composable-data-stack 0.6.0__tar.gz → 0.7.0__tar.gz

{composable_data_stack-0.6.0/composable_data_stack.egg-info → composable_data_stack-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: composable-data-stack
-Version: 0.6.0
+Version: 0.7.0
 Summary: CLI for validating and composing composable data stack profiles
 Author: Ronald Hensbergen
 License-Expression: Apache-2.0
@@ -31,7 +31,7 @@ Provides-Extra: dev
 Requires-Dist: coverage>=7.6; extra == "dev"
 Requires-Dist: bandit>=1.7; extra == "dev"
 Requires-Dist: pip-audit>=2.7; extra == "dev"
-Requires-Dist: ruff==0.16.4; extra == "dev"
+Requires-Dist: ruff==0.16.5; extra == "dev"
 Dynamic: license-file
 
 # 🚀 Composable Data Stack (CDS)
@@ -633,8 +633,9 @@ Differences from 'dev' to 'prod':
   ~ spec.modules[postgres].config.storage.size: "2Gi" -> "20Gi"
 ```
 
-Commands without `--environment` are unaffected — they behave exactly as
-before and never look for an `environments/` directory.
+Persist an environment default for a project with `cds config set environment
+prod`; commands without `--environment` then use that overlay. An explicit
+`--environment` always takes precedence.
 
 ---
 
@@ -654,6 +655,7 @@ before and never look for an `environments/` directory.
 |cds security [profile]|Run rule-based security validation on a profile|
 |cds diff [profile] --from \<env\> --to \<env\>|Show effective configuration differences between two environment overlays, secrets never included|
 |cds use [profile] [--clear]|Save (show/clear) a default profile so it doesn't have to be passed to other commands|
+|cds config get\|set\|unset\|list|Manage persisted project defaults in `.cds/config.json`|
 |cds completion \<bash\|zsh\|powershell\>|Print shell setup instructions for tab-completion|
 
 `init`, `validate`, `preflight`, `plan`, `render`, `up`, `test`, and `security`
@@ -674,6 +676,29 @@ destination root, `--dry-run` to inspect the copy plan first, and `--force` to
 replace conflicting local files. Successful fetches record tracking metadata
 in `.cds/get-manifest.json` for future update workflows.
 
+### Project defaults
+
+`cds config` manages the gitignored `.cds/config.json` file (or the path in
+`CDS_CONFIG_PATH`). Supported settings are `profile`, `environment`, and
+`security.strict`:
+
+```bash
+cds config set profile my-profile
+cds config set environment prod
+cds config set security.strict true
+cds config list
+```
+
+`profile` is stored as its resolved path, and `environment` is validated
+against that profile's `environments/` directory. `security.strict true`
+applies the existing production security rules even if the profile declares a
+local environment. `cds use` remains a shortcut for setting, showing, or
+clearing `profile`.
+
+CLI flags take precedence over these defaults. In particular,
+`--environment` overrides `config environment`; `CDS_PROFILE_PATH` continues
+to override the saved profile.
+
 `[profile]` accepts:
 
 | Form | Example |
@@ -682,7 +707,7 @@ in `.cds/get-manifest.json` for future update workflows.
 | Path to a `profile.yaml` file | `profiles/local-dagster-postgres-superset/profile.yaml` |
 | Path to a profiles root directory | `profiles/` |
 
-When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds use <profile>`, then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted `cds use` default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
+When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds config set profile` (or `cds use <profile>`), then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted project default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
 
 To view the full list of options for any command, use the `--help` flag:
 

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/README.md

@@ -597,8 +597,9 @@ Differences from 'dev' to 'prod':
   ~ spec.modules[postgres].config.storage.size: "2Gi" -> "20Gi"
 ```
 
-Commands without `--environment` are unaffected — they behave exactly as
-before and never look for an `environments/` directory.
+Persist an environment default for a project with `cds config set environment
+prod`; commands without `--environment` then use that overlay. An explicit
+`--environment` always takes precedence.
 
 ---
 
@@ -618,6 +619,7 @@ before and never look for an `environments/` directory.
 |cds security [profile]|Run rule-based security validation on a profile|
 |cds diff [profile] --from \<env\> --to \<env\>|Show effective configuration differences between two environment overlays, secrets never included|
 |cds use [profile] [--clear]|Save (show/clear) a default profile so it doesn't have to be passed to other commands|
+|cds config get\|set\|unset\|list|Manage persisted project defaults in `.cds/config.json`|
 |cds completion \<bash\|zsh\|powershell\>|Print shell setup instructions for tab-completion|
 
 `init`, `validate`, `preflight`, `plan`, `render`, `up`, `test`, and `security`
@@ -638,6 +640,29 @@ destination root, `--dry-run` to inspect the copy plan first, and `--force` to
 replace conflicting local files. Successful fetches record tracking metadata
 in `.cds/get-manifest.json` for future update workflows.
 
