dr-environment 0.1.0__tar.gz

dr_environment-0.1.0/.cursor/BUGBOT.md

@@ -0,0 +1,67 @@
+# BugBot Review Instructions
+
+You are a code review bot. When reviewing pull requests in this repository, use the guideline below to identify issues and leave comments.
+
+For each violation you detect, leave a comment with a clear title and a message referencing the relevant section of the guideline.
+
+Full guideline source: https://datarobot.atlassian.net/wiki/spaces/BUZOK/pages/7305920528/REVIEW+BEFORE+COMMIT+Working+with+agentic+starter+application+and+its+components
+
+---
+
+# General guidelines
+
+The sections below are the parts of the shared "review before commit" guideline that apply here. The
+sign-off matrix and the template rules in the source cover the agentic starter application and its
+components, not this plugin.
+
+### B1. Assume public
+
+This repository is public. Therefore:
+
+- Do not include internal code, proprietary logic, or private repository references.
+- Avoid leaking internal architecture, infrastructure details, or security mechanisms.
+- Keep comments, README and any other communication language civil, polite, and free of internal references
+
+### B2. Update CHANGELOG
+
+Use past tense
+
+When CHANGELOG.md is present, and your change looks like it should be communicated with users, please add it.
+
+Do not add every change: Added .woff2 and .woff and .js files to fastapi_server/static/.gitignore is not important to our users.
+
+When bumping child components, list all the changes:
+
+```
+- Updated agent component from 11.6.3 to 11.6.10:
+  - Migrated to a new interface
+  - Refactored agent infra concurrency configuration
+  - Fixed header forwarding in LangGraph
+  - Added debugpy for debugging in IDE
+```
+
+---
+
+# Repo-specific: dr-environment
+
+The sections above come from the shared "review before commit" guideline. The following applies
+**only to this repository** (`datarobot-oss/dr-environment`).
+
+## Offline and air-gapped builds
+
+This plugin renders the execution environment that air-gapped installs build from, so a build step
+that reaches the network at deploy time is a defect rather than a slow path. When reviewing, flag:
+
+- A new fetch (`curl`, `pip install`, `uv sync`, `apk add`) in a Dockerfile fragment with no baked
+  cache, wheelhouse entry, or find-links source behind it.
+- A fetch inside a command substitution. `$(curl ...)` discards curl's exit status, so a failed
+  download still produces a green build and an image missing the tool.
+- Changes to `UV_OFFLINE`, `UV_FROZEN`, `UV_FIND_LINKS`, `UV_PYTHON_PREFERENCE`,
+  `NPM_CONFIG_OFFLINE`, or `GOPROXY` with no note on what they break offline.
+
+## Pins that ship to customers
+
+`versions.yaml`, `kernel/requirements.txt`, and `build-deps/build-requirements.txt` are baked into
+every generated image, so a bump in any of them reaches customer environments and deserves the same
+scrutiny as a runtime dependency. A `versions.yaml` `minimum-version` is interpolated unquoted into
+Dockerfile `ARG` and `RUN` lines, so it must stay a version literal.

dr_environment-0.1.0/.cursor/rules/test-convention.mdc

@@ -0,0 +1,11 @@
+---
+globs: tests/*
+alwaysApply: false
+---
+Follow GIVEN–WHEN–THEN style in tests:
+
+- GIVEN: preconditions/state
+- WHEN: the behavior under test
+- THEN: expected outcomes/assertions
+
+For background, see Martin Fowler’s article on GivenWhenThen: https://martinfowler.com/bliki/GivenWhenThen.html

dr_environment-0.1.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @datarobot-oss/buzok @datarobot-oss/mcp

dr_environment-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,6 @@
+# This repository is public. Do not put here any private DataRobot or customer's data: code, datasets, model artifacts, .etc.
+
+## Summary
+
+
+## Rationale

dr_environment-0.1.0/.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # The two pinned manifests baked into every generated image. Dependabot's uv ecosystem
+  # does not read bare requirements.txt, so these need their own pip entries.
+  - package-ecosystem: "pip"
+    directories:
+      - "/src/dr_environment/recipe/templates/docker_context/kernel"
+      - "/src/dr_environment/recipe/templates/docker_context/build-deps"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"

