gen3-dataops-toolkit 3.8.0__tar.gz → 4.0.1__tar.gz

{gen3_dataops_toolkit-3.8.0 → gen3_dataops_toolkit-4.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gen3-dataops-toolkit
-Version: 3.8.0
+Version: 4.0.1
 Summary: Gen3 DataOps toolkit (g3dt): operate SSM-published Gen3 data pipeline environments
 License: Apache-2.0
 Author: JoshuaHarris391
@@ -59,10 +59,12 @@ pip install gen3-dataops-toolkit
 ## Bootstrap: discover, then use
 
 ```bash
-g3dt config discover --all-profiles --add   # find every deployed env your
-                                            # AWS profiles can see; register
-                                            # them as contexts
-g3dt config contexts                        # list them (current marked *)
+g3dt config discover <aws-profile> --add    # logs the profile in if needed,
+                                            # lists every deployed env its
+                                            # account holds, registers them
+g3dt config contexts                        # list them (current marked *);
+                                            # offline — add --verify to check
+                                            # what each account has deployed
 g3dt config use myproj/test                 # point g3dt at one
 ```
 
@@ -184,8 +186,9 @@ g3dt dict deploy --env staging --version v1.1.7   # same tag, no cdk deploy
 ```
 
 An override does not persist, so `config show` keeps reporting the declared
-version until the CDK config catches up — `g3dt config diff --env <env>` reports
-exactly that gap and exits 1, so it can gate CI.
+version until the CDK config catches up —
+`g3dt config diff --env <env> --file <wrapper>/config/<project>.<env>.json`
+reports exactly that gap and exits 1, so it can gate CI.
 
 Synthetic data is only schema-valid against the dictionary that generated it, so
 `synth generate` records the dictionary version in each batch and `synth upload`
@@ -208,7 +211,7 @@ Only the API key stays local — as a *path* to the file holding it, never the
 key itself, set once per operator:
 
 ```bash
-g3dt config set llm_api_key_file ~/.g3dt/anthropic_api_key
+g3dt synth set-key ~/.g3dt/anthropic_api_key
 g3dt synth generate AusDiab_Simulated --llm -n 5 -e test
 ```
 
@@ -242,14 +245,18 @@ step, so it asks for confirmation (decline to skip it, or pass
 `--skip-delete` to skip without prompting); on a first deploy, when no
 previous batch exists locally, deletion is skipped automatically.
 
-`deploy` without `--studies` falls back to the original ACDC demo set
-(`AusDiab_Simulated,Baker-Biobank_Simulated,BioHeart-CT_Simulated,CAUGHT-CAD_Simulated`
-at 30,60,20,55 records, previous batch `v1.0.0`) — kept for continuity; any
-other project should always pass its own `--studies`. The deploy's delete step
-targets exactly the studies being regenerated, at `--prev-version`.
+`deploy` requires `--studies`: the list scopes every step — the previous
+batch deleted (at `--prev-version`), the batch generated, and the batch
+uploaded. Stale study directories from an earlier run that happen to sit in
+the same version directory are skipped with a log line, never submitted.
+(Before 4.0.0, omitting `--studies` silently deployed a hardcoded ACDC demo
+set — wrong for every other project.)
 
 ### Kubernetes restart targets
 
+Restarts and dictionary uploads against a production context require typing
+the context name to confirm, the same gate the synth and delete commands use.
+
 `k8s restart-schema`, `k8s restart-ms`, `dict deploy`, and `synth deploy`
 restart the commons' schema microservices **serially, in a configured order**,
 waiting for each rollout to go Healthy before the next; `k8s restart-etl` and

{gen3_dataops_toolkit-3.8.0 → gen3_dataops_toolkit-4.0.1}/README.md

@@ -25,10 +25,12 @@ pip install gen3-dataops-toolkit
 ## Bootstrap: discover, then use
 
 ```bash
-g3dt config discover --all-profiles --add   # find every deployed env your
-                                            # AWS profiles can see; register
-                                            # them as contexts
-g3dt config contexts                        # list them (current marked *)
+g3dt config discover <aws-profile> --add    # logs the profile in if needed,
+                                            # lists every deployed env its
+                                            # account holds, registers them
+g3dt config contexts                        # list them (current marked *);
+                                            # offline — add --verify to check
+                                            # what each account has deployed
 g3dt config use myproj/test                 # point g3dt at one
 ```
 
@@ -150,8 +152,9 @@ g3dt dict deploy --env staging --version v1.1.7   # same tag, no cdk deploy
 ```
 
 An override does not persist, so `config show` keeps reporting the declared
-version until the CDK config catches up — `g3dt config diff --env <env>` reports
-exactly that gap and exits 1, so it can gate CI.
+version until the CDK config catches up —
+`g3dt config diff --env <env> --file <wrapper>/config/<project>.<env>.json`
+reports exactly that gap and exits 1, so it can gate CI.
 
