deployforge 0.1.0__py3-none-any.whl

deployforge/config.py

@@ -0,0 +1,195 @@
+"""Configuration management for DeployForge.
+
+Two layers:
+
+* **Project configuration** — ``.deployforge/config.yml`` inside the project.
+  Never contains secrets.
+* **User configuration** — stored in the platform user config directory
+  (e.g. ``~/.config/deployforge/config.yml``). Provider credentials are kept
+  in the OS keyring, never in the config file.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml
+from platformdirs import user_config_dir
+
+from deployforge.errors import ConfigError
+
+logger = logging.getLogger("deployforge")
+
+PROJECT_CONFIG_DIR = ".deployforge"
+PROJECT_CONFIG_FILE = "config.yml"
+
+DEFAULT_BRANCH = "main"
+DEFAULT_FRONTEND_PROVIDER = "vercel"
+DEFAULT_BACKEND_PROVIDER = "render"
+DEFAULT_PLAN = "starter"
+
+VERCEL_TOKEN_ENV_NAMES = ("DEPLOYFORGE_VERCEL_TOKEN", "VERCEL_TOKEN")
+RENDER_KEY_ENV_NAMES = ("DEPLOYFORGE_RENDER_API_KEY", "RENDER_API_KEY")
+
+
+@dataclass
+class ProjectConfig:
+    """Validated rich representation of ``.deployforge/config.yml``."""
+
+    version: int = 1
+    name: str | None = None
+    github_repository: str | None = None
+    branch: str = DEFAULT_BRANCH
+    frontend_provider: str = DEFAULT_FRONTEND_PROVIDER
+    frontend_directory: str | None = None
+    backend_provider: str = DEFAULT_BACKEND_PROVIDER
+    backend_directory: str | None = None
+    auto_connect: bool = True
+    security_enabled: bool = True
+    block_on_secrets: bool = True
+    plan: str = DEFAULT_PLAN
+
+    def public(self) -> dict[str, Any]:
+        return {k: v for k, v in asdict(self).items()}
+
+
+def default_config_path() -> Path:
+    return Path(user_config_dir("deployforge", "deployforge")) / "config.yml"
+
+
+def default_data_dir() -> Path:
+    from platformdirs import user_data_dir
+
+    return Path(user_data_dir("deployforge", "deployforge"))
+
+
+def project_config_path(project: Path) -> Path:
+    return project / PROJECT_CONFIG_DIR / PROJECT_CONFIG_FILE
+
+
+def _load_yml(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    try:
+        with path.open("r", encoding="utf-8") as fh:
+            data = yaml.safe_load(fh) or {}
+    except (OSError, yaml.YAMLError) as exc:
+        raise ConfigError(f"Unable to read configuration file {path}: {exc}") from exc
+    if not isinstance(data, dict):
+        raise ConfigError(f"Invalid configuration file {path}: expected a mapping.")
+    return data
+
+
+def _filter_known(data: dict[str, Any], cls: type[Any]) -> dict[str, Any]:
+    fields = set(cls.__dataclass_fields__)  # type: ignore[attr-defined]
+    return {k: v for k, v in data.items() if k in fields and v is not None}
+
+
+class ProjectConfigManager:
+    """Reads and writes ``.deployforge/config.yml`` for a project."""
+
+    def __init__(self, project: Path) -> None:
+        self.project = project
+        self.path = project_config_path(project)
+
+    def load(self) -> ProjectConfig:
+        data = _load_yml(self.path)
+        config = ProjectConfig()
+        for key, value in _filter_known(data, ProjectConfig).items():
+            setattr(config, key, value)
+        return config
+
+    def save(self, config: ProjectConfig) -> None:
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        data = {k: v for k, v in config.public().items() if v is not None}
+        try:
+            with self.path.open("w", encoding="utf-8") as fh:
+                yaml.safe_dump(data, fh, sort_keys=False)
+        except OSError as exc:
+            raise ConfigError(f"Unable to write configuration file {self.path}: {exc}") from exc
+
+    def update(self, **kwargs: Any) -> ProjectConfig:
+        config = self.load()
+        for key, value in kwargs.items():
+            if not hasattr(config, key):
+                raise ConfigError(f"Unknown configuration option: {key}")
+            setattr(config, key, value)
+        self.save(config)
+        return config
+
+
+class KeyringSecrets:
+    """OS-keyring backed credential storage (never inside a project)."""
