datasecops-cli 0.7.0b4__tar.gz → 0.7.0b5__tar.gz

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/CHANGELOG.md

@@ -4,11 +4,18 @@ All notable changes to the DataSecOps CLI are documented in this file.
 
 ## [Unreleased]
 
+## [0.7.0b5] - 2026-10-26
+
+### Added
+
+- **`datasecops pipeline env`** — resolves the dbt target for a pipeline run from the native app's dbt Targets (`--branch` matches a target's Branch, then a target named like the branch; `--target` picks one by name) and sets `TARGET`, `SF_ROLE`, `SF_WAREHOUSE` and `TARGET_SCHEMA` (`$GITHUB_ENV` on GitHub Actions, `##vso` on Azure DevOps, `KEY=value` otherwise). Generated pipelines use it instead of hard-coding the CI role and warehouse.
+
 ### Fixed
 
 - **`profiles.yml` deployment targets were being written to a developer's own `~/.dbt/profiles.yml`** — CI/deployment targets (`dev`/`test`/`prod`) belong to the native app's CI pipeline, not a developer's machine, so they're no longer written there at all. Only the `local-dev` target is ever added or refreshed; any other targets already present in the file (added manually, or by a framework target sharing the profile's name) are left untouched. Removed the now-unused CI-identity profile generation (`ProjectSettings.ci_username`, the old `generate_profiles_yml`).
 - **`local-dev` used a hardcoded `authenticator: externalbrowser` and a shared database instead of the developer's own identity** — `local-dev` now reuses whatever Snowflake CLI connection is already configured for the project in `~/.snowflake/connections.toml` (account, user, and whatever auth method is already in use — key pair, SSO, password, etc.), read directly via `snowflake.connector.config_manager` without establishing a connection. `role`/`warehouse`/`schema` still always come from the project's dbt targets config. The developer is prompted once for their name (persisted to `.datasecops.yml`), used to build a personal sandpit database (`<target_database>SANDPIT_<name>`) so multiple developers never collide.
 - **`profiles.yml` is no longer written inside the dbt project folder** — dbt never reads a `profiles.yml` there (it reads `--profiles-dir`, i.e. `~/.dbt` per the native app's `profile_dir` setting), so the project-local copy was always a dead reference file. `datasecops setup`/`bootstrap`/`new project` now write/merge the `local-dev` target directly into `~/.dbt/profiles.yml` via a shared `write_profiles_yml()` helper, creating the folder/file if needed.
+- **`app_database` is validated before it is used in SQL** — it is interpolated into the native app `CALL` statements (CLI and MCP server), so a value that isn't a single plain or double-quoted identifier is now rejected instead of being able to change the statement.
 
 ## [0.7.0b2] - 2026-10-26
 

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datasecops-cli
-Version: 0.7.0b4
+Version: 0.7.0b5
 Summary: DataSecOps Framework CLI for Snowflake Native App
 License-Expression: MIT
 License-File: LICENSE
@@ -146,6 +146,33 @@ Your pipeline needs two things:
 
 The exit code is `0` on success, `1` if any download fails.
 
