doover-cli 0.3.3__tar.gz → 0.4.2__tar.gz

{doover_cli-0.3.3 → doover_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: doover-cli
-Version: 0.3.3
+Version: 0.4.2
 Summary: CLI for Doover
 License-File: LICENSE
 Requires-Python: >=3.11

{doover_cli-0.3.3 → doover_cli-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "doover-cli"
-version = "0.3.3"
+version = "0.4.2"
 description = "CLI for Doover"
 requires-python = ">=3.11"
 dependencies = [

{doover_cli-0.3.3 → doover_cli-0.4.2}/src/doover_cli/api/session.py

@@ -45,6 +45,33 @@ class DooverCLISession:
             auth=auth,
         )
 
+    @classmethod
+    def from_trusted_publisher(
+        cls,
+        *,
+        provider: str = "GH",
+        oidc_token: str | None = None,
+        audience: str | None = None,
+        control_base_url: str | None = None,
+        timeout: float = 60.0,
+    ) -> "DooverCLISession":
+        """Build a session that publishes via the trusted-publisher OIDC flow —
+        no stored Doover secret. Inside GitHub Actions (provider 'GH' with
+        id-token permission) the OIDC token is fetched automatically."""
+        from pydoover.api.auth import TrustedPublisherAuthClient
+
+        # audience defaults to pydoover's DEFAULT_DOOVER_OIDC_AUDIENCE when unset.
+        kwargs = dict(
+            provider=provider,
+            oidc_token=oidc_token,
+            control_base_url=control_base_url,
+            timeout=timeout,
+        )
+        if audience:
+            kwargs["audience"] = audience
+        auth = TrustedPublisherAuthClient(**kwargs)
+        return cls(config_manager=None, profile_name=None, auth=auth)
+
     @classmethod
     def from_env(cls, *, timeout: float = 60.0) -> "DooverCLISession":
         token = os.environ.get("DOOVER_API_TOKEN")

{doover_cli-0.3.3 → doover_cli-0.4.2}/src/doover_cli/apps/apps.py

@@ -104,6 +104,21 @@ def _resolve_staging(staging: bool | None) -> bool:
     return ".staging." in _control_base_url()
 
 
+def _detect_git_commit(root_fp: Path) -> str:
+    """Best-effort current git commit SHA for the app dir (empty if unavailable)."""
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=root_fp,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except OSError:
+        return ""
+    return result.stdout.strip() if result.returncode == 0 else ""
+
+
 def _build_container(
     root_fp: Path, *, buildx: bool, build_args: str, image_name: str
 ) -> None:
@@ -1049,15 +1064,10 @@ def publish(
             application_id,
             root_fp,
         )
-        print("Done!")
-
-        print("Creating new lambda version release...")
-        version_response = client.applications.processor_version(
-            str(application_id),
-            body=dict(payload),
+        print(
+            "Done! Run `doover app release` to publish an immutable version of this app."
         )
-        print("Done!")
-        renderer.render(version_response or processor_response or response)
+        renderer.render(processor_response or response)
         raise typer.Exit(0)
 
     if build_container:
@@ -1079,6 +1089,77 @@ def publish(
     renderer.render(response)
 
