frontier-runner 0.2.2__tar.gz → 0.2.4__tar.gz

{frontier_runner-0.2.2 → frontier_runner-0.2.4}/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to frontier-runner are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.2.4] — 2026-09-27
+
+- CLI browser login (`frontier login`) uses a PKCE device-code flow and stores a short-lived user token separately from project API keys.
+- `frontier project create` / `frontier profile create --create-project` create a SaaS project with user authorization, issue a project key, and bind a named Frontier profile without printing the key.
+
+## [0.2.3] — 2026-09-27
+
+- Named Frontier profiles: local execution contexts that bind a SaaS project credential, API origin, optional dbt target, and optional profiles.yml path without replacing `dbt_project.yml` `profile:`.
+- Named-profile identity uses immutable SaaS organization and project IDs from `whoami`. Names are display-only. Cross-project upload and ingest compare IDs, not names.
+
 ## [0.2.2] — 2026-09-22
 
 - Disposable repair validation is the authoritative repaired-vs-head check. The unchanged materialized mart versus head comparison is an expected pre-repair difference and no longer fails the run.
@@ -100,6 +112,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - SaaS commands resolve stored keychain credentials through one shared
   resolver instead of requiring `FRONTIER_API_KEY` in the environment.
 
+[0.2.4]: https://github.com/jadsamara/frontier-runner/compare/v0.2.3...v0.2.4
+[0.2.3]: https://github.com/jadsamara/frontier-runner/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/jadsamara/frontier-runner/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/jadsamara/frontier-runner/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/jadsamara/frontier-runner/compare/v0.1.3...v0.2.0

{frontier_runner-0.2.2/frontier_runner.egg-info → frontier_runner-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: frontier-runner
-Version: 0.2.2
+Version: 0.2.4
 Summary: Customer-side Frontier CLI for dbt + Snowflake or BigQuery + GitHub impact assessments.
 Author: Frontier
 License: MIT License
@@ -92,7 +92,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.2/frontier_runner-0.2.2-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.4/frontier_runner-0.2.4-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -119,6 +119,31 @@ API keys are stored in the OS keychain (or `~/.config/frontier/credentials`
 mode 0600). They are never written to `frontier.yml`, `dbt_project.yml`,
 `profiles.yml`, Git, or generated workflows.
 
+## Frontier profiles
+
+A **Frontier profile** is a local named execution context. It selects one
+Frontier SaaS project credential and may default the dbt target and
+`profiles.yml` path. It does **not** replace the dbt `profile:` in
+`dbt_project.yml`. A **dbt target** is an output such as `dev`, `ci`, or
+`benchmark`.
+
+```bash
+frontier profile create repair --target dev --api-key
+frontier profile create benchmark --target benchmark --api-key
+frontier profile use benchmark
+frontier auth status
+frontier doctor
+```
+
+`--api-key` prompts securely; never pass the raw key as an argument.
+Selection is gitignored in `.frontier/state.yml` and is local to this
+repository. GitHub Actions ignores that file unless `FRONTIER_PROFILE` or
+`--profile` is set; CI continues to use `FRONTIER_API_KEY` /
+`FRONTIER_API_URL` repository secrets. `frontier upload` refuses a run
+generated for another origin, organization, project, dbt project, target, or
+semantic manifest (`ARTIFACT_PROFILE_MISMATCH`). Legacy login without a
+named profile is unchanged.
+
 ## Developer setup
 
 From this repository:
@@ -200,11 +225,12 @@ assessment.
 
 `frontier upload` posts `target/frontier-run.json` to `POST /api/v1/runs`. It
 retries HTTP 429/5xx and network errors, and honors `Retry-After`. SaaS
-commands resolve credentials in this order: `FRONTIER_API_KEY`, the OS
-keychain, the `0600` fallback file, then `FRONTIER_DEMO_API_KEY` only when
-`FRONTIER_ALLOW_LOCAL_MANIFEST` is set outside GitHub Actions. If none are
-present, the CLI exits with `AUTH_REQUIRED: Run \`frontier login --api-key\``.
-Hashed uploads set `entityIdsHashed: true`.
+commands resolve credentials in this order: `FRONTIER_API_KEY`, the selected
+Frontier profile credential, the OS keychain, the `0600` fallback file, then
+`FRONTIER_DEMO_API_KEY` only when `FRONTIER_ALLOW_LOCAL_MANIFEST` is set
+outside GitHub Actions. If none are present, the CLI exits with
+`AUTH_REQUIRED: Run \`frontier login --api-key\``. Hashed uploads set
+`entityIdsHashed: true`.
 