+### Environment settings for the branch
+
+`datasecops pipeline env` reads the dbt Targets from the native app (**Settings › Data › dbt
+Targets**) and sets `TARGET`, `SF_ROLE`, `SF_WAREHOUSE` and `TARGET_SCHEMA` for the target mapped to
+the branch, so pipelines don't hard-code them:
+
+```bash
+datasecops pipeline env --branch "$GITHUB_REF_NAME"         # GitHub Actions: target whose Branch is this branch
+datasecops pipeline env --branch "$BUILD_SOURCEBRANCH"      # Azure DevOps (the full ref, not BUILD_SOURCEBRANCHNAME)
+datasecops pipeline env --target unit-test                  # a named target
+```
+
+Pass the branch through the runner's environment variable, not a `${{ ... }}` / `$(...)` expression:
+those are substituted into the script before the shell runs, so a branch name containing `$(...)`
+would execute.
+
+- `--branch` matches a target's **Branch**, then a target named like the branch; `refs/heads/` is
+  ignored and a pull request's merge ref resolves to its source branch (`$GITHUB_HEAD_REF` on GitHub,
+  `$SYSTEM_PULLREQUEST_SOURCEBRANCH` on Azure DevOps). On Azure DevOps pass `$BUILD_SOURCEBRANCH`:
+  `$BUILD_SOURCEBRANCHNAME` is only the last part of the ref (`release/prod` -> `prod`).
+  Exact names win; a case-insensitive match is used only when it is unambiguous.
+- GitHub Actions: the values are appended to `$GITHUB_ENV`. Azure DevOps: they are set with
+  `##vso[task.setvariable]`. Elsewhere (or `--format shell`) they are printed as shell-quoted `KEY=value` lines.
+- A target with no role, warehouse or schema leaves that variable as it is.
+- The command connects with `.datasecops.yml`'s connection, so the CI user needs the `orbit_developer`
+  application role. It exits `1` when no target matches.
+
 ## DCM projects
 
 ```bash

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/README.md

@@ -126,6 +126,33 @@ Your pipeline needs two things:
 
 The exit code is `0` on success, `1` if any download fails.
 
+### Environment settings for the branch
+
+`datasecops pipeline env` reads the dbt Targets from the native app (**Settings › Data › dbt
+Targets**) and sets `TARGET`, `SF_ROLE`, `SF_WAREHOUSE` and `TARGET_SCHEMA` for the target mapped to
+the branch, so pipelines don't hard-code them:
+
+```bash
+datasecops pipeline env --branch "$GITHUB_REF_NAME"         # GitHub Actions: target whose Branch is this branch
+datasecops pipeline env --branch "$BUILD_SOURCEBRANCH"      # Azure DevOps (the full ref, not BUILD_SOURCEBRANCHNAME)
+datasecops pipeline env --target unit-test                  # a named target
+```
+
+Pass the branch through the runner's environment variable, not a `${{ ... }}` / `$(...)` expression:
+those are substituted into the script before the shell runs, so a branch name containing `$(...)`
+would execute.
+
+- `--branch` matches a target's **Branch**, then a target named like the branch; `refs/heads/` is
+  ignored and a pull request's merge ref resolves to its source branch (`$GITHUB_HEAD_REF` on GitHub,
+  `$SYSTEM_PULLREQUEST_SOURCEBRANCH` on Azure DevOps). On Azure DevOps pass `$BUILD_SOURCEBRANCH`:
+  `$BUILD_SOURCEBRANCHNAME` is only the last part of the ref (`release/prod` -> `prod`).
+  Exact names win; a case-insensitive match is used only when it is unambiguous.
+- GitHub Actions: the values are appended to `$GITHUB_ENV`. Azure DevOps: they are set with
+  `##vso[task.setvariable]`. Elsewhere (or `--format shell`) they are printed as shell-quoted `KEY=value` lines.
+- A target with no role, warehouse or schema leaves that variable as it is.
+- The command connects with `.datasecops.yml`'s connection, so the CI user needs the `orbit_developer`
+  application role. It exits `1` when no target matches.
+
 ## DCM projects
 
 ```bash

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datasecops-cli"
-version = "0.7.0b4"
+version = "0.7.0b5"
 description = "DataSecOps Framework CLI for Snowflake Native App"
 readme = "README.md"
 requires-python = ">=3.10"

datasecops_cli-0.7.0b5/src/datasecops_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.7.0b5"

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/src/datasecops_cli/config.py

@@ -23,8 +23,9 @@ class Config:
         self.dbt_project_dir: Path = Path.cwd()
         self.profile_name: str = ""
     
-    def load(self, project_dir: Path = None) -> bool:
-        """Load configuration from .datasecops.yml and dbt_project.yml."""
+    def load(self, project_dir: Path = None, connection_name: Optional[str] = None) -> bool:
+        """Load configuration from .datasecops.yml and dbt_project.yml. `connection_name`
+        (a --connection option) overrides the file's and may stand in for a missing one."""
         self.project_dir = project_dir or Path.cwd()
         
         # Load .datasecops.yml
@@ -54,6 +55,8 @@ class Config:
             warning_line(f"Invalid dbt_engine '{self.datasecops.dbt_engine}' in .datasecops.yml — falling back to dbt_core")
             self.datasecops.dbt_engine = "dbt_core"
         