 Synthetic data is only schema-valid against the dictionary that generated it, so
 `synth generate` records the dictionary version in each batch and `synth upload`
@@ -174,7 +177,7 @@ Only the API key stays local — as a *path* to the file holding it, never the
 key itself, set once per operator:
 
 ```bash
-g3dt config set llm_api_key_file ~/.g3dt/anthropic_api_key
+g3dt synth set-key ~/.g3dt/anthropic_api_key
 g3dt synth generate AusDiab_Simulated --llm -n 5 -e test
 ```
 
@@ -208,14 +211,18 @@ step, so it asks for confirmation (decline to skip it, or pass
 `--skip-delete` to skip without prompting); on a first deploy, when no
 previous batch exists locally, deletion is skipped automatically.
 
-`deploy` without `--studies` falls back to the original ACDC demo set
-(`AusDiab_Simulated,Baker-Biobank_Simulated,BioHeart-CT_Simulated,CAUGHT-CAD_Simulated`
-at 30,60,20,55 records, previous batch `v1.0.0`) — kept for continuity; any
-other project should always pass its own `--studies`. The deploy's delete step
-targets exactly the studies being regenerated, at `--prev-version`.
+`deploy` requires `--studies`: the list scopes every step — the previous
+batch deleted (at `--prev-version`), the batch generated, and the batch
+uploaded. Stale study directories from an earlier run that happen to sit in
+the same version directory are skipped with a log line, never submitted.
+(Before 4.0.0, omitting `--studies` silently deployed a hardcoded ACDC demo
+set — wrong for every other project.)
 
 ### Kubernetes restart targets
 
+Restarts and dictionary uploads against a production context require typing
+the context name to confirm, the same gate the synth and delete commands use.
+
 `k8s restart-schema`, `k8s restart-ms`, `dict deploy`, and `synth deploy`
 restart the commons' schema microservices **serially, in a configured order**,
 waiting for each rollout to go Healthy before the next; `k8s restart-etl` and

{gen3_dataops_toolkit-3.8.0 → gen3_dataops_toolkit-4.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "gen3-dataops-toolkit"
-version = "3.8.0"
+version = "4.0.1"
 description = "Gen3 DataOps toolkit (g3dt): operate SSM-published Gen3 data pipeline environments"
 authors = ["JoshuaHarris391 <harjo391@gmail.com>"]
 readme = "README.md"

{gen3_dataops_toolkit-3.8.0 → gen3_dataops_toolkit-4.0.1}/src/g3dt/cli/__init__.py

@@ -1,4 +1,4 @@
-"""The ``acdc`` operations CLI.
+"""The ``g3dt`` operations CLI.
 
 A thin, self-documenting command layer over the project's existing service
 scripts and library functions. Run ``acdc --help`` or ``acdc docs`` to start.

gen3_dataops_toolkit-4.0.1/src/g3dt/cli/_internal/aws_quiet.py

@@ -0,0 +1,36 @@
+"""Scoped botocore log suppression for credential-probing commands.
+
+botocore logs its own WARNING tracebacks (with ``exc_info``) when an SSO
+token refresh fails — e.g. ``tokens.py: "SSO token refresh attempt failed"``
+and ``credentials.py: "Refreshing temporary credentials failed"``. Commands
+that deliberately probe possibly-stale profiles (``config contexts
+--verify``, ``config discover``) already render those failures as a tidy
+``?`` / "skipped" line, so the tracebacks are pure noise that drowns the
+intended output.
+
+A permanent ``logging.getLogger("botocore").setLevel(logging.ERROR)`` would
+also hide real botocore warnings for the rest of the process; this context
+manager scopes the silence to the probing block and restores the previous
+levels afterwards, even on error.
+"""
+from __future__ import annotations
+
+import logging
+from contextlib import contextmanager
+
+_NOISY_LOGGERS = ("botocore", "boto3", "urllib3")
+
+
+@contextmanager
+def quiet_botocore():
+    """Silence botocore/boto3/urllib3 warnings for the enclosed block."""
+    saved = {}
+    for name in _NOISY_LOGGERS:
+        logger = logging.getLogger(name)
+        saved[name] = logger.level
+        logger.setLevel(logging.ERROR)
+    try:
+        yield
+    finally:
+        for name, level in saved.items():
+            logging.getLogger(name).setLevel(level)