 In GitHub Actions, assessments use `{project}-{GITHUB_SHA}` as `externalRunId`
 and record repository, branch, commit, and PR number. After a successful
@@ -222,9 +248,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.2"
+pip install "frontier-runner[snowflake]==0.2.4"
 # or
-pip install "frontier-runner[bigquery]==0.2.2"
+pip install "frontier-runner[bigquery]==0.2.4"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.2 → frontier_runner-0.2.4}/README.md

@@ -34,7 +34,7 @@ Until the package is on PyPI, install the GitHub Release wheel for a version
 tag. You do not need a commit SHA:
 
 ```bash
-pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.2/frontier_runner-0.2.2-py3-none-any.whl"
+pipx install \ "frontier-runner[snowflake] @ https://github.com/jadsamara/frontier-runner/releases/download/v0.2.4/frontier_runner-0.2.4-py3-none-any.whl"
 pipx inject frontier-runner "snowflake-connector-python>=3.12,<4"
 ```
 
@@ -61,6 +61,31 @@ API keys are stored in the OS keychain (or `~/.config/frontier/credentials`
 mode 0600). They are never written to `frontier.yml`, `dbt_project.yml`,
 `profiles.yml`, Git, or generated workflows.
 
+## Frontier profiles
+
+A **Frontier profile** is a local named execution context. It selects one
+Frontier SaaS project credential and may default the dbt target and
+`profiles.yml` path. It does **not** replace the dbt `profile:` in
+`dbt_project.yml`. A **dbt target** is an output such as `dev`, `ci`, or
+`benchmark`.
+
+```bash
+frontier profile create repair --target dev --api-key
+frontier profile create benchmark --target benchmark --api-key
+frontier profile use benchmark
+frontier auth status
+frontier doctor
+```
+
+`--api-key` prompts securely; never pass the raw key as an argument.
+Selection is gitignored in `.frontier/state.yml` and is local to this
+repository. GitHub Actions ignores that file unless `FRONTIER_PROFILE` or
+`--profile` is set; CI continues to use `FRONTIER_API_KEY` /
+`FRONTIER_API_URL` repository secrets. `frontier upload` refuses a run
+generated for another origin, organization, project, dbt project, target, or
+semantic manifest (`ARTIFACT_PROFILE_MISMATCH`). Legacy login without a
+named profile is unchanged.
+
 ## Developer setup
 
 From this repository:
@@ -142,11 +167,12 @@ assessment.
 
 `frontier upload` posts `target/frontier-run.json` to `POST /api/v1/runs`. It
 retries HTTP 429/5xx and network errors, and honors `Retry-After`. SaaS
-commands resolve credentials in this order: `FRONTIER_API_KEY`, the OS
-keychain, the `0600` fallback file, then `FRONTIER_DEMO_API_KEY` only when
-`FRONTIER_ALLOW_LOCAL_MANIFEST` is set outside GitHub Actions. If none are
-present, the CLI exits with `AUTH_REQUIRED: Run \`frontier login --api-key\``.
-Hashed uploads set `entityIdsHashed: true`.
+commands resolve credentials in this order: `FRONTIER_API_KEY`, the selected
+Frontier profile credential, the OS keychain, the `0600` fallback file, then
+`FRONTIER_DEMO_API_KEY` only when `FRONTIER_ALLOW_LOCAL_MANIFEST` is set
+outside GitHub Actions. If none are present, the CLI exits with
+`AUTH_REQUIRED: Run \`frontier login --api-key\``. Hashed uploads set
+`entityIdsHashed: true`.
 
 In GitHub Actions, assessments use `{project}-{GITHUB_SHA}` as `externalRunId`
 and record repository, branch, commit, and PR number. After a successful
@@ -164,9 +190,9 @@ workflow uses `FRONTIER_BLOCKING=false` unless you pass `--blocking`.
 Pin an immutable released version:
 
 ```bash
-pip install "frontier-runner[snowflake]==0.2.2"
+pip install "frontier-runner[snowflake]==0.2.4"
 # or
-pip install "frontier-runner[bigquery]==0.2.2"
+pip install "frontier-runner[bigquery]==0.2.4"
 ```
 
 Until PyPI trusted publishing is reviewed and live, install the GitHub Release

{frontier_runner-0.2.2 → frontier_runner-0.2.4}/frontier/__init__.py

@@ -1,3 +1,3 @@
 """Customer-side Frontier runner."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"