+        if connection_name:
+            self.datasecops.connection_name = connection_name
         if not self.datasecops.connection_name or not self.datasecops.app_database:
             error_line(".datasecops.yml is missing connection_name or app_database.")
             return False

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/src/datasecops_cli/main.py

@@ -17,7 +17,8 @@ from datasecops_cli.services.download_service import DownloadService
 from datasecops_cli.services.skill_service import SkillService
 from datasecops_cli.services.bootstrap_service import BootstrapService
 from datasecops_cli.services.dcm_service import DcmService
-from datasecops_cli.services import dcm_registry, model_commands
+from datasecops_cli.services import dcm_registry, model_commands, pipeline_env
+from datasecops_cli.models.project_config import DbtTarget
 from datasecops_cli.menus.development import DevelopmentMenu
 from datasecops_cli.menus.git_operations import GitOperationsMenu
 from datasecops_cli.menus.downloads import DownloadsMenu
@@ -239,6 +240,55 @@ def dcm_pipelines_cmd(platform, names, force, projects, connection):
         sf_service.close()
 
 
+# ── pipeline commands ──────────────────────────────────────────────────────
+
+
+@cli.group()
+def pipeline():
+    """Helpers for CI/CD pipelines."""
+
+
+@pipeline.command("env")
+@click.option("--branch", "-b", default=None,
+              help="Branch being built: picks the dbt target mapped to it (a GitHub pull request's "
+                   "<n>/merge ref resolves to its source branch)")
+@click.option("--target", "-t", default=None, help="dbt target name (instead of --branch)")
+@click.option("--connection", "-c", default=None, help="Snowflake connection name (overrides .datasecops.yml)")
+@click.option("--format", "fmt", type=click.Choice(["auto", *pipeline_env.PLATFORMS]), default="auto",
+              show_default=True, help="auto: GitHub when $GITHUB_ENV is set, Azure DevOps when $TF_BUILD is set")
+def pipeline_env_cmd(branch: Optional[str], target: Optional[str], connection: Optional[str], fmt: str):
+    """Set TARGET, SF_ROLE, SF_WAREHOUSE and TARGET_SCHEMA from the app's dbt Targets.
+
+    GitHub Actions: appended to $GITHUB_ENV. Azure DevOps: set with ##vso logging commands.
+    Otherwise printed as KEY=value. Empty role / warehouse / schema values are left unset.
+    """
+    if bool(branch) == bool(target):
+        raise click.UsageError("give exactly one of --branch or --target")
+    config = Config()
+    if not config.load(connection_name=connection):
+        sys.exit(1)
+    sf_service = SnowflakeService(config.datasecops)
+    try:
+        raw = sf_service.get_framework_config("PROJECT") or {}
+    except Exception as e:  # noqa: BLE001 - connector errors
+        error_line(f"Failed to read the dbt targets from {config.datasecops.app_database}: {e}")
+        sys.exit(1)
+    finally:
+        sf_service.close()
+    targets = [DbtTarget(**{k: v for k, v in t.items() if k in DbtTarget.model_fields})
+               for t in raw.get("targets") or []]
+    try:
+        resolved = pipeline_env.resolve_target(targets, branch=branch, target=target)
+    except pipeline_env.TargetNotFound as e:
+        error_line(str(e))
+        sys.exit(1)
+    values = pipeline_env.env_values(resolved)
+    platform = pipeline_env.detect_platform() if fmt == "auto" else fmt
+    for line in pipeline_env.export(values, platform):
+        click.echo(line)
+    click.echo("dbt environment: " + ", ".join(f"{k}={v}" for k, v in values.items()), err=True)
+
+
 # ── model commands ─────────────────────────────────────────────────────────
 