gen3_dataops_toolkit-4.0.1/src/g3dt/cli/_internal/helptext.py

@@ -0,0 +1,15 @@
+"""Shared help strings for options that appear across command groups.
+
+--env is offered by ~20 commands; before this module each declared its own
+phrasing (five variants had accumulated), so the same option read
+differently depending on which command's --help you happened to open. One
+constant keeps the story identical everywhere; append command-specific
+notes with ``+`` where a command genuinely differs.
+"""
+
+ENV_OPT = (
+    "Environment; defaults to the current context "
+    "(switch with 'g3dt config use', one-shot with --ctx)."
+)
+
+ENV_OPT_SYNTH = ENV_OPT + " Production targets require typed confirmation."

{gen3_dataops_toolkit-3.8.0 → gen3_dataops_toolkit-4.0.1}/src/g3dt/cli/config_cmds.py

@@ -26,10 +26,17 @@ import typer
 from g3dt import config, contexts
 from g3dt.cli._internal import resolve
 from g3dt.cli._internal.resolve import env_of, study_of
+from g3dt.cli._internal.helptext import ENV_OPT
 
 app = typer.Typer(
     no_args_is_help=True,
-    help="Contexts (use/discover/contexts), plus the resolved SSM settings.",
+    help="Contexts and resolved settings.\n\n"
+         "A context is a named (project, env, AWS profile, region) tuple "
+         "stored in the local g3dt.yaml marker. Every command acts on the "
+         "current context — switch with 'g3dt config use <name>', one-shot "
+         "with --ctx. Discovery scans one SSO profile's AWS account at a "
+         "time ('g3dt config discover <profile>'). Run 'g3dt docs' for the "
+         "full model.",
 )
 
 
@@ -91,6 +98,8 @@ def _print_context_row(ctx: contexts.Context, current: Optional[str],
             f"region={ctx.region}")
     if deployed is not None:
         line += f"  deployed={deployed}"
+        if deployed == "?" and ctx.profile:
+            line += f"  (try: aws sso login --profile {ctx.profile})"
     typer.secho(line, fg=typer.colors.RED if prod else None, bold=prod)
 
 
@@ -99,25 +108,55 @@ def _print_context_row(ctx: contexts.Context, current: Optional[str],
 # --------------------------------------------------------------------------- #
 @app.command("contexts")
 def contexts_list(
-    no_verify: bool = typer.Option(
-        False, "--no-verify", help="Skip the per-context deployed check (offline)."
+    verify: bool = typer.Option(
+        False,
+        "--verify/--no-verify",
+        help="Check each context's deployed toolkit version (one SSM read "
+             "per context; needs live AWS credentials). Default: list the "
+             "local marker only, fully offline.",
     ),
 ) -> None:
-    """List the configured contexts (current marked with *)."""
+    """List the locally registered contexts (current marked with *).
+
+    Reads only the local g3dt.yaml marker — no AWS/SSO calls are made
+    unless --verify is passed.
+    """
     resolve.announce_context()
     ctxs = contexts.list_contexts()
     if not ctxs:
         typer.secho(
-            "No contexts configured. Run `g3dt config discover --all-profiles "
-            "--add`, or `g3dt config add <name> --project <p> --env <e> "
-            "--profile <profile>`.",
+            "No contexts configured. Run 'g3dt config discover <aws-profile> "
+            "--add', or 'g3dt config add <name> --project <p> --env <e> "
+            "--profile <profile>'.",
             fg=typer.colors.YELLOW,
         )
         return
     current = contexts.current_context_name()
-    for ctx in ctxs.values():
-        deployed = None if no_verify else _deployed_version(ctx)
-        _print_context_row(ctx, current, deployed)
+    if verify:
+        from g3dt.cli._internal.aws_quiet import quiet_botocore
+
+        with quiet_botocore():
+            for ctx in ctxs.values():
+                _print_context_row(ctx, current, _deployed_version(ctx))
+    else:
+        for ctx in ctxs.values():
+            _print_context_row(ctx, current, None)
+
+
+@app.command("current")
+def current_cmd() -> None:
+    """Print the current context name (script-friendly; exit 1 if none)."""
+    resolve.announce_context()
+    name = contexts.current_context_name()
+    if name is None:
+        typer.secho(
+            "No context selected — run 'g3dt config use <name>' "
+            "(see 'g3dt config contexts').",
+            fg=typer.colors.YELLOW,
+            err=True,
+        )
+        raise typer.Exit(1)
+    typer.echo(name)
 
