craft-dashboard 0.1.0__tar.gz

craft_dashboard-0.1.0/.dockerignore

@@ -0,0 +1,24 @@
+.git
+.github
+.venv
+.pytest_cache
+.ruff_cache
+__pycache__
+*.pyc
+.env
+.env.example
+.envrc
+tests/
+docs/
+provisioning/
+plans/
+*.egg-info
+logs.txt
+*.sql.gz
+.logs/
+.local/
+debug-evals/
+*.pem
+.token_cache*.json
+htmlcov/
+.coverage

craft_dashboard-0.1.0/.env.example

@@ -0,0 +1,65 @@
+# ===========================================================================
+# General & Shared Configuration
+# ===========================================================================
+# Craft-dashboard server URL to pull evaluation jobs from
+# Local Dev:      https://craft-dashboard.name (or http://localhost:8000)
+# Production VPS: http://craft-dashboard:8000
+DASHBOARD_URL=
+
+# Eval API bearer token (authenticates worker requests to /api/eval/*)
+EVAL_API_TOKEN=
+
+# GitHub token (shared: collector cron on server, local scripts/queries)
+GITHUB_TOKEN=
+
+DEBUG=false
+LOG_LEVEL=INFO
+
+# ===========================================================================
+# LLM Backend Configuration
+# ===========================================================================
+# Choose a backend (OpenRouter or llama.cpp) by commenting/uncommenting.
+
+# --- OpenRouter ---
+LLM_BASE_URL=https://openrouter.ai/api/v1
+LLM_API_KEY=
+LLM_MODEL=
+# LLM_MODEL_SUMMARY=
+# LLM_MODEL_SCORING=
+
+# --- llama.cpp (local OpenAI-compatible server) ---
+# LLM_BASE_URL=http://localhost:8080/v1
+# LLM_API_KEY=
+# LLM_MODEL=
+
+# LLM & worker tuning
+# LLM_TIMEOUT=600.0
+# LLM_CA_CERT=
+# DASHBOARD_CA_CERT=
+
+# Git mirror storage for evaluation tools (git grep, git log)
+# CRAFT_DASHBOARD_MIRROR_DIR=~/.cache/craft-dashboard/mirrors
+# CRAFT_DASHBOARD_GIT_CONCURRENCY=2
+
+# ===========================================================================
+# Server Only (Production VPS: /opt/vps-infra/.env)
+# ===========================================================================
+# PostgreSQL connection string (server only; local evals use HTTP)
+# DATABASE_URL=postgresql+asyncpg://craft_dashboard:<DB_PASSWORD>@postgres/craft_dashboard
+
+# Admin bearer token for /api/admin/* endpoints
+# ADMIN_TOKEN=
+
+# API key for server-side semantic search & eval embeddings
+# EMBEDDING_API_KEY=
+
+# Retention window in days for superseded evaluation transcripts
+# EVAL_TRANSCRIPT_RETENTION_DAYS=30
+
+# Auto-pause evaluation when today's USD spend cap is reached (0.0 = unlimited)
+# EVAL_DAILY_SPEND_CAP_USD=0.0
+
+# Related issues tuning on the issue detail page
+# RELATED_ISSUES_TOP_N=10
+# RELATED_ISSUES_SIMILARITY_THRESHOLD=0.70
+

craft_dashboard-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1 @@
+- [ ] Have you successfully run `make lint && make test`?

craft_dashboard-0.1.0/.github/renovate.json5

@@ -0,0 +1,3 @@
+{
+  extends: ["github>canonical/starflow:renovate.json5"],
+}

craft_dashboard-0.1.0/.github/workflows/check-renovate.yaml

@@ -0,0 +1,31 @@
+name: Renovate check
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/check-renovate.yaml"
+      - ".github/renovate.json5"
+
+  # Allows triggering the workflow manually from the Actions tab
+  workflow_dispatch:
+    inputs:
+      enable_ssh_access:
+        type: boolean
+        description: "Enable ssh access"
+        required: false
+        default: false
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install renovate
+        run: npm install --global re2 renovate
+      - name: Check renovate config
+        run: renovate-config-validator .github/renovate.json5
+      - name: Renovate dry-run
+        run: renovate --dry-run=full --autodiscover --print-config
+        env:
+          RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RENOVATE_USE_BASE_BRANCH_CONFIG: ${{ github.ref }}