 
+@app.command(name="release")
+def release(
+    app_fp: Annotated[
+        Path, typer.Argument(help="Path to the application directory.")
+    ] = Path(),
+    digest: Annotated[
+        str | None,
+        typer.Option(
+            help="Pushed image digest (e.g. sha256:…) for container apps. Ignored for processors."
+        ),
+    ] = None,
+    tag: Annotated[
+        str | None,
+        typer.Option(help="Optional version label (e.g. semver / image tag)."),
+    ] = None,
+    commit: Annotated[
+        str | None,
+        typer.Option(
+            help="Source git commit SHA (for browsing the code). Defaults to the repo's HEAD."
+        ),
+    ] = None,
+    notes: Annotated[str, typer.Option(help="Optional release notes.")] = "",
+    staging: Annotated[
+        bool | None,
+        typer.Option(help="Force staging mode (default: inferred from the API URL)."),
+    ] = None,
+    app_name: Annotated[
+        str | None,
+        typer.Option(help="Application name in doover_config.json."),
+    ] = None,
+    _profile: ProfileAnnotation = None,
+):
+    """Publish an immutable version (release) of an application.
+
+    Run `doover app publish` first (it updates the app's metadata + config/UI
+    schema from doover_config.json). For container apps pass the pushed image
+    --digest; for processors the lambda version is published server-side.
+    """
+    _ = _profile
+    root_fp = get_app_directory(app_fp)
+    app_config = get_app_config(root_fp, app_name=app_name)
+    resolved_staging = _resolve_staging(staging)
+
+    application_id = _get_persisted_application_id(app_config, staging=resolved_staging)
+    if application_id is None:
+        rich.print(
+            "[red]Application has not been published yet. Run `doover app publish` first.[/red]"
+        )
+        raise typer.Exit(1)
+
+    if app_config.type == "DEV" and not digest:
+        rich.print(
+            "[red]--digest is required to release a container application.[/red]"
+        )
+        raise typer.Exit(1)
+
+    resolved_commit = commit if commit is not None else _detect_git_commit(root_fp)
+
+    client, renderer = get_state()
+    with renderer.loading("Creating application version..."):
+        version = client.create_application_version(
+            application_id,
+            digest=digest,
+            tag=tag or "",
+            commit=resolved_commit or "",
+            notes=notes or "",
+        )
+    rich.print("[green]Released a new application version.[/green]")
+    renderer.render(version)
+
+
 @app.command(
     context_settings={"allow_extra_args": True, "ignore_unknown_options": True}
 )

{doover_cli-0.3.3 → doover_cli-0.4.2}/src/doover_cli/utils/api.py

@@ -8,6 +8,22 @@ from typer import Option
 from doover_cli.api import ControlClientUnavailableError, DooverCLISession
 
 
+def _trusted_publisher_provider() -> str | None:
+    """The CI provider to use for the trusted-publisher (OIDC) flow, or None.
+
+    Triggers on explicit opt-in (`DOOVER_TRUSTED_PUBLISHER`, value is the provider
+    or a truthy flag meaning GitHub), or automatically inside a GitHub Actions job
+    that has `permissions: id-token: write` — so `doover app publish` just works."""
+    explicit = os.environ.get("DOOVER_TRUSTED_PUBLISHER")
+    if explicit:
+        return "GH" if explicit.lower() in ("1", "true", "yes", "github") else explicit
+    if os.environ.get("GITHUB_ACTIONS") == "true" and os.environ.get(
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
+    ):
+        return "GH"
+    return None
+
+
 def setup_session(
     profile_name: str,
     config_manager: ConfigManager | None = None,
@@ -15,6 +31,14 @@ def setup_session(
     if os.environ.get("DOOVER_API_TOKEN"):
         return DooverCLISession.from_env()
 
+    provider = _trusted_publisher_provider()
+    if provider:
+        return DooverCLISession.from_trusted_publisher(
+            provider=provider,
+            audience=os.environ.get("DOOVER_OIDC_AUDIENCE"),
+            control_base_url=os.environ.get("DOOVER_CONTROL_API_BASE_URL"),
+        )
+
     manager = config_manager or ConfigManager(profile_name)
     manager.current_profile = profile_name
     return DooverCLISession.from_profile(profile_name, config_manager=manager)

{doover_cli-0.3.3 → doover_cli-0.4.2}/src/doover_cli/utils/apps.py

@@ -306,16 +306,20 @@ def get_app_directory(root: Path | None = None) -> Path:
 
 
 def get_uv_path() -> Path:
-    brew = Path("/opt/homebrew/bin/uv")
-    if brew.exists():
-        return brew
-
-    uv_path = Path.home() / ".local" / "bin" / "uv"
-    if not uv_path.exists():
-        raise RuntimeError(
-            "uv not found in your PATH. Please install it and try again."
-        )
-    return uv_path
+    # Prefer uv on PATH (covers CI where uv is installed to a tool cache dir),
+    # then common fixed locations.
+    found = shutil.which("uv")
+    if found:
+        return Path(found)
+
+    for candidate in (
+        Path("/opt/homebrew/bin/uv"),
+        Path.home() / ".local" / "bin" / "uv",
+    ):
+        if candidate.exists():
+            return candidate
+
+    raise RuntimeError("uv not found in your PATH. Please install it and try again.")
 