dr_environment-0.1.0/.github/pip-audit-ignore.txt

@@ -0,0 +1,21 @@
+# Advisory IDs the `audit` CI job skips, one per line. Blank lines and `#` comments ignored.
+#
+# The job fails on any known vulnerability in this project's closure or in either image
+# manifest's resolved closure. Most of those packages are transitive and not pinned here, so an
+# advisory published upstream can turn every open PR red before a fix is available. Listing an ID
+# here unblocks PRs while the bump is worked out; it is not a way to close a finding.
+#
+# Each entry needs the ID, why it is being skipped, and what removes it. Review on every bump.
+#
+# Format:
+#   GHSA-xxxx-xxxx-xxxx  # <package>: <why skipped> - remove when <condition>
+#
+# Example: pip-audit prints the ID and whether a fix exists:
+#
+#   Name     Version  ID                   Fix Versions
+#   -------- -------- -------------------- ------------
+#   urllib3  2.2.1    GHSA-34jh-p97f-mpxf
+#
+# No fix version, and urllib3 is transitive via datarobot, so there is nothing here to bump. Add:
+#
+#   GHSA-34jh-p97f-mpxf  # urllib3 (transitive via datarobot): no fixed release yet - remove when datarobot pins a fixed urllib3

dr_environment-0.1.0/.github/workflows/changelog-check.yml

@@ -0,0 +1,22 @@
+name: Changelog
+
+# Fails a pull request that did not update CHANGELOG.md, bots included: a dependency
+# bump can change what ships. Waivable with the `skip-changelog` label.
+
+# `labeled` and `unlabeled` are listed because naming any type replaces the defaults.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    uses: datarobot-oss/github-actions/.github/workflows/check-changelog.yaml@0.0.24
+    permissions:
+      contents: read
+    with:
+      changelog_path: CHANGELOG.md
+      skip_label: skip-changelog
+      skip_bot_authors: false

dr_environment-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,183 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [ main ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      - name: Cache uv download cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-3.12-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            uv-${{ runner.os }}-3.12-
+
+      - name: Check uv.lock is current
+        run: uv lock --check
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Lint (ruff format)
+        run: uv run ruff format --check src tests
+
+      - name: Lint (ruff check)
+        run: uv run ruff check src tests
+
+      - name: Type check (mypy)
+        run: uv run mypy src
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: [ '3.11', '3.12', '3.13' ]
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      - name: Cache uv download cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+        with:
+          path: ~/.cache/uv
+          key: uv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            uv-${{ runner.os }}-${{ matrix.python-version }}-
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Run tests
+        run: uv run pytest -q --junitxml=test_results/test-results.xml
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: junit-py${{ matrix.python-version }}
+          path: test_results/test-results.xml
+          if-no-files-found: ignore
+
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Build package
+        run: uv build
+
+      - name: Validate package metadata
+        run: uvx twine check dist/*
+
+      - name: Upload dist
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: dist
+          path: dist
+          if-no-files-found: ignore
+
+  licenses:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Check copyright headers
+        run: |
+          docker run --rm -v "$(pwd)":/github/workspace \
+            ghcr.io/apache/skywalking-eyes/license-eye:785bb7f3810572d6912666b4f64bad28e4360799 \
+            -v info -c .licenserc.yaml header check
+
+  audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      # Covers this project's own dependencies and the two pinned manifests that are baked
+      # into every generated image, which Dependabot's uv ecosystem cannot read.
+      - name: Audit dependencies for known CVEs
+        run: |
+          # Advisories listed in .github/pip-audit-ignore.txt are skipped, so a CVE with no fix
+          # available yet does not block every open PR. That file carries the rationale per entry.
+          IDS=()
+          while read -r id _; do
+            [ -n "$id" ] && IDS+=("$id")
+          done < <(sed 's/#.*//' .github/pip-audit-ignore.txt | grep -vE '^[[:space:]]*$')
+          IGNORE=()
+          for id in "${IDS[@]}"; do IGNORE+=(--ignore-vuln "$id"); done
+          echo "Skipping ${#IDS[@]} advisory ID(s) from .github/pip-audit-ignore.txt"
+          # uv.lock already resolves this project's full closure, so export and audit directly.
+          uv export --frozen --no-hashes --no-dev --no-emit-project -o "${RUNNER_TEMP}/project.txt"
+          echo "::group::pip-audit project"
+          uvx pip-audit==2.9.0 --disable-pip --no-deps "${IGNORE[@]}" -r "${RUNNER_TEMP}/project.txt"
+          echo "::endgroup::"
+          # The image manifests list direct pins only, but the build installs their transitive
+          # closures. Resolve each against the image's Python before auditing, or CVEs in
+          # transitive packages ship without failing CI.
+          for f in src/dr_environment/recipe/templates/docker_context/kernel/requirements.txt \
+                   src/dr_environment/recipe/templates/docker_context/build-deps/build-requirements.txt; do
+            resolved="${RUNNER_TEMP}/$(basename "$f").resolved.txt"
+            uv pip compile --python-version 3.11 --no-header --no-annotate -o "$resolved" "$f"
+            echo "::group::pip-audit $f"
+            uvx pip-audit==2.9.0 --disable-pip --no-deps "${IGNORE[@]}" -r "$resolved"
+            echo "::endgroup::"
+          done