+### Project defaults
+
+`cds config` manages the gitignored `.cds/config.json` file (or the path in
+`CDS_CONFIG_PATH`). Supported settings are `profile`, `environment`, and
+`security.strict`:
+
+```bash
+cds config set profile my-profile
+cds config set environment prod
+cds config set security.strict true
+cds config list
+```
+
+`profile` is stored as its resolved path, and `environment` is validated
+against that profile's `environments/` directory. `security.strict true`
+applies the existing production security rules even if the profile declares a
+local environment. `cds use` remains a shortcut for setting, showing, or
+clearing `profile`.
+
+CLI flags take precedence over these defaults. In particular,
+`--environment` overrides `config environment`; `CDS_PROFILE_PATH` continues
+to override the saved profile.
+
 `[profile]` accepts:
 
 | Form | Example |
@@ -646,7 +671,7 @@ in `.cds/get-manifest.json` for future update workflows.
 | Path to a `profile.yaml` file | `profiles/local-dagster-postgres-superset/profile.yaml` |
 | Path to a profiles root directory | `profiles/` |
 
-When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds use <profile>`, then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted `cds use` default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
+When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds config set profile` (or `cds use <profile>`), then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted project default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
 
 To view the full list of options for any command, use the `--help` flag:
 

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/cli/main.py

@@ -132,7 +132,7 @@ def find_project_root(start: Path | None = None) -> Path:
 
 
 def get_config_path() -> Path:
-    """Location of the per-project CDS config file used by `cds use`."""
+    """Location of the per-project CDS config file."""
     override = os.getenv("CDS_CONFIG_PATH")
     if override:
         return Path(override).expanduser()
@@ -140,7 +140,7 @@ def get_config_path() -> Path:
 
 
 class ConfigIOError(RuntimeError):
-    """Raised when the `cds use` config file cannot be read or written."""
+    """Raised when the CDS config file cannot be read or written."""
 
 
 
@@ -154,7 +154,7 @@ def _read_config() -> dict:
     except json.JSONDecodeError:
         print(
             f"WARNING {config_path} is not valid JSON; treating it as empty. "
-            "It will be overwritten by the next `cds use <profile>`.",
+            "It will be overwritten by the next config update.",
             file=sys.stderr,
         )
         return {}
@@ -164,13 +164,45 @@ def _read_config() -> dict:
     if not isinstance(data, dict):
         print(
             f"WARNING {config_path} contains valid JSON but not a mapping; treating it as empty. "
-            "It will be overwritten by the next `cds use <profile>`.",
+            "It will be overwritten by the next config update.",
             file=sys.stderr,
         )
         return {}
     return data
 
 
+def _write_config(data: dict) -> Path:
+    config_path = get_config_path()
+    try:
+        if data:
+            _atomic_write(config_path, json.dumps(data, indent=2) + "\n")
+        else:
+            config_path.unlink()
+    except OSError as exc:
+        raise ConfigIOError(f"Could not update config file {config_path}: {exc}") from exc
+    return config_path
+
+
+def _config_value(key: str) -> Any:
+    value: Any = _read_config()
+    for part in key.split("."):
+        if not isinstance(value, dict) or part not in value:
+            return None
+        value = value[part]
+    return value
+
+
+def load_saved_environment() -> str | None:
+    """Return the environment overlay saved for this project, if any."""
+    environment = _config_value("environment")
+    return environment if isinstance(environment, str) and environment else None
+
+
+def load_saved_security_strict() -> bool:
+    """Return whether this project always uses production security rules."""
+    return _config_value("security.strict") is True
+
+
 def load_saved_profile() -> str | None:
     """Return the profile name saved via `cds use`, if any."""
     profile = _read_config().get("profile")
@@ -182,14 +214,9 @@ def save_profile(profile: str) -> Path:
 
     Raises ConfigIOError if the config file cannot be written.
     """
-    config_path = get_config_path()
     data = _read_config()
     data["profile"] = profile
-    try:
-        _atomic_write(config_path, json.dumps(data, indent=2) + "\n")
-    except OSError as exc:
-        raise ConfigIOError(f"Could not update config file {config_path}: {exc}") from exc
-    return config_path
+    return _write_config(data)
 
 
 def clear_saved_profile() -> bool:
@@ -197,21 +224,88 @@ def clear_saved_profile() -> bool:
 
     Raises ConfigIOError if the config file cannot be updated/removed.
     """
-    config_path = get_config_path()
     data = _read_config()
     if "profile" not in data:
         return False
     del data["profile"]
-    try:
-        if data:
-            _atomic_write(config_path, json.dumps(data, indent=2) + "\n")
-        else:
-            config_path.unlink()
-    except OSError as exc:
-        raise ConfigIOError(f"Could not update config file {config_path}: {exc}") from exc
+    _write_config(data)
+    return True
+
+
+def set_config_value(key: str, value: str) -> Path:
+    """Set a supported project setting and return the config file path."""
+    data = _read_config()
+    if key == "profile":
+        data["profile"] = value
+    elif key == "environment":
+        data["environment"] = value
+    elif key == "security.strict":
+        security = data.setdefault("security", {})
+        if not isinstance(security, dict):
+            raise ConfigIOError("Config key 'security' must be a mapping.")
+        security["strict"] = value == "true"
+    else:
+        raise ValueError(f"Unknown config key '{key}'.")
+    return _write_config(data)
+
+
+def unset_config_value(key: str) -> bool:
+    """Remove a supported project setting."""
+    data = _read_config()
+    if key == "profile" or key == "environment":
+        if key not in data:
+            return False
+        del data[key]
+    elif key == "security.strict":
+        security = data.get("security")
+        if not isinstance(security, dict) or "strict" not in security:
+            return False
+        del security["strict"]
+        if not security:
+            del data["security"]
+    else:
+        raise ValueError(f"Unknown config key '{key}'.")
+    _write_config(data)
     return True
 