 

datasecops_cli-0.7.0b5/src/datasecops_cli/services/pipeline_env.py

@@ -0,0 +1,93 @@
+"""Resolve a pipeline run's dbt environment (target, role, warehouse, schema) from the dbt Targets.
+
+The dbt Targets (Settings > Data > dbt Targets in the native app) map branches to targets and give
+each target its role, warehouse and schema. Pipelines call `datasecops pipeline env` instead of
+hard-coding them, so a change in the app applies without regenerating the pipelines.
+"""
+from __future__ import annotations
+
+import os
+import re
+import shlex
+from typing import Optional
+
+from datasecops_cli.models.project_config import DbtTarget
+
+PLATFORMS = ("github", "azure", "shell")
+
+
+class TargetNotFound(ValueError):
+    pass
+
+
+def _pick(entries: list[DbtTarget], key, value: str) -> Optional[DbtTarget]:
+    """An exact match first; a case-insensitive one only when it is unambiguous."""
+    exact = [t for t in entries if key(t) and key(t) == value]
+    if exact:
+        return exact[0]
+    loose = [t for t in entries if key(t) and key(t).lower() == value.lower()]
+    return loose[0] if len(loose) == 1 else None
+
+
+def branch_name(branch: str) -> str:
+    """The branch to look up: without refs/heads/, and for a pull request's merge ref (GitHub
+    `<number>/merge`, Azure DevOps `refs/pull/<number>/merge`) the pull request's source branch
+    ($GITHUB_HEAD_REF / $SYSTEM_PULLREQUEST_SOURCEBRANCH)."""
+    name = branch.removeprefix("refs/heads/")
+    if re.fullmatch(r"(refs/pull/)?\d+/merge", name):
+        source = os.environ.get("GITHUB_HEAD_REF") or os.environ.get("SYSTEM_PULLREQUEST_SOURCEBRANCH")
+        if source:
+            return source.removeprefix("refs/heads/")
+    return name
+
+
+def resolve_target(targets: list[DbtTarget], branch: Optional[str] = None,
+                   target: Optional[str] = None) -> DbtTarget:
+    """`target` matches a target name; `branch` matches a target's branch, then a target named
+    like the branch (the convention before branches were mapped). Exact matches win; a
+    case-insensitive match is used only when exactly one target has it."""
+    if not target and not branch:
+        raise TargetNotFound("give --branch or --target")
+    if target:
+        found = _pick(targets, lambda t: t.target_name, target)
+    else:
+        name = branch_name(branch)
+        found = _pick(targets, lambda t: t.branch_name, name) or _pick(targets, lambda t: t.target_name, name)
+    if found is None:
+        known = ", ".join(f"{t.target_name} (branch {t.branch_name})" if t.branch_name else t.target_name
+                          for t in targets) or "none"
+        wanted = f"target '{target}'" if target else f"branch '{branch}'"
+        raise TargetNotFound(f"no dbt target for {wanted}; configured targets: {known}")
+    return found
+
+
+def env_values(t: DbtTarget) -> dict[str, str]:
+    """Variables for the target. An empty role / warehouse / schema is left out, so the
+    pipeline's own (CI) value stays in place."""
+    values = {"TARGET": t.target_name, "SF_ROLE": t.target_role,
+              "SF_WAREHOUSE": t.target_warehouse, "TARGET_SCHEMA": t.target_schema}
+    return {k: v for k, v in values.items() if v}
+
+
+def detect_platform() -> str:
+    if os.environ.get("GITHUB_ENV"):
+        return "github"
+    if os.environ.get("TF_BUILD"):
+        return "azure"
+    return "shell"
+
+
+def export(values: dict[str, str], platform: str) -> list[str]:
+    """Write the values for the platform: GitHub appends them to $GITHUB_ENV, Azure DevOps sets
+    them with logging commands, otherwise shell-quoted KEY=value lines. Returns the lines to print."""
+    for k, v in values.items():
+        if "\n" in v or "\r" in v:
+            raise ValueError(f"{k} contains a newline")
+    if platform == "github":
+        with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
+            f.writelines(f"{k}={v}\n" for k, v in values.items())
+        return []
+    if platform == "azure":
+        # The agent decodes %AZP25 / %0A / %0D in logging commands: encode % so values stay literal.
+        return [f"##vso[task.setvariable variable={k}]{v.replace('%', '%AZP25')}" for k, v in values.items()]
+    return [f"{k}={shlex.quote(v)}" for k, v in values.items()]