+
+    SERVICE = "deployforge"
+
+    def __init__(self, keyring_backend: Any | None = None) -> None:
+        self.keyring = keyring_backend if keyring_backend is not None else self._load_keyring()
+
+    @staticmethod
+    def _load_keyring() -> Any:
+        try:
+            import keyring
+        except Exception:
+            return None
+        try:
+            return keyring.get_keyring()
+        except Exception:
+            return None
+
+    def _store(self, key: str, value: str) -> bool:
+        if self.keyring is None:
+            return False
+        try:
+            self.keyring.set_password(self.SERVICE, key, value)
+            return True
+        except Exception:
+            return False
+
+    def set_vercel_token(self, token: str) -> bool:
+        return self._store("vercel_token", token)
+
+    def set_render_api_key(self, key: str) -> bool:
+        return self._store("render_api_key", key)
+
+    def get_vercel_token(self) -> str | None:
+        return self._get("vercel_token")
+
+    def get_render_api_key(self) -> str | None:
+        return self._get("render_api_key")
+
+    def _get(self, key: str) -> str | None:
+        if self.keyring is None:
+            return None
+        try:
+            return self.keyring.get_password(self.SERVICE, key) or None
+        except Exception:
+            return None
+
+    def clear(self, key: str) -> None:
+        if self.keyring is None:
+            return
+        try:
+            self.keyring.delete_password(self.SERVICE, key)
+        except Exception:
+            logger.debug("No stored credential to delete for %s", key)
+
+
+def _first_env(names: tuple[str, ...]) -> str | None:
+    for name in names:
+        value = os.environ.get(name)
+        if value and value.strip():
+            return value.strip()
+    return None
+
+
+def resolve_vercel_token(secrets: KeyringSecrets | None = None) -> str | None:
+    return _first_env(VERCEL_TOKEN_ENV_NAMES) or (secrets.get_vercel_token() if secrets else None)
+
+
+def resolve_render_api_key(secrets: KeyringSecrets | None = None) -> str | None:
+    return _first_env(RENDER_KEY_ENV_NAMES) or (secrets.get_render_api_key() if secrets else None)

deployforge/deployment/__init__.py

@@ -0,0 +1,19 @@
+from deployforge.deployment.orchestrator import DeployOutcome, run_deploy
+from deployforge.deployment.planner import DeploymentPlan, build_plan
+from deployforge.deployment.verifier import (
+    VerificationReport,
+    VerificationResult,
+    check_url,
+    verify_endpoints,
+)
+
+__all__ = [
+    "DeployOutcome",
+    "DeploymentPlan",
+    "VerificationReport",
+    "VerificationResult",
+    "build_plan",
+    "check_url",
+    "run_deploy",
+    "verify_endpoints",
+]

deployforge/deployment/orchestrator.py

@@ -0,0 +1,331 @@
+"""Deployment orchestration.
+
+Runs the ordered deployment pipeline:
+
+    analyze → security → backend → frontend env → frontend → backend CORS → verify
+
+Partial failures are reported accurately instead of claiming success.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from deployforge.analyzer.project import ProjectAnalysis
+from deployforge.config import default_data_dir
+from deployforge.deployment.planner import DeploymentPlan
+from deployforge.deployment.verifier import VerificationReport, verify_endpoints
+from deployforge.errors import (
+    AuthenticationError,
+    DeploymentError,
+    PartialDeploymentError,
+    ProjectError,
+    ProviderError,
+    SecurityError,
+)
+from deployforge.providers.base import DeploymentProvider, DeploymentResult
+from deployforge.security import scan_project
+
+StepCallback = Callable[[str], None]
+ConfirmCallback = Callable[[str], bool] | None
+
+
+@dataclass
+class DeployOutcome:
+    dry_run: bool = False
+    frontend: DeploymentResult | None = None
+    backend: DeploymentResult | None = None
+    frontend_url: str | None = None
+    backend_url: str | None = None
+    env_vars_set: list[tuple[str, str]] = field(default_factory=list)
+    verification: VerificationReport | None = None
+    warnings: list[str] = field(default_factory=list)
+
+
+def _record(outcome: DeployOutcome) -> None:
+    """Append to the local deployment log (never stores secrets)."""
+    try:
+        log_dir = default_data_dir()
+        log_dir.mkdir(parents=True, exist_ok=True)
+        log_path = log_dir / "deployments.jsonl"
+        entry: dict[str, Any] = {
+            "time": int(time.time()),
+            "dry_run": outcome.dry_run,
+            "frontend_url": outcome.frontend_url,
+            "backend_url": outcome.backend_url,
+        }
+        for kind, result in (("frontend", outcome.frontend), ("backend", outcome.backend)):
+            if result is not None:
+                entry[f"{kind}_provider"] = result.provider
+                entry[f"{kind}_id"] = result.service_id
+                entry[f"{kind}_name"] = result.project_name
+        with log_path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(entry) + "\n")
+    except OSError:
+        pass
+
+
+def _require_auth(provider: DeploymentProvider, name: str) -> None:
+    auth = provider.authenticate()
+    if not auth.authenticated:
+        raise AuthenticationError(
+            f"{name} authentication is not configured. Set the provider API token "
+            "or run 'deployforge config' to store it securely."
