ".join(sorted(addresses)), "variant": partition}
+            for (_axis, partition), addresses in sorted(entries_by_variant.items(), key=lambda item: item[0][1])
+        ])
+    )
+
+
+def _find(parent: dict[str, str], service: str) -> str:
+    root = service
+    while parent[root] != root:
+        root = parent[root]
+    while parent[service] != service:
+        parent[service], service = root, parent[service]
+    return root

boatyard/verbs/mirror.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import typer
+from bashrun.bash import bash, bash_check
+
+from boatyard.config.config import (
+    ConfigFile,
+    chart_lock_key,
+    mirrored_ref,
+)
+from boatyard.crane import install_crane
+from boatyard.config.lock import LOCK_PATH, LockFile
+from boatyard.paths import DEFAULT_CONFIG_PATH
+
+app = typer.Typer()
+
+
+@app.command()
+def mirror() -> None:
+    root = Path.cwd()
+    config = ConfigFile.load(root / DEFAULT_CONFIG_PATH)
+    prefix = config.mirror_prefix
+
+    lock = LockFile.load(root / LOCK_PATH, config)
+    mirror_targets: list[tuple[str, list[str]]] = []
+    for name, reference in sorted(config.base_images.items(), key=lambda item: item[1]):
+        mirror_targets.append((reference, lock.images[name].recorded_digests))
+    for chart_name, chart_ref in sorted(config.declared_charts.items()):
+        mirror_targets.append((chart_ref.removeprefix("oci://"), [lock.charts[chart_lock_key(chart_name)]]))
+
+    if not mirror_targets:
+        raise ValueError("nothing is declared to mirror (base_images and k8s.charts are empty)")
+
+    install_crane()
+    copied = 0
+    already_present = 0
+    for reference, recorded in mirror_targets:
+        probes = sorted(set(recorded))
+        if probes and all(bash_check(f"crane digest {probe}") for probe in probes):
+            for probe in probes:
+                print(f"Already mirrored {probe}")
+            already_present += 1
+            continue
+        destination = mirrored_ref(reference, prefix)
+        print(f"Mirror {reference} -> {destination}")
+        bash(f"crane copy {reference} {destination}")
+        copied += 1
+    print(f"Mirrored references: {copied} copied, {already_present} already present")