 
+def _resolve_profile_for_config(profile: str) -> str:
+    resolved = resolve_profile_path(profile)
+    if not Path(resolved).is_file():
+        raise ValueError(f"Profile '{profile}' could not be found (looked for {resolved}).")
+
+    profile_root = get_profiles_root()
+    if profile_root.is_file() and Path(resolved).resolve() == profile_root.resolve():
+        expected_names = {profile_root.stem, profile_root.parent.name}
+        given_matches_file = Path(profile).resolve() == profile_root.resolve()
+        if profile not in expected_names and not given_matches_file:
+            raise ValueError(
+                f"CDS_PROFILE_PATH points to a single profile file ({profile_root}); "
+                f"'{profile}' does not identify it. Pass the file path directly, "
+                f"or use '{profile_root.stem}' or '{profile_root.parent.name}'."
+            )
+    return resolved
+
+
+def _validate_environment_setting(environment: str) -> None:
+    saved_profile = load_saved_profile()
+    if not saved_profile:
+        raise ValueError(
+            "Cannot set environment without a saved default profile. "
+            "Run `cds use <profile>` or `cds config set profile <profile>` first."
+        )
+    try:
+        profile_path = resolve_profile_path(saved_profile)
+    except ValueError as exc:
+        raise ValueError(
+            "Cannot set environment: the saved default profile could not be resolved."
+        ) from exc
+    profile, _, diagnostics = resolve_profile(profile_path, environment)
+    if profile is None or has_errors(diagnostics):
+        details = "; ".join(d.message for d in diagnostics if d.level == "error")
+        raise ValueError(details or "The environment could not be resolved for the saved profile.")
+
+
 def _resolve_profile_root(profile_root: Path) -> str | None:
     """
     Resolve an ambient profiles root (CDS_PROFILE_PATH, or the default
@@ -436,7 +530,7 @@ def _add_environment_arg(subparser: argparse.ArgumentParser) -> None:
     subparser.add_argument(
         "--environment",
         "-e",
-        default=None,
+        default=argparse.SUPPRESS,
         help=(
             "Environment overlay to apply, e.g. dev or prod. Merges "
             "profiles/<name>/environments/<environment>.yaml over the base "
@@ -977,6 +1071,20 @@ def main() -> int:
     if argcomplete is not None:
         use_action.completer = profile_completer  # type: ignore[attr-defined]
 
+    config_parser = subparsers.add_parser(
+        "config",
+        help="Get, set, unset, or list persisted project defaults",
+    )
+    config_subparsers = config_parser.add_subparsers(dest="config_command", required=True)
+    config_get_parser = config_subparsers.add_parser("get", help="Print a persisted setting")
+    config_get_parser.add_argument("key", choices=["profile", "environment", "security.strict"])
+    config_set_parser = config_subparsers.add_parser("set", help="Persist a setting")
+    config_set_parser.add_argument("key", choices=["profile", "environment", "security.strict"])
+    config_set_parser.add_argument("value")
+    config_unset_parser = config_subparsers.add_parser("unset", help="Remove a persisted setting")
+    config_unset_parser.add_argument("key", choices=["profile", "environment", "security.strict"])
+    config_subparsers.add_parser("list", help="Print all persisted settings as JSON")
+
     completion_parser = subparsers.add_parser(
         "completion",
         help="Print shell setup instructions for cds tab-completion",
@@ -991,6 +1099,9 @@ def main() -> int:
         argcomplete.autocomplete(parser)
 
     args = parser.parse_args()
+    environment_explicit = hasattr(args, "environment")
+    if args.command in {"validate", "plan", "render", "up", "test", "preflight", "init", "security"}:
+        args.environment = getattr(args, "environment", None) or load_saved_environment()
     
     if args.command == "validate":
         try:
@@ -1076,7 +1187,7 @@ def main() -> int:
                     pass
 