+        )
+
+
+def _repo_slug(analysis: ProjectAnalysis) -> str:
+    slug = analysis.repo.slug()
+    if not slug:
+        raise ProjectError(
+            "No GitHub repository detected.\n\n"
+            "DeployForge works best with PushForge.\n\n"
+            "You can run:\n\n"
+            "    pushforge\n\n"
+            "Then return here and run:\n\n"
+            "    deployforge"
+        )
+    return slug
+
+
+def _relative_dir(root: Path, directory: Path) -> str | None:
+    try:
+        rel = directory.relative_to(root)
+    except ValueError:
+        return None
+    if rel == Path("."):
+        return None
+    return rel.as_posix()
+
+
+def _deploy_backend(
+    analysis: ProjectAnalysis,
+    plan: DeploymentPlan,
+    providers: dict[str, DeploymentProvider],
+    confirm: ConfirmCallback,
+    non_interactive: bool,
+    on_step: StepCallback,
+    timeout: int,
+    plan_name: str,
+) -> DeploymentResult | None:
+    backend = analysis.backend
+    if backend is None:
+        return None
+    on_step(f"Backend: {backend.framework} → {backend.provider}")
+
+    provider = providers[backend.provider]
+    label = next(s.label for s in plan.services if s.kind == "backend")
+    _require_auth(provider, backend.provider.title())
+
+    create: dict[str, Any] = dict(
+        name=label,
+        repo=_repo_slug(analysis),
+        runtime=backend.language or "python",
+        root_directory=_relative_dir(analysis.root, backend.directory),
+        build_command=backend.build_command,
+        start_command=backend.start_command,
+        health_check_path=backend.health_path,
+        branch=analysis.repo.branch or "main",
+        plan=plan_name,
+    )
+    on_step("Creating backend service…")
+    result = provider.create_project(**create)
+    on_step("Deploying backend…")
+    result = provider.deploy(result, ref=analysis.repo.branch or "main")
+    status = provider.poll_until_ready(
+        result, timeout=timeout, on_progress=lambda s: on_step(f"Backend status: {s.state}")
+    )
+    if status.state in {"error", "canceled"}:
+        raise DeploymentError(f"Backend deployment failed: {status.message or 'unknown error'}")
+    if status.url:
+        result.url = status.url
+        result.status = "ready"
+    return result
+
+
+def _deploy_frontend(
+    analysis: ProjectAnalysis,
+    plan: DeploymentPlan,
+    providers: dict[str, DeploymentProvider],
+    confirm: ConfirmCallback,
+    non_interactive: bool,
+    on_step: StepCallback,
+    timeout: int,
+    backend_url: str | None,
+) -> tuple[DeploymentResult | None, list[tuple[str, str]]]:
+    frontend = analysis.frontend
+    if frontend is None:
+        return None, []
+    on_step(f"Frontend: {frontend.framework} → {frontend.provider}")
+
+    provider = providers[frontend.provider]
+    _require_auth(provider, frontend.provider.title())
+
+    frontend_result = provider.create_project(
+        name=analysis.name,
+        repo=_repo_slug(analysis),
+        directory=_relative_dir(analysis.root, frontend.directory),
+        framework=frontend.framework,
+    )
+
+    envs: list[tuple[str, str]] = []
+    if backend_url:
+        api_var = next((e.key for e in plan.env_vars if e.applies_to == "frontend"), None)
+        if api_var:
+            message = f"Set {api_var}={backend_url} on {frontend.provider}?"