 
 def call_with_uv(

{doover_cli-0.3.3 → doover_cli-0.4.2}/tests/test_apps.py

@@ -662,7 +662,9 @@ def test_app_publish_processor_type_without_ui_skips_ui_export(monkeypatch, tmp_
     assert "export_ui_called" not in captured
     assert captured["build_script"] == ("./build.sh", tmp_path)
     assert captured["processor_source"] == ("303", {"file": package_fp})
-    assert renderer.render_calls == [{"id": 303, "versioned": True}]
+    # publish uploads the package but no longer cuts a version (that's `release`)
+    assert "processor_version" not in captured
+    assert renderer.render_calls == [{"id": 303}]
 
 
 def test_app_publish_skips_ui_export_when_config_disables_generation(
@@ -769,9 +771,7 @@ def test_app_publish_honours_explicit_staging(monkeypatch, tmp_path):
         lambda ctx, app_fp, validate_: None,
     )
 
-    result = runner.invoke(
-        app, ["app", "publish", str(tmp_path), "--staging"]
-    )
+    result = runner.invoke(app, ["app", "publish", str(tmp_path), "--staging"])
 
     assert result.exit_code == 0
     assert captured["body"]["deployment_data"] == "staging-data"
@@ -872,9 +872,7 @@ def test_app_publish_skips_build_when_requested_by_config(monkeypatch, tmp_path)
     assert renderer.render_calls == [{"id": 101}]
 
 
-def test_app_publish_processor_builds_package_and_releases_version(
-    monkeypatch, tmp_path
-):
+def test_app_publish_processor_builds_package_without_release(monkeypatch, tmp_path):
     captured = {}
     renderer = FakeRenderer()
     app_config = FakeAppConfig(app_id=303)
@@ -938,10 +936,11 @@ def test_app_publish_processor_builds_package_and_releases_version(
     assert captured["build_script"] == ("./build.sh", tmp_path)
     assert captured["application_id"] == "303"
     assert captured["body"] == {"file": package_fp}
-    assert captured["version"][0] == "303"
+    # publish uploads the package; the version is cut by `doover app release`
+    assert "version" not in captured
     assert "build_called" not in captured
     assert "push_called" not in captured
-    assert renderer.render_calls == [{"id": 303, "versioned": True}]
+    assert renderer.render_calls == [{"id": 303}]
 
 
 def test_publish_processor_package_uses_package_zip(tmp_path):

{doover_cli-0.3.3 → doover_cli-0.4.2}/tests/test_auth_unit.py

@@ -187,3 +187,49 @@ def test_session_require_agent_id_rejects_missing_value():
 
     with pytest.raises(typer.BadParameter):
         session.require_agent_id(None)
+
+
+def test_trusted_publisher_provider_detects_github_actions(monkeypatch):
+    from doover_cli.utils.api import _trusted_publisher_provider
+
+    monkeypatch.delenv("DOOVER_TRUSTED_PUBLISHER", raising=False)
+    monkeypatch.setenv("GITHUB_ACTIONS", "true")
+    monkeypatch.setenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "rt")
+
+    assert _trusted_publisher_provider() == "GH"
+
+
+def test_trusted_publisher_provider_explicit_flag(monkeypatch):
+    from doover_cli.utils.api import _trusted_publisher_provider
+
+    monkeypatch.setenv("DOOVER_TRUSTED_PUBLISHER", "1")
+
+    assert _trusted_publisher_provider() == "GH"
+
+
+def test_trusted_publisher_provider_absent(monkeypatch):
+    from doover_cli.utils.api import _trusted_publisher_provider
+
+    monkeypatch.delenv("DOOVER_TRUSTED_PUBLISHER", raising=False)
+    monkeypatch.delenv("GITHUB_ACTIONS", raising=False)
+    monkeypatch.delenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN", raising=False)
+
+    assert _trusted_publisher_provider() is None
+
+
+def test_session_from_trusted_publisher_builds_control_client():
+    from pydoover.api import auth as _auth
+
+    if not hasattr(_auth, "TrustedPublisherAuthClient"):
+        pytest.skip("installed pydoover lacks trusted-publisher support yet")
+
+    session = DooverCLISession.from_trusted_publisher(
+        provider="GH",
+        oidc_token="gh-oidc",
+        control_base_url="https://control.example",
+    )
+
+    assert session.auth.provider == "GH"
+    assert session.auth.control_base_url == "https://control.example"
+    client = session.get_control_client()
+    assert client.base_url == "https://control.example"