         if is_plan_file:
-            if args.environment is not None:
+            if environment_explicit:
                 print(
                     "ERROR --environment is not supported when rendering a saved Plan file; "
                     "the environment overlay was already applied when the Plan was built."
@@ -1391,6 +1502,7 @@ def main() -> int:
                     profile_path=Path(profile_path),
                     env_file=env_file,
                     environment=args.environment,
+                    strict=load_saved_security_strict(),
                     redact_values=not args.reveal_secrets,
                     precomputed_render=PrecomputedRender(
                         plan=plan if plan_ok else None,
@@ -1649,9 +1761,11 @@ def main() -> int:
                         precomputed_render = PrecomputedRender(
                             plan=plan, rendered_compose_yaml=compose_yaml
                         )
-                        profile_class = (
-                            infer_profile_class(profile) if profile is not None else "local"
-                        )
+                        strict = load_saved_security_strict()
+                        if profile is not None:
+                            profile_class = "prod" if strict else infer_profile_class(profile)
+                        else:
+                            profile_class = "prod" if strict else "local"
                         image_verification_kwargs = {
                             "compose_yaml": compose_yaml,
                             "profile_class": profile_class,
@@ -1663,6 +1777,7 @@ def main() -> int:
                 profile_path=Path(profile_path),
                 env_file=str(resolve_env_file_path(profile_path)),
                 environment=args.environment,
+                strict=load_saved_security_strict(),
                 redact_values=not args.reveal_secrets,
                 precomputed_render=precomputed_render,
             )
@@ -1745,40 +1860,71 @@ def main() -> int:
             return 0
 
         try:
-            resolved = resolve_profile_path(args.profile)
+            resolved = _resolve_profile_for_config(args.profile)
         except ValueError as exc:
             print(f"ERROR {exc}")
             return 1
 
-        if not Path(resolved).is_file():
-            print(f"ERROR Profile '{args.profile}' could not be found (looked for {resolved}).")
+        try:
+            config_path = save_profile(resolved)
+        except ConfigIOError as exc:
+            print(f"ERROR {exc}")
             return 1
+        print(f"Saved default profile: {args.profile} (resolves to {resolved})")
+        print(f"Stored in {config_path}")
+        return 0
 
-        # When CDS_PROFILE_PATH points directly at a single profile.yaml
-        # file, resolve_profile_path() returns that file for *any* name
-        # argument (there's no profiles directory to look names up under),
-        # which would otherwise let `cds use <typo>` succeed silently and
-        # save a bogus name as if it had been validated. Require the given
-        # name to plausibly identify this profile before accepting it.
-        profile_root = get_profiles_root()
-        if profile_root.is_file() and Path(resolved).resolve() == profile_root.resolve():
-            expected_names = {profile_root.stem, profile_root.parent.name}
-            given_matches_file = Path(args.profile).resolve() == profile_root.resolve()
-            if args.profile not in expected_names and not given_matches_file:
-                print(
-                    f"ERROR CDS_PROFILE_PATH points to a single profile file ({profile_root}); "
-                    f"'{args.profile}' does not identify it. Pass the file path directly, "
-                    f"or use '{profile_root.stem}' or '{profile_root.parent.name}'."
-                )
+    if args.command == "config":
+        if args.config_command == "list":
+            print(json.dumps(_read_config(), indent=2, sort_keys=True))
+            return 0
+
+        if args.config_command == "get":
+            value = _config_value(args.key)
+            if value is None:
+                print(f"ERROR Config key '{args.key}' is not set.")
                 return 1
+            print(json.dumps(value) if isinstance(value, bool) else value)
+            return 0
+
+        if args.config_command == "set":
+            if args.key == "profile":
+                try:
+                    value = _resolve_profile_for_config(args.value)
+                except ValueError as exc:
+                    print(f"ERROR {exc}")
+                    return 1
+            elif args.key == "environment":
+                value = args.value
+                try:
+                    _validate_environment_setting(value)
+                except ValueError as exc:
+                    print(f"ERROR {exc}")
+                    return 1
+            elif args.key == "security.strict":
+                if args.value not in {"true", "false"}:
+                    print("ERROR Config key 'security.strict' must be true or false.")
+                    return 1
+                value = args.value
+            else:
+                value = args.value
+            try:
+                config_path = set_config_value(args.key, value)
+            except ConfigIOError as exc:
+                print(f"ERROR {exc}")
+                return 1
+            print(f"Set {args.key} = {value} ({config_path})")
+            return 0
 
         try:
-            config_path = save_profile(resolved)
+            removed = unset_config_value(args.key)
         except ConfigIOError as exc:
             print(f"ERROR {exc}")
             return 1
-        print(f"Saved default profile: {args.profile} (resolves to {resolved})")
-        print(f"Stored in {config_path}")
+        if removed:
+            print(f"Unset {args.key} ({get_config_path()})")
+        else:
+            print(f"Config key '{args.key}' is not set.")
         return 0
 
     if args.command == "completion":

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/cli/renderer.py

@@ -244,7 +244,8 @@ def _render_services(
             project_root=project_root,
             compose_dir=compose_dir,
         )
-        
+        service_copy = _apply_image_source(service_copy, module)
+
         # Attach to the network if network_name is provided
         if network_name:
             service_copy["networks"] = [network_name]
@@ -661,6 +662,36 @@ def _rewrite_depends_on(
     return {**service_def, "depends_on": rewritten}
 