dr_environment-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+name: Release
+
+# Tags the version `pyproject.toml` declares and publishes that build to PyPI.
+# Recover a failed publish with "Re-run failed jobs", never "Re-run all jobs": the tag
+# already exists by then, so the publish is skipped rather than retried.
+on:
+  push:
+    branches: [ main ]
+
+# `cancel-in-progress: false` so a second merge waits, then finds this run's tag. Only one
+# run queues, so a third merge inside one release evicts the second; re-run it on that sha.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  # Ahead of the tag: tagging first would strand the version, since an existing tag
+  # releases nothing.
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.12'
+
+      - name: Read version from pyproject.toml
+        id: version
+        uses: datarobot-oss/github-actions/actions/read-pyproject-version@0.0.24
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      # Gates the publish, not the merge: `ci.yml` covers this commit on its own trigger.
+      # Tests only; lint and audit stay there. A release can be yanked, never replaced.
+      - name: Run tests
+        run: uv run pytest
+
+      - name: Build package
+        run: uv build
+
+      - name: Validate package metadata
+        run: uvx twine check dist/*
+
+      - name: Upload dist
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: dist
+          path: dist
+
+  release:
+    needs: build
+    uses: datarobot-oss/github-actions/.github/workflows/create-release-on-merge.yaml@0.0.24
+    with:
+      version: ${{ needs.build.outputs.version }}
+    permissions:
+      contents: write
+      pull-requests: read
+
+  # A merge without a bump cuts no tag, so there is nothing to publish.
+  publish:
+    needs: [ build, release ]
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    # Trusted publishing: PyPI checks this environment claim, so no token is stored.
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # The release workflow passes no `target_commitish`, so the tag lands on main's
+      # tip, which a merge landing mid-run has already moved. Checked before the upload:
+      # a stale tag is deletable, a wheel on PyPI is yank-only.
+      - name: Verify the tag is the commit that was built
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.build.outputs.version }}
+        run: |
+          TAG_SHA="$(gh api "repos/$GITHUB_REPOSITORY/commits/$TAG" --jq .sha)"
+          if [ "$TAG_SHA" != "$GITHUB_SHA" ]; then
+            echo "::error::Tag $TAG is $TAG_SHA, not the built $GITHUB_SHA."
+            exit 1
+          fi
+
+      - name: Download dist
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always

dr_environment-0.1.0/.github/workflows/secret-scan.yml

@@ -0,0 +1,22 @@
+---
+name: secret-scan
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  gitleaks:
+    name: "gitleaks"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks
+        run: |
+          docker run --rm -v "$(pwd)":/repo -w /repo \
+            ghcr.io/gitleaks/gitleaks:v8.29.1 \
+            detect --source=/repo --redact --verbose --no-banner