boatyard/verbs/publish.py

@@ -0,0 +1,138 @@
+from __future__ import annotations
+
+import json
+import os
+import shlex
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from typing import Annotated
+
+import typer
+from bashrun.bash import bash, bash_output
+
+from boatyard import dockerfiles
+from boatyard.config.config import ConfigFile, compose_bundle_output_path, lock_key_prefix
+from boatyard.crane import install_crane
+from boatyard.config.lock import LOCK_PATH, LockFile
+from boatyard.paths import DEFAULT_CONFIG_PATH
+from boatyard.publish import (
+    STUB_VALUE,
+    VAR_PATTERN,
+    PublishedEntry,
+    bake_sources,
+    finalize_baked,
+)
+
+app = typer.Typer()
+
+
+@app.command()
+def publish_compose(
+    bundle: Annotated[
+        str | None,
+        typer.Option(
+            "--bundle",
+            help="Publish this bundle's entry (one artifact per workload-bearing entry or option); a bare invocation publishes every entry.",
+        ),
+    ] = None,
+    branch: Annotated[
+        str | None,
+        typer.Option("--branch", help="Branch tag for the second publish; defaults to the checked-out branch."),
+    ] = None,
+    plan: Annotated[
+        bool,
+        typer.Option(
+            "--plan", help="Print the publish entries as a bare JSON array (empty when no section); no publish."
+        ),
+    ] = False,
+) -> None:
+    root = Path.cwd()
+    config_path = root / DEFAULT_CONFIG_PATH
+    config = ConfigFile.load(config_path) if config_path.is_file() else None
+    bundles = (
+        [(name, compose_bundle_output_path(root, name)) for name, _entry in config.local_service_entries()]
+        if config is not None
+        else []
+    )
+    names = [name for name, _output in bundles]
+    if config is None or not names:
+        if plan:
+            print(json.dumps([]))
+            return
+        raise ValueError("publishing requires local entries (workloads:) in boatyard.yml")
+
+    if plan:
+        entries = [{"bundle": name} for name in names]
+        print(json.dumps(entries))
+        return
+
+    if bundle is not None and bundle not in names:
+        raise typer.BadParameter(f"unknown --bundle {bundle!r}; declared bundles: {names}")
+
+    username = os.environ.get("REGISTRY_USERNAME", "")
+    token = os.environ.get("REGISTRY_TOKEN", "")
+    if not username or not token:
+        raise SystemExit("REGISTRY_USERNAME and REGISTRY_TOKEN must be set for registry login")
+    repository = config.repository
+    if repository is None:
+        raise ValueError("local entries (workloads:) are declared; repository is required")
+    registry_host = repository.partition("/")[0]
+    print(f"Login to {registry_host}")
+    bash(f"docker login {shlex.quote(registry_host)} -u {shlex.quote(username)} --password-stdin", stdin_text=token)
+    install_crane()
+
+    sha = bash_output("git rev-parse HEAD").strip()
+    branch_tag = (branch or bash_output("git rev-parse --abbrev-ref HEAD").strip()).replace("/", "-")
+
+    service_shas = dockerfiles.compute_service_shas(config.root, config.service_builds)
+    lock_entries = LockFile.load(root / LOCK_PATH, config).index_references()
+
+    published: list[PublishedEntry] = []
+    for bundle_name, output in bundles:
+        if bundle is not None and bundle_name != bundle:
+            continue
+        with TemporaryDirectory(prefix="compose-bundle-") as baked_directory_string:
+            baked_directory = Path(baked_directory_string)
+            # Fan the lock keys under the bundle prefix
+            substitutions = {
+                **service_shas,
+                **lock_entries,
+                **{lock_key_prefix(bundle_name) + key: value for key, value in lock_entries.items()},
+            }
+            baked_path = bake_sources(baked_directory, output.as_posix(), substitutions)
+
+            # Set non-empty stubs for unresolved vars.
+            unresolved = {
+                match.group(1) for match in VAR_PATTERN.finditer(baked_path.read_text(encoding="utf-8"))
+            } - substitutions.keys()
+            for name in unresolved:
+                os.environ.setdefault(name, STUB_VALUE)
+
+            finalize_baked(baked_path, repository)
+
+            # Publish once under the sha tag and alias the branch tag.
+            sha_reference = f"{repository}/{bundle_name}:{sha}"
+            print(f"Publish {sha_reference}")
+            bash(f"docker compose -f {shlex.quote(str(baked_path))} publish {shlex.quote(sha_reference)} --yes")
+            branch_reference = f"{repository}/{bundle_name}:{branch_tag}"
+            print(f"Tag {branch_reference}")
+            bash(f"crane tag {shlex.quote(sha_reference)} {shlex.quote(branch_tag)}")
+            digest = bash_output(f"crane digest {shlex.quote(sha_reference)}").strip()
+            print(f"Digest {sha_reference} {digest}")
+            print(f"Digest {branch_reference} {digest}")
+            published.append(PublishedEntry(bundle_name, sha_reference, branch_reference, digest))
+
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary_path is not None and published:
+        lines = [
+            "## Published compose bundles",
+            "",
+            "| artifact | sha tag | branch tag | digest |",
+            "| --- | --- | --- | --- |",
+        ]
+        for entry in published:
+            lines.append(
+                f"| {entry.artifact} | `{entry.sha_reference}` | `{entry.branch_reference}` | `{entry.digest}` |"
+            )
+        with Path(summary_path).open("a", encoding="utf-8") as summary:
+            summary.write("\n".join(lines) + "\n")