 
+def _apply_image_source(
+    service_def: dict[str, Any],
+    module: dict[str, Any],
+) -> dict[str, Any]:
+    """
+    Swap a rendered service's build: block for a registry image: reference
+    when the module's config.image.source is "registry".
+
+    When config.image.source is "registry", any "build" key is dropped and
+    "image" is rewritten to
+    "docker.io/ronaldsoeverein/<module id>:<config.image.tag>". Emitting
+    a registry reference without a tag would silently produce an untagged
+    image, so the service is left unchanged (with the build: block intact)
+    if no tag is configured; validator enforcement of a required tag is
+    tracked separately (issue #533).
+    """
+    image_config = module.get("config", {}).get("image", {})
+    if not isinstance(image_config, dict) or image_config.get("source") != "registry":
+        return service_def
+
+    tag = image_config.get("tag")
+    if not tag:
+        return service_def
+
+    service_copy = dict(service_def)
+    service_copy.pop("build", None)
+    service_copy["image"] = f"docker.io/ronaldsoeverein/{module.get('id')}:{tag}"
+    return service_copy
+
+
 def _rewrite_build_context(
     service_def: dict[str, Any],
     module: dict[str, Any],

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/cli/security.py

@@ -659,6 +659,7 @@ def run_security_validation(
     env_file: str | None = None,
     redact_values: bool = False,
     environment: str | None = None,
+    strict: bool = False,
     precomputed_render: PrecomputedRender | None = None,
 ) -> tuple[list[dict[str, Any]], list[Diagnostic]]:
     """
@@ -679,6 +680,8 @@ def run_security_validation(
             profile's declared metadata.environment (and therefore the
             production security policy applied below) reflects the overlay,
             not just the base profile.
+        strict:           Apply the production security rule class regardless
+            of the profile's declared environment.
         precomputed_render: Optional `PrecomputedRender` used by
             "rendered-compose"-scoped rules (e.g. CDS-SEC-070). Callers that
             already planned and/or rendered the profile for their own
@@ -707,7 +710,7 @@ def run_security_validation(
         overlay_diags = []
     rule_set = _validate_rule_set(rule_schema_path, rule_set_path)
 
-    profile_class = infer_profile_class(profile)
+    profile_class = "prod" if strict else infer_profile_class(profile)
 
     secrets, secret_diags = load_secrets_from_env(env_file)
 

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0/composable_data_stack.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: composable-data-stack
-Version: 0.6.0
+Version: 0.7.0
 Summary: CLI for validating and composing composable data stack profiles
 Author: Ronald Hensbergen
 License-Expression: Apache-2.0
@@ -31,7 +31,7 @@ Provides-Extra: dev
 Requires-Dist: coverage>=7.6; extra == "dev"
 Requires-Dist: bandit>=1.7; extra == "dev"
 Requires-Dist: pip-audit>=2.7; extra == "dev"
-Requires-Dist: ruff==0.16.4; extra == "dev"
+Requires-Dist: ruff==0.16.5; extra == "dev"
 Dynamic: license-file
 