dr_environment-0.1.0/.github/workflows/version-check.yml

@@ -0,0 +1,72 @@
+name: Version
+
+# A merge releases the version `pyproject.toml` declares, so a pull request that changes
+# what ships has to bump it. Waivable with the `skip-version-bump` label.
+
+# `labeled` and `unlabeled` are listed because naming any type replaces the defaults.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          # Full history, for the base branch's pyproject.toml.
+          fetch-depth: 0
+
+      - name: Require a version bump when what ships changes
+        env:
+          BASE: origin/${{ github.base_ref }}
+          SKIP: ${{ contains(github.event.pull_request.labels.*.name, 'skip-version-bump') }}
+        run: |
+          set -euo pipefail
+
+          # In the step, not a job-level `if`: branch protection counts a skipped job as
+          # passing, so the waiver has to run and report rather than skip.
+          if [ "$SKIP" = 'true' ]; then
+            echo "Waived by skip-version-bump."
+            exit 0
+          fi
+
+          # Paths that reach a consumer; `pyproject.toml` because its metadata ships in METADATA.
+          CHANGED="$(git -c core.quotePath=false diff --name-only --no-renames "${BASE}...HEAD")"
+          if ! grep -qE '^(src/|pyproject\.toml$|README\.md$|LICENSE$|NOTICE$|AUTHORS$)' <<<"$CHANGED"; then
+            echo "Nothing that ships changed."
+            exit 0
+          fi
+
+          # Parsed, not grepped: `version` appears in other tables and spacing around `=` varies.
+          read_version() {
+            git show "$1:pyproject.toml" \
+              | python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
+          }
+          BASE_VERSION="$(read_version "$BASE")"
+          HEAD_VERSION="$(read_version HEAD)"
+
+          if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
+            echo "::error::pyproject.toml still declares $BASE_VERSION. Bump it, or apply skip-version-bump."
+            exit 1
+          fi
+
+          # Checked here, not at release time: a bad version would otherwise redden main.
+          if ! printf '%s' "$HEAD_VERSION" | grep -qE '^(0|[1-9][0-9]*)(\.(0|[1-9][0-9]*)){2}$'; then
+            echo "::error::'$HEAD_VERSION' is not a plain X.Y.Z; the build backend strips leading zeros."
+            exit 1
+          fi
+
+          LATEST="$(printf '%s\n%s\n' "$BASE_VERSION" "$HEAD_VERSION" | sort -V | tail -1)"
+          if [ "$LATEST" != "$HEAD_VERSION" ]; then
+            echo "::error::pyproject.toml goes backwards, from $BASE_VERSION to $HEAD_VERSION."
+            exit 1
+          fi
+
+          echo "Version bumped from $BASE_VERSION to $HEAD_VERSION."

dr_environment-0.1.0/.github/workflows/workflow-pr-automation.yaml

@@ -0,0 +1,66 @@
+name: PR Automation
+
+# Reviewer-facing helpers: labels approved pull requests `00 - Reviewed`, comments a
+# Jira link, and posts to Slack. Both Slack jobs need `SLACK_WEBHOOK_URL`.
+
+on:
+  pull_request_review:
+    types: [submitted]
+  pull_request:
+    types: [opened, edited, labeled]
+  schedule:
+    - cron: '0 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # On an approving review: label the PR "00 - Reviewed".
+  mark-reviewed:
+    if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+    uses: datarobot-oss/github-actions/.github/workflows/mark-pr-reviewed.yaml@0.0.24
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+    permissions:
+      pull-requests: write
+
+  # On the `00 - Ready for Review` label: announce the pull request in Slack.
+  notify-ready-for-review:
+    if: github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == '00 - Ready for Review'
+    uses: datarobot-oss/github-actions/.github/workflows/mark-pr-to-review.yaml@0.0.24
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+      pr_url: ${{ github.event.pull_request.html_url }}
+      pr_title: ${{ github.event.pull_request.title }}
+      pr_author: ${{ github.event.pull_request.user.login }}
+      pr_additions: ${{ github.event.pull_request.additions }}
+      pr_deletions: ${{ github.event.pull_request.deletions }}
+      repo_name: ${{ github.repository }}
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+    permissions:
+      pull-requests: write
+
+  # On PR open/edit: comment a link to any Jira ticket in the title or branch.
+  add-jira-link:
+    if: github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'edited')
+    uses: datarobot-oss/github-actions/.github/workflows/add-jira-link.yaml@0.0.24
+    with:
+      jira_base_url: 'https://datarobot.atlassian.net/browse'
+      pr_title: ${{ github.event.pull_request.title }}
+      pr_number: ${{ github.event.pull_request.number }}
+      pr_branch: ${{ github.head_ref }}
+    permissions:
+      pull-requests: write
+
+  # On schedule or dispatch: post a digest of what is still awaiting review.
+  notify-slack-digest:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    uses: datarobot-oss/github-actions/.github/workflows/notify-slack.yaml@0.0.24
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: read