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/src/datasecops_cli/services/snowflake_service.py

@@ -1,4 +1,5 @@
 import json
+import re
 from typing import Any, Optional
 import snowflake.connector
 
@@ -31,6 +32,19 @@ def get_connection_params(connection_name: str) -> dict[str, Any]:
         return {}
 
 
+_PLAIN_IDENTIFIER = re.compile(r"[A-Za-z_][A-Za-z0-9_$]*")
+_QUOTED_IDENTIFIER = re.compile(r'"(?:[^"]|"")+"')
+
+
+def app_database_identifier(name: str) -> str:
+    """The app database as a SQL identifier: a plain name or one double-quoted name. It is
+    interpolated into CALL statements, so anything else (dots, spaces, SQL) is rejected."""
+    name = (name or "").strip()
+    if _PLAIN_IDENTIFIER.fullmatch(name) or _QUOTED_IDENTIFIER.fullmatch(name):
+        return name
+    raise ValueError(f"app_database must be a single Snowflake identifier, got {name!r}")
+
+
 class SnowflakeService:
     """Connects to Snowflake and calls native app API procedures."""
     
@@ -65,7 +79,7 @@ class SnowflakeService:
     def call_procedure(self, proc_name: str, *args) -> Any:
         if proc_name not in ALLOWED_PROCEDURES:
             raise ValueError(f"Unknown native app procedure: {proc_name}")
-        db = self.config.app_database
+        db = app_database_identifier(self.config.app_database)
         arg_placeholders = ", ".join(["%s"] * len(args))
         sql = f"CALL {db}.api.{proc_name}({arg_placeholders})"
         rows = self.execute_query(sql, list(args))

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/src/datasecops_mcp/connection.py

@@ -11,13 +11,16 @@ from typing import Any, Optional
 import snowflake.connector
 import yaml
 
+from datasecops_cli.services.snowflake_service import app_database_identifier
+
 
 class MCPSnowflakeService:
     """Lightweight Snowflake service for the MCP server."""
 
     def __init__(self, connection_name: str, app_database: str):
         self.connection_name = connection_name
-        self.app_database = app_database
+        # Interpolated into CALL statements: must be a single identifier.
+        self.app_database = app_database_identifier(app_database)
         self._conn: Optional[snowflake.connector.SnowflakeConnection] = None
 
     @property

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/tests/test_config.py

@@ -42,6 +42,13 @@ class TestConfigLoad:
         result = config.load(project_dir=tmp_path)
         assert result is False
 
+    def test_load_connection_override_fills_missing_connection_name(self, tmp_path):
+        (tmp_path / ".datasecops.yml").write_text("connection_name: ''\napp_database: MYDB\n", encoding="utf-8")
+
+        config = Config()
+        assert config.load(project_dir=tmp_path, connection_name="ci") is True
+        assert config.datasecops.connection_name == "ci"
+
     def test_load_missing_app_database(self, tmp_path):
         """Config.load() fails when app_database is empty string."""
         (tmp_path / ".datasecops.yml").write_text(

{datasecops_cli-0.7.0b4 → datasecops_cli-0.7.0b5}/tests/test_main.py

@@ -7,7 +7,7 @@ from click.testing import CliRunner
 
 from datasecops_cli.main import cli, _run_download, DOWNLOAD_ITEMS
 from datasecops_cli.config import Config
-from datasecops_cli.models.project_config import ProjectProfile
+from datasecops_cli.models.project_config import DbtTarget, ProjectProfile
 