 # 🚀 Composable Data Stack (CDS)
@@ -633,8 +633,9 @@ Differences from 'dev' to 'prod':
   ~ spec.modules[postgres].config.storage.size: "2Gi" -> "20Gi"
 ```
 
-Commands without `--environment` are unaffected — they behave exactly as
-before and never look for an `environments/` directory.
+Persist an environment default for a project with `cds config set environment
+prod`; commands without `--environment` then use that overlay. An explicit
+`--environment` always takes precedence.
 
 ---
 
@@ -654,6 +655,7 @@ before and never look for an `environments/` directory.
 |cds security [profile]|Run rule-based security validation on a profile|
 |cds diff [profile] --from \<env\> --to \<env\>|Show effective configuration differences between two environment overlays, secrets never included|
 |cds use [profile] [--clear]|Save (show/clear) a default profile so it doesn't have to be passed to other commands|
+|cds config get\|set\|unset\|list|Manage persisted project defaults in `.cds/config.json`|
 |cds completion \<bash\|zsh\|powershell\>|Print shell setup instructions for tab-completion|
 
 `init`, `validate`, `preflight`, `plan`, `render`, `up`, `test`, and `security`
@@ -674,6 +676,29 @@ destination root, `--dry-run` to inspect the copy plan first, and `--force` to
 replace conflicting local files. Successful fetches record tracking metadata
 in `.cds/get-manifest.json` for future update workflows.
 
+### Project defaults
+
+`cds config` manages the gitignored `.cds/config.json` file (or the path in
+`CDS_CONFIG_PATH`). Supported settings are `profile`, `environment`, and
+`security.strict`:
+
+```bash
+cds config set profile my-profile
+cds config set environment prod
+cds config set security.strict true
+cds config list
+```
+
+`profile` is stored as its resolved path, and `environment` is validated
+against that profile's `environments/` directory. `security.strict true`
+applies the existing production security rules even if the profile declares a
+local environment. `cds use` remains a shortcut for setting, showing, or
+clearing `profile`.
+
+CLI flags take precedence over these defaults. In particular,
+`--environment` overrides `config environment`; `CDS_PROFILE_PATH` continues
+to override the saved profile.
+
 `[profile]` accepts:
 
 | Form | Example |
@@ -682,7 +707,7 @@ in `.cds/get-manifest.json` for future update workflows.
 | Path to a `profile.yaml` file | `profiles/local-dagster-postgres-superset/profile.yaml` |
 | Path to a profiles root directory | `profiles/` |
 
-When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds use <profile>`, then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted `cds use` default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
+When `[profile]` is omitted, resolution falls back in order to: `CDS_PROFILE_PATH` if set (accepts the same three forms), then the default profile saved via `cds config set profile` (or `cds use <profile>`), then the single profile under `profiles/` if there is exactly one. An explicitly-set env var takes precedence over the persisted project default, matching common CLI convention (env vars are per-invocation and reflect the current session more reliably than a saved, gitignored default that's easy to forget about).
 
 To view the full list of options for any command, use the `--help` flag:
 

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/composable_data_stack.egg-info/requires.txt

@@ -11,4 +11,4 @@ argcomplete<4,>=3.0.0
 coverage>=7.6
 bandit>=1.7
 pip-audit>=2.7
-ruff==0.16.4
+ruff==0.16.5

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "composable-data-stack"
-version = "0.6.0"
+version = "0.7.0"
 description = "CLI for validating and composing composable data stack profiles"
 readme = "README.md"
 license = "Apache-2.0"
@@ -52,7 +52,7 @@ dev = [
   "coverage>=7.6",
   "bandit>=1.7",
   "pip-audit>=2.7",
-  "ruff==0.16.4",
+  "ruff==0.16.5",
 ]
 
 [project.scripts]

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/tests/test_environment_cli.py

@@ -89,6 +89,45 @@ class EnvironmentOverlayFixture(unittest.TestCase):
 
 
 class ValidatePlanRenderEnvironmentTest(EnvironmentOverlayFixture):
+    def test_configured_environment_is_used_when_flag_is_omitted(self):
+        self._write_overlay("prod", {"spec": {"modules": [{"id": "db", "config": {"replicas": 3}}]}})
+        config_path = self.root / ".cds" / "config.json"
+        config_path.parent.mkdir()
+        config_path.write_text(
+            json.dumps({"profile": str(self.profile_path), "environment": "prod"})
+        )
+        env_vars = {**self.env_vars, "CDS_CONFIG_PATH": str(config_path)}
+
+        stdout = io.StringIO()
+        with patch.dict(os.environ, env_vars, clear=False), patch.object(
+            sys, "argv", ["cds", "plan"]
+        ), contextlib.redirect_stdout(stdout):
+            result = main()
+
+        self.assertEqual(result, 0, stdout.getvalue())
+        self.assertEqual(json.loads(stdout.getvalue())["environment"], "prod")
+
+    def test_explicit_environment_overrides_configured_default(self):
+        self._write_overlay("dev", {"spec": {"modules": [{"id": "db", "config": {"replicas": 2}}]}})
+        self._write_overlay("prod", {"spec": {"modules": [{"id": "db", "config": {"replicas": 3}}]}})
+        config_path = self.root / ".cds" / "config.json"
+        config_path.parent.mkdir()
+        config_path.write_text(
+            json.dumps({"profile": str(self.profile_path), "environment": "prod"})
+        )
+        env_vars = {**self.env_vars, "CDS_CONFIG_PATH": str(config_path)}
+
+        stdout = io.StringIO()
+        with patch.dict(os.environ, env_vars, clear=False), patch.object(
+            sys, "argv", ["cds", "plan", "--environment", "dev"]
+        ), contextlib.redirect_stdout(stdout):
+            result = main()
+
+        self.assertEqual(result, 0, stdout.getvalue())