+            if non_interactive or (confirm and confirm(message)):
+                on_step(f"Configuring environment: {api_var}")
+                provider.set_env(frontend_result, api_var, backend_url)
+                envs = [(api_var, backend_url)]
+
+    on_step("Deploying frontend…")
+    frontend_result = provider.deploy(frontend_result, ref=analysis.repo.branch or "main")
+    status = provider.poll_until_ready(
+        frontend_result,
+        timeout=timeout,
+        on_progress=lambda s: on_step(f"Frontend status: {s.state}"),
+    )
+    if status.state in {"error", "canceled"}:
+        raise DeploymentError(f"Frontend deployment failed: {status.message or 'unknown error'}")
+    if status.url:
+        frontend_result.url = status.url
+        frontend_result.status = "ready"
+    return frontend_result, envs
+
+
+def _set_backend_cors(
+    analysis: ProjectAnalysis,
+    plan: DeploymentPlan,
+    providers: dict[str, DeploymentProvider],
+    backend: DeploymentResult,
+    frontend_url: str,
+    on_step: StepCallback,
+) -> bool:
+    cors_var = next((e.key for e in plan.env_vars if e.applies_to == "backend"), None)
+    if not cors_var or analysis.backend is None:
+        return False
+    provider = providers[analysis.backend.provider]
+    on_step(f"Configuring backend CORS: {cors_var}")
+    provider.set_env(backend, cors_var, frontend_url)
+    return True
+
+
+def run_deploy(
+    analysis: ProjectAnalysis,
+    plan: DeploymentPlan,
+    providers: dict[str, DeploymentProvider],
+    *,
+    security_enabled: bool = True,
+    block_on_secrets: bool = True,
+    security_level: str = "normal",
+    dry_run: bool = False,
+    non_interactive: bool = False,
+    confirm: ConfirmCallback = None,
+    on_step: StepCallback = lambda _m: None,
+    timeout: int = 900,
+    plan_name: str = "starter",
+) -> DeployOutcome:
+    """Execute the deployment pipeline for an analyzed project."""
+    outcome = DeployOutcome(dry_run=dry_run, warnings=[])
+
+    if security_enabled:
+        on_step("Running security preflight…")
+        report = scan_project(analysis.root, level=security_level)
+        if report.high_confidence and block_on_secrets and not dry_run:
+            files = ", ".join(sorted({f.file for f in report.findings}))
+            raise SecurityError(
+                "Security preflight blocked this deployment.\n"
+                f"Potential secret(s) detected in: {files}\n\n"
+                "DeployForge will not deploy projects that leak credentials.\n"
+                "Fix the issue and retry."
+            )
+        if not report.high_confidence:
+            on_step(f"Security preflight passed ({len(report.findings)} low-confidence findings)")
+
+    if dry_run:
+        return outcome
+
+    succeeded: list[str] = []
+    backend: DeploymentResult | None = None
+    frontend: DeploymentResult | None = None
+    envs: list[tuple[str, str]] = []
+
+    try:
+        backend = _deploy_backend(
+            analysis,
+            plan,
+            providers,
+            confirm,
+            non_interactive,
+            on_step,
+            timeout,
+            plan_name,
+        )
+        if backend:
+            succeeded.append("backend")
+            outcome.backend = backend
+            outcome.backend_url = backend.url
+
+        frontend, envs = _deploy_frontend(
+            analysis,
+            plan,
+            providers,
+            confirm,
+            non_interactive,
+            on_step,
+            timeout,
+            outcome.backend_url,
+        )
+        if frontend:
+            succeeded.append("frontend")
+            outcome.frontend = frontend
+            outcome.frontend_url = frontend.url
+
+        outcome.env_vars_set = envs
+
+        if (
+            backend
+            and outcome.frontend_url
+            and _set_backend_cors(
+                analysis,
+                plan,
+                providers,
+                backend,
+                outcome.frontend_url,
+                on_step,
+            )
+        ):
+            succeeded.append("cors")
+
+        outcomes: list[tuple[str, str, str | None]] = []
+        if outcome.frontend_url:
+            outcomes.append(("Frontend", outcome.frontend_url, None))
+        if outcome.backend_url:
+            health = analysis.backend.health_path if analysis.backend else None
+            outcomes.append(("Backend", outcome.backend_url, health))
+        if outcomes:
+            on_step("Verifying deployments…")
+            outcome.verification = verify_endpoints(outcomes)
+
+        _record(outcome)
+        return outcome
+
+    except (DeploymentError, ProviderError, AuthenticationError, ProjectError) as exc:
+        if succeeded:
+            message = "PARTIAL DEPLOYMENT\n\n"
+            if "backend" in succeeded:
+                message += f"✓ Backend deployed\n  {outcome.backend_url}\n\n"
+            if "frontend" in succeeded:
+                message += f"✓ Frontend deployed\n  {outcome.frontend_url}\n\n"
+            message += f"✗ {exc}\n\n"
+            message += "Remaining services stay untouched.\n"
+            message += "Run 'deployforge logs' for details."
+            _record(outcome)
+            raise PartialDeploymentError(message, succeeded) from exc
+        _record(outcome)
+        raise