craft_dashboard-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - run: |
+          uv sync --frozen
+          make setup
+          make lint
+
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      # A lockfile that has drifted from pyproject.toml means CI and the
+      # published image resolve different dependency versions.
+      - run: uv lock --check
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - run: |
+          uv sync --frozen
+          make setup
+          make test
+
+  migrations:
+    runs-on: ubuntu-latest
+    # The app runs `alembic upgrade head` at startup, so a migration that fails
+    # on PostgreSQL takes production down rather than failing a test. The unit
+    # suite runs on SQLite and cannot catch that.
+    services:
+      postgres:
+        # Must match the image vps-infra runs; migrations create the
+        # `vector` extension, which stock postgres does not ship.
+        image: pgvector/pgvector:pg16
+        env:
+          POSTGRES_USER: craft_dashboard
+          POSTGRES_PASSWORD: craft_dashboard
+          POSTGRES_DB: craft_dashboard
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U craft_dashboard"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql+asyncpg://craft_dashboard:craft_dashboard@localhost:5432/craft_dashboard
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - run: uv sync --frozen
+      - name: Upgrade an empty database to head
+        run: uv run alembic upgrade head
+      - name: Check for a missing migration
+        # Autogenerate must produce no operations once head is applied,
+        # otherwise a model change shipped without its migration.
+        run: |
+          uv run alembic check
+
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0  # needed for setuptools_scm versioning
+      - name: Build the runtime image
+        run: |
+          docker build --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0 \
+            -t craft-dashboard:ci .
+      - name: Smoke test the image
+        # Catches a broken entrypoint or a missing runtime dependency before
+        # the image reaches GHCR and the deploy workflow restarts production.
+        run: |
+          docker run --rm craft-dashboard:ci \
+            python -c "from craft_dashboard.app import create_app; create_app()"

craft_dashboard-0.1.0/.github/workflows/e2e.yml

@@ -0,0 +1,23 @@
+name: E2E
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  test-e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "22"
+      - run: |
+          uv sync --frozen
+          make setup
+          make test-e2e

craft_dashboard-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,98 @@
+name: Publish Docker Image
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  # Publishing to GHCR triggers a production deploy, so it must not run ahead
+  # of the checks. Calling the workflows here (rather than relying on branch
+  # protection) keeps the gate in version control.
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  e2e:
+    uses: ./.github/workflows/e2e.yml
+
+  publish:
+    needs: [ci, e2e]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      security-events: write  # for the Trivy SARIF upload
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0  # needed for setuptools_scm versioning
+
+      # The default docker driver cannot attach SBOM or provenance
+      # attestations; the container driver can.
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest
+            type=sha,prefix=
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+          build-args: |
+            SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0
+
+      - name: Scan the published image
+        continue-on-error: true
+        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+          format: sarif
+          output: trivy.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+
+      - name: Upload scan results
+        # Informational: a base-image CVE must not block shipping an app fix.
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@88585263c0627ee42c0e1c5143a112c8d6f4aa18 # v4.38.2
+        with:
+          sarif_file: trivy.sarif
+
+      - name: Trigger vps-infra deploy
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        with:
+          token: ${{ secrets.VPSINFRA_PAT }}
+          repository: mr-cal/vps-infra
+          event-type: craft-dashboard-updated
+          # The digest makes a deploy reproducible and a rollback unambiguous;
+          # `latest` is a convenience tag only. vps-infra may pin to this.
+          client-payload: |
+            {
+              "image": "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}",
+              "digest": "${{ steps.build.outputs.digest }}",
+              "sha": "${{ github.sha }}"
+            }