+        plan = json.loads(stdout.getvalue())
+        self.assertEqual(plan["environment"], "dev")
+        self.assertEqual(plan["modules"][0]["config"]["replicas"], 2)
+
     def test_validate_uses_overlay_when_environment_given(self):
         self._write_overlay("prod", {"spec": {"modules": [{"id": "db", "config": {"replicas": 3}}]}})
         result, output = self._run(["cds", "validate", "--environment", "prod"])

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/tests/test_main.py

@@ -1711,6 +1711,87 @@ class UseCommandCLITest(unittest.TestCase):
         self.assertIn("Profile is valid", captured.getvalue())
 
 
+class ConfigCommandCLITest(unittest.TestCase):
+    def setUp(self):
+        self.repo_root = Path(__file__).resolve().parent.parent
+        self.profiles_root = self.repo_root / "profiles"
+        self.tmpdir = tempfile.TemporaryDirectory()
+        self.config_path = Path(self.tmpdir.name) / "config.json"
+        self.env_patch = patch.dict(
+            os.environ,
+            {"CDS_PROFILE_PATH": str(self.profiles_root), "CDS_CONFIG_PATH": str(self.config_path)},
+            clear=False,
+        )
+        self.env_patch.start()
+
+    def tearDown(self):
+        self.env_patch.stop()
+        self.tmpdir.cleanup()
+
+    def _run(self, argv_extra):
+        captured = io.StringIO()
+        with patch.object(sys, "argv", ["cds", "config"] + argv_extra), contextlib.redirect_stdout(captured):
+            result = main()
+        return result, captured.getvalue()
+
+    def test_config_sets_gets_and_unsets_profile(self):
+        result, output = self._run(["set", "profile", "local-dagster-postgres-superset"])
+        self.assertEqual(result, 0, output)
+        expected = str((self.profiles_root / "local-dagster-postgres-superset" / "profile.yaml").resolve())
+        self.assertEqual(json.loads(self.config_path.read_text())["profile"], expected)
+
+        result, output = self._run(["get", "profile"])
+        self.assertEqual(result, 0, output)
+        self.assertEqual(output.strip(), expected)
+
+        result, output = self._run(["unset", "profile"])
+        self.assertEqual(result, 0, output)
+        self.assertFalse(self.config_path.exists())
+
+    def test_config_environment_requires_existing_overlay_for_default_profile(self):
+        self._run(["set", "profile", "local-dagster-postgres-superset"])
+
+        result, output = self._run(["set", "environment", "does-not-exist"])
+        self.assertEqual(result, 1)
+        self.assertIn("Unknown environment", output)
+        self.assertNotIn("environment", json.loads(self.config_path.read_text()))
+
+    def test_config_list_and_security_strict(self):
+        self._run(["set", "profile", "local-dagster-postgres-superset"])
+        result, output = self._run(["set", "security.strict", "true"])
+        self.assertEqual(result, 0, output)
+
+        result, output = self._run(["get", "security.strict"])
+        self.assertEqual(result, 0, output)
+        self.assertEqual(output.strip(), "true")
+
+        result, output = self._run(["list"])
+        self.assertEqual(result, 0, output)
+        self.assertTrue(json.loads(output)["security"]["strict"])
+
+    def test_config_rejects_invalid_security_strict_value(self):
+        result, output = self._run(["set", "security.strict", "yes"])
+        self.assertEqual(result, 1)
+        self.assertIn("must be true or false", output)
+        self.assertFalse(self.config_path.exists())
+
+    @patch("cli.main.run_security_validation", return_value=([], []))
+    @patch("cli.main.validate_profile", return_value=[])
+    def test_configured_security_strict_is_passed_to_security_checks(
+        self, mock_validate, mock_run_security
+    ):
+        self._run(["set", "security.strict", "true"])
+        captured = io.StringIO()
+        with patch.object(
+            sys, "argv", ["cds", "security", "local-dagster-postgres-superset"]
+        ), contextlib.redirect_stdout(captured):
+            result = main()
+
+        self.assertEqual(result, 0, captured.getvalue())
+        mock_validate.assert_called_once()
+        self.assertTrue(mock_run_security.call_args.kwargs["strict"])
+
+
 class CompletionCommandCLITest(unittest.TestCase):
     def _run(self, shell):
         captured = io.StringIO()

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/tests/test_publish_images_workflow.py

@@ -104,6 +104,65 @@ class PublishImagesWorkflowTest(unittest.TestCase):
             names.index("Push image"),
         )
 
+    def test_dockerhub_job_has_id_token_permission_for_keyless_signing(self) -> None:
+        perms = self.jobs["publish-dockerhub"]["permissions"]
+        self.assertEqual(perms.get("id-token"), "write")
+
+    def test_dockerhub_job_signs_and_attests_by_digest(self) -> None:
+        job = self.jobs["publish-dockerhub"]
+        push_step = next(s for s in job["steps"] if s.get("id") == "push")
+        self.assertIn("$(docker inspect", push_step["run"])
+        self.assertIn('echo "digest=$digest" >> "$GITHUB_OUTPUT"', push_step["run"])
+        self.assertIn('"$ref:${prefix}sha-${GITHUB_SHA::12}"', push_step["run"])
+
+        for step_name in ("Sign image (keyless)", "Attest SBOM", "Attest provenance"):
+            with self.subTest(step=step_name):
+                step = next(s for s in job["steps"] if s.get("name") == step_name)
+                self.assertIn("steps.push.outputs.digest", step["run"])
+
+    def test_dockerhub_job_verifies_signature_and_attestations(self) -> None:
+        job = self.jobs["publish-dockerhub"]
+        verify_step = next(
+            s for s in job["steps"] if s.get("name") == "Verify signed image (self-check)"
+        )
+        verify_run = verify_step["run"]
+        self.assertIn("cosign verify \\", verify_run)
+        self.assertIn("cosign verify-attestation \\", verify_run)
+        self.assertIn("--type cyclonedx", verify_run)