 
 class TestCliParsing:
@@ -508,3 +508,42 @@ class TestDownloadPackageFiltering:
         import yaml
         result = yaml.safe_load((tmp_path / "packages.yml").read_text())
         assert len(result["packages"]) == 2
+
+
+class TestPipelineEnvCommand:
+    TARGETS = [
+        DbtTarget(target_name="unit-test", target_role="DATAOPS_ADMIN", target_warehouse="DEV_WH"),
+        DbtTarget(target_name="prd", branch_name="main", target_role="DATAOPS_ADMIN", target_warehouse="PRD_WH",
+                  target_schema="CORE"),
+    ]
+
+    def _invoke(self, args, project=None):
+        sf = MagicMock()
+        sf.get_framework_config.return_value = project if project is not None else {
+            "targets": [t.model_dump() for t in self.TARGETS]}
+        with patch("datasecops_cli.main.Config") as config_cls, \
+                patch("datasecops_cli.main.SnowflakeService", return_value=sf):
+            config_cls.return_value.load.return_value = True
+            self.config = config_cls.return_value
+            result = CliRunner().invoke(cli, ["pipeline", "env", *args])
+        return result, sf
+
+    def test_prints_shell_values_for_the_branch(self):
+        result, sf = self._invoke(["--branch", "main", "--format", "shell"])
+        assert result.exit_code == 0, result.output
+        assert "TARGET=prd\nSF_ROLE=DATAOPS_ADMIN\nSF_WAREHOUSE=PRD_WH\nTARGET_SCHEMA=CORE\n" in result.output
+        sf.get_framework_config.assert_called_once_with("PROJECT")
+        sf.close.assert_called_once()
+
+    def test_unknown_branch_fails(self):
+        result, _ = self._invoke(["--branch", "feature/x", "--format", "shell"])
+        assert result.exit_code == 1
+
+    def test_needs_exactly_one_of_branch_and_target(self):
+        assert self._invoke(["--format", "shell"])[0].exit_code == 2
+        assert self._invoke(["--branch", "main", "--target", "prd"])[0].exit_code == 2
+
+    def test_connection_option_is_passed_to_config_load(self):
+        result, _ = self._invoke(["--target", "prd", "--format", "shell", "--connection", "ci"])
+        assert result.exit_code == 0, result.output
+        self.config.load.assert_called_once_with(connection_name="ci")