craft_dashboard-0.1.0/.github/workflows/release-publish.yaml

@@ -0,0 +1,69 @@
+name: Release
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+  pull_request:
+    paths:
+      - .github/workflows/release-publish.yaml
+
+jobs:
+  source-wheel:
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - name: Fetch tag annotations
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          git fetch --force --tags --depth 1
+          git describe --dirty --long --match '[0-9]*.[0-9]*.[0-9]*' --exclude '*[^0-9.]*'
+      - name: Build packages
+        run: |
+          uv build
+          uvx twine check dist/*
+      - name: Upload pypi packages artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: pypi-packages
+          path: dist/
+
+  pypi:
+    needs: ["source-wheel"]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Get packages
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: pypi-packages
+          path: dist/
+      - name: Publish to pypi
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  github-release:
+    needs: ["source-wheel"]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Get pypi artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: pypi-packages
+      - name: Release
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: gh release create "$RELEASE_TAG" --generate-notes -- *.whl *.tar.gz

craft_dashboard-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,87 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+*"
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Verify build without publishing to PyPI"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  build:
+    needs: [ci]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+
+      - name: Fetch tag annotations
+        run: |
+          git fetch --force --tags --depth 1
+
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+
+      - name: Build packages
+        run: |
+          uv build
+          uvx twine check dist/*
+
+      - name: Upload pypi packages artifact
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: pypi-packages
+          path: dist/
+          if-no-files-found: error
+
+  publish-pypi:
+    needs: [build]
+    if: startsWith(github.ref, 'refs/tags/') && !inputs.dry-run
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Mandatory for PyPI Trusted Publishing
+
+    steps:
+      - name: Get packages
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          name: pypi-packages
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    needs: [publish-pypi]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Get packages
+        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        with:
+          name: pypi-packages
+          path: dist/
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "${{ github.ref_name }}" \
+            --generate-notes \
+            dist/*

craft_dashboard-0.1.0/.gitignore

@@ -0,0 +1,54 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+*.egg
+dist/
+build/
+.eggs/
+
+# Version
+craft_dashboard/_version.py
+
+# Virtual environments
+.venv/
+venv/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Tools
+.cache/
+.bakeoff/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Environment
+.env*
+!.env.example
+.envrc
+provisioning/secrets.env
+*.sql.gz
+
+# OS
+.DS_Store
+
+# uv
+logs.txt
+
+# plans
+plans/
+
+# LLM debug-eval scratch artifacts (local-only, not versioned)
+debug-evals/
+.logs/
+.local/
+*.pem
+.token_cache*.json

craft_dashboard-0.1.0/Dockerfile

@@ -0,0 +1,51 @@
+# ---- Build stage ----
+FROM python:3.12-slim AS builder
+
+WORKDIR /build
+RUN pip install --no-cache-dir uv
+
+COPY pyproject.toml uv.lock ./
+COPY craft_dashboard/ craft_dashboard/
+COPY alembic/ alembic/
+COPY alembic.ini ./
+COPY scripts/ scripts/
+COPY craft-dashboard.toml ./
+
+# setuptools_scm needs .git; use a pretend version in Docker builds
+ARG SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0
+
+# Install the app and its dependencies into a virtual environment
+RUN uv venv /app/.venv \
+    && uv pip install --python /app/.venv/bin/python . psycopg2-binary
+
+# ---- Runtime stage ----
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends libpq5 postgresql-client git \
+    && rm -rf /var/lib/apt/lists/*
+
+# A fixed UID so bind-mounted host directories (the git mirror store) can be
+# chowned to match. Keep in sync with vps-infra's mirror volume ownership.
+RUN useradd --create-home --uid 10001 --user-group app
+
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /build /app
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+WORKDIR /app
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    HOME=/home/app
+
+RUN chown -R app:app /app
+
+USER app
+
+EXPOSE 8000
+
+# Declared here as well as in compose, so `podman run` and any orchestrator
+# that ignores compose still get a liveness signal. curl is not installed.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
+
+CMD ["/usr/local/bin/docker-entrypoint.sh"]