+        self.assertIn("--type slsaprovenance", verify_run)
+        self.assertIn("steps.push.outputs.digest", verify_run)
+        self.assertIn(
+            "'^https://github\\.com/${{ github.repository }}/\\.github/workflows/"
+            "publish-images\\.yml@${{ github.ref }}$'",
+            verify_run,
+        )
+
+    def test_dockerhub_job_sbom_and_provenance_are_both_attested(self) -> None:
+        job = self.jobs["publish-dockerhub"]
+        names = {s.get("name") for s in job["steps"]}
+        self.assertIn("Attest SBOM", names)
+        self.assertIn("Attest provenance", names)
+        sbom_attest = next(s for s in job["steps"] if s.get("name") == "Attest SBOM")
+        self.assertIn("--type cyclonedx", sbom_attest["run"])
+        provenance_attest = next(
+            s for s in job["steps"] if s.get("name") == "Attest provenance"
+        )
+        self.assertIn("--type slsaprovenance", provenance_attest["run"])
+
+    def test_dockerhub_job_uses_cosign_installer(self) -> None:
+        job = self.jobs["publish-dockerhub"]
+        uses = [str(s.get("uses", "")) for s in job["steps"]]
+        self.assertTrue(any(u.startswith("sigstore/cosign-installer@") for u in uses))
+
+    def test_dockerhub_gate_runs_before_sign_and_push(self) -> None:
+        job = self.jobs["publish-dockerhub"]
+        names = [s.get("name") for s in job["steps"]]
+        gate_idx = names.index("Gate on HIGH/CRITICAL vulnerabilities before push")
+        push_idx = names.index("Push image")
+        sign_idx = names.index("Sign image (keyless)")
+        self.assertLess(gate_idx, push_idx)
+        self.assertLess(push_idx, sign_idx)
+
     def test_sbom_and_provenance_are_both_attested(self) -> None:
         names = {s.get("name") for s in self.publish_steps}
         self.assertIn("Attest SBOM", names)

{composable_data_stack-0.6.0 → composable_data_stack-0.7.0}/tests/test_renderer.py

@@ -852,5 +852,91 @@ class RendererRegressionTest(unittest.TestCase):
         self.assertEqual(len(errors), 1)
         self.assertNotIn("web-app", output)
 
+
+class ImageSourceRenderingTest(unittest.TestCase):
+    def _plan(self, image_config):
+        return {
+            "metadata": {"name": "cds-test"},
+            "modules": [
+                {
+                    "id": "dagster",
+                    "config": {"image": image_config},
+                    "implementation": {
+                        "kind": "docker-compose",
+                        "compose": {
+                            "services": {
+                                "user-code": {
+                                    "build": {
+                                        "context": ".",
+                                        "dockerfile": "images/dagster/${config.image.variant}/Dockerfile",
+                                    },
+                                    "image": "local/dagster:custom",
+                                },
+                                "webserver": {
+                                    "image": "local/dagster:custom",
+                                },
+                            }
+                        },
+                    },
+                }
+            ],
+        }
+
+    def test_default_source_build_leaves_build_block_intact(self):
+        plan = self._plan({"variant": "base", "source": "build"})
+
+        output, diagnostics = render_compose(plan)
+
+        self.assertEqual(len([d for d in diagnostics if d.level == "error"]), 0)
+        compose = yaml.safe_load(output)
+        service = compose["services"]["dagster-user-code"]
+        self.assertIn("build", service)
+        self.assertEqual(service["image"], "local/dagster:custom")
+
+    def test_source_registry_with_tag_drops_build_and_rewrites_image(self):
+        plan = self._plan({"variant": "base", "source": "registry", "tag": "1.8.0"})
+
+        output, diagnostics = render_compose(plan)
+
+        self.assertEqual(len([d for d in diagnostics if d.level == "error"]), 0)
+        compose = yaml.safe_load(output)
+        service = compose["services"]["dagster-user-code"]
+        self.assertNotIn("build", service)
+        self.assertEqual(service["image"], "docker.io/ronaldsoeverein/dagster:1.8.0")
+
+    def test_source_registry_without_tag_falls_back_to_build(self):
+        plan = self._plan({"variant": "base", "source": "registry"})
+
+        output, diagnostics = render_compose(plan)
+
+        self.assertEqual(len([d for d in diagnostics if d.level == "error"]), 0)
+        compose = yaml.safe_load(output)
+        service = compose["services"]["dagster-user-code"]
+        self.assertIn("build", service)
+        self.assertEqual(service["image"], "local/dagster:custom")
+
+    def test_source_registry_rewrites_services_without_build(self):
+        plan = self._plan({"variant": "base", "source": "registry", "tag": "1.8.0"})
+
+        output, diagnostics = render_compose(plan)
+
+        self.assertEqual(len([d for d in diagnostics if d.level == "error"]), 0)
+        compose = yaml.safe_load(output)
+        service = compose["services"]["dagster-webserver"]
+        self.assertNotIn("build", service)
+        self.assertEqual(service["image"], "docker.io/ronaldsoeverein/dagster:1.8.0")
+
+    def test_source_registry_with_variant_prefixed_tag(self):
+        plan = self._plan({"variant": "hardened", "source": "registry", "tag": "hardened-1.8.0"})
+
+        output, diagnostics = render_compose(plan)
+
+        self.assertEqual(len([d for d in diagnostics if d.level == "error"]), 0)
+        compose = yaml.safe_load(output)
+        service = compose["services"]["dagster-user-code"]
+        self.assertNotIn("build", service)
+        self.assertEqual(service["image"], "docker.io/ronaldsoeverein/dagster:hardened-1.8.0")
+
+
 if __name__ == "__main__":
     unittest.main()