datasecops_cli-0.7.0b5/tests/test_pipeline_env.py

@@ -0,0 +1,108 @@
+"""Tests for datasecops_cli.services.pipeline_env (the `pipeline env` Click wiring is in test_main.py)."""
+import pytest
+
+from datasecops_cli.models.project_config import DbtTarget
+from datasecops_cli.services import pipeline_env
+from datasecops_cli.services.pipeline_env import TargetNotFound, env_values, export, resolve_target
+
+TARGETS = [
+    DbtTarget(target_name="unit-test", target_role="DATAOPS_ADMIN", target_warehouse="DEV_WH"),
+    DbtTarget(target_name="dev", branch_name="develop", target_role="DEVELOPERS", target_warehouse="DEV_WH"),
+    DbtTarget(target_name="prd", branch_name="main", target_role="DATAOPS_ADMIN", target_warehouse="PRD_WH",
+              target_schema="CORE"),
+    DbtTarget(target_name="test", target_role="", target_warehouse=""),
+]
+
+
+class TestResolveTarget:
+    def test_branch_uses_the_mapped_branch(self):
+        assert resolve_target(TARGETS, branch="main").target_name == "prd"
+        assert resolve_target(TARGETS, branch="refs/heads/develop").target_name == "dev"
+
+    def test_branch_falls_back_to_a_target_named_like_it(self):
+        assert resolve_target(TARGETS, branch="TEST").target_name == "test"
+
+    def test_explicit_target(self):
+        assert resolve_target(TARGETS, target="Unit-Test").target_name == "unit-test"
+
+    def test_unknown_branch_lists_the_targets(self):
+        with pytest.raises(TargetNotFound, match="prd \\(branch main\\)"):
+            resolve_target(TARGETS, branch="feature/x")
+
+    def test_exact_case_wins_and_ambiguous_case_matches_nothing(self):
+        targets = [DbtTarget(target_name="Prod", target_role="A"), DbtTarget(target_name="prod", target_role="B")]
+        assert resolve_target(targets, target="Prod").target_role == "A"
+        assert resolve_target(targets, target="prod").target_role == "B"
+        with pytest.raises(TargetNotFound):
+            resolve_target(targets, target="PROD")
+
+    def test_pull_request_merge_ref_uses_the_source_branch(self, monkeypatch):
+        monkeypatch.setenv("GITHUB_HEAD_REF", "develop")
+        assert resolve_target(TARGETS, branch="42/merge").target_name == "dev"
+        assert resolve_target(TARGETS, branch="refs/pull/42/merge").target_name == "dev"
+
+    def test_azure_pull_request_ref_uses_the_source_branch(self, monkeypatch):
+        monkeypatch.delenv("GITHUB_HEAD_REF", raising=False)
+        monkeypatch.setenv("SYSTEM_PULLREQUEST_SOURCEBRANCH", "refs/heads/develop")
+        assert resolve_target(TARGETS, branch="refs/pull/7/merge").target_name == "dev"
+
+    def test_branch_with_slashes_keeps_its_full_name(self):
+        targets = [DbtTarget(target_name="prod", branch_name="release/prod"), DbtTarget(target_name="other", branch_name="prod")]
+        assert resolve_target(targets, branch="refs/heads/release/prod").target_name == "prod"
+
+    def test_needs_branch_or_target(self):
+        with pytest.raises(TargetNotFound):
+            resolve_target(TARGETS)
+
+
+class TestExport:
+    def test_values_leave_out_empty_settings(self):
+        assert env_values(TARGETS[2]) == {"TARGET": "prd", "SF_ROLE": "DATAOPS_ADMIN",
+                                          "SF_WAREHOUSE": "PRD_WH", "TARGET_SCHEMA": "CORE"}
+        assert env_values(TARGETS[3]) == {"TARGET": "test", "TARGET_SCHEMA": "PUBLIC"}
+
+    def test_azure_and_shell_lines(self):
+        values = {"TARGET": "prd", "SF_ROLE": "R"}
+        assert export(values, "azure") == ["##vso[task.setvariable variable=TARGET]prd",
+                                           "##vso[task.setvariable variable=SF_ROLE]R"]
+        assert export(values, "shell") == ["TARGET=prd", "SF_ROLE=R"]
+
+    def test_shell_values_are_quoted(self):
+        assert export({"SF_ROLE": "$(touch x) ok"}, "shell") == ["SF_ROLE='$(touch x) ok'"]
+
+    def test_azure_encodes_percent_so_escapes_stay_literal(self):
+        assert export({"TARGET": "build%0Aarchive"}, "azure") == [
+            "##vso[task.setvariable variable=TARGET]build%AZP250Aarchive"]
+
+    def test_github_appends_to_github_env(self, tmp_path, monkeypatch):
+        env_file = tmp_path / "github_env"
+        env_file.write_text("EXISTING=1\n")
+        monkeypatch.setenv("GITHUB_ENV", str(env_file))
+        assert export({"TARGET": "prd"}, "github") == []
+        assert env_file.read_text() == "EXISTING=1\nTARGET=prd\n"
+
+    def test_rejects_newlines(self):
+        with pytest.raises(ValueError):
+            export({"SF_ROLE": "A\nB=1"}, "shell")
+
+    def test_detect_platform(self, monkeypatch):
+        monkeypatch.delenv("GITHUB_ENV", raising=False)
+        monkeypatch.delenv("TF_BUILD", raising=False)
+        assert pipeline_env.detect_platform() == "shell"
+        monkeypatch.setenv("TF_BUILD", "True")
+        assert pipeline_env.detect_platform() == "azure"
+        monkeypatch.setenv("GITHUB_ENV", "/tmp/x")
+        assert pipeline_env.detect_platform() == "github"
+
+
+class TestAppDatabaseIdentifier:
+    @pytest.mark.parametrize("name", ["MONITORIAL_ORBIT", '"MONITORIAL_ORBIT"', '"My ""App"""', "app$1"])
+    def test_accepts_one_identifier(self, name):
+        from datasecops_cli.services.snowflake_service import app_database_identifier
+        assert app_database_identifier(name) == name
+
+    @pytest.mark.parametrize("name", ["", "DB.api.x", "DB; drop table t", "DB --", '"A"."B"', "1DB"])
+    def test_rejects_anything_else(self, name):
+        from datasecops_cli.services.snowflake_service import app_database_identifier
+        with pytest.raises(ValueError):
+            app_database_identifier(name)

datasecops_cli-0.7.0b4/src/datasecops_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.7.0b4"