 
 @app.command("use")
@@ -165,18 +204,20 @@ def use(
 def add(
     name: str = typer.Argument(..., help="Context name, e.g. myproj/staging."),
     project: str = typer.Option(..., "--project", help="Project id, e.g. myproj."),
-    env: str = typer.Option(..., "--env", help="Base environment, e.g. staging."),
-    profile: str = typer.Option(
+    env: str = typer.Option(..., "--env", "-e", help="Base environment, e.g. staging."),
+    profile: Optional[str] = typer.Option(
         None, "--profile", help="AWS named profile (omit for the ambient chain)."
     ),
-    region: str = typer.Option(None, "--region", help="AWS region override."),
+    region: Optional[str] = typer.Option(
+        None, "--region", "-r", help="AWS region override."
+    ),
     production: bool = typer.Option(
         False, "--production",
         help="Mark as production: strict typed confirmation on every "
              "destructive action.",
     ),
 ) -> None:
-    """Register one context by hand (`config discover --add` is the usual path)."""
+    """Register one context by hand ('config discover <profile> --add' is the usual path)."""
     resolve.announce_context()
     marker = config.load_marker()
     ctx = contexts.Context(
@@ -226,77 +267,154 @@ def forget(
 
 @app.command("discover")
 def discover(
+    profile_arg: Optional[str] = typer.Argument(
+        None, metavar="[PROFILE]",
+        help="Scan just this AWS profile's account. If its SSO session is "
+             "stale you are offered `aws sso login` first.",
+    ),
     all_profiles: bool = typer.Option(
         False, "--all-profiles",
         help="Scan every profile in ~/.aws/config for deployed "
-             "/{project}/{env} trees.",
+             "/{project}/{env} trees (profiles with stale sessions are "
+             "skipped, not logged in).",
     ),
     add_found: bool = typer.Option(
         False, "--add", help="Register discovered pairs as contexts."
     ),
     profile: List[str] = typer.Option(
-        [], "--profile", help="Restrict --all-profiles to these profiles."
+        [], "--profile", hidden=True,
+        help="(Deprecated) Restrict --all-profiles to these profiles.",
     ),
-    region: str = typer.Option(
-        None, "--region", help="Region for profiles that configure none."
+    region: Optional[str] = typer.Option(
+        None, "--region", "-r", help="Region for profiles that configure none."
     ),
 ) -> None:
-    """Find deployable infrastructure.
-
-    Default: verify each configured context against its own account (nothing
-    else is touched). With --all-profiles: enumerate every AWS profile and
-    list all deployed environments its account holds; add --add to register
-    them as contexts.
+    """Scan an AWS profile's account for deployed environments (register with --add).
+
+    Discovery works one AWS account at a time, through one SSO profile:
+    'g3dt config discover <profile>' checks that profile's session, offers
+    'aws sso login' if it is stale, then lists every deployed environment
+    the account holds — the recommended flow. --all-profiles sweeps every
+    configured profile instead (stale sessions are skipped, not logged in).
+    Run with no arguments to see your profiles and this model. To check
+    contexts you already registered: 'g3dt config contexts --verify'.
     """
     resolve.announce_context()
-    # The scan probes credentials that may be stale; botocore logs its own
-    # WARNING tracebacks for failed SSO refreshes, which would drown the
-    # per-profile "skipped (run: aws sso login ...)" lines this command
-    # prints deliberately. Quiet botocore for the duration.
-    import logging
-
-    logging.getLogger("botocore").setLevel(logging.ERROR)
     marker = config.load_marker()
     default_region = region or marker.get("region") or config.DEFAULT_REGION
 
-    if not all_profiles:
-        ctxs = contexts.list_contexts(marker)
-        if not ctxs:
+    if profile_arg and all_profiles:
+        typer.secho("Pass either a PROFILE argument or --all-profiles, not both.",
+                    fg=typer.colors.RED, err=True)
+        raise typer.Exit(1)
+    if profile and profile_arg:
+        typer.secho(
+            "Pass either a PROFILE argument or --profile, not both "
+            "(--profile is deprecated).",
+            fg=typer.colors.RED, err=True,
+        )
+        raise typer.Exit(1)
+    if profile and not all_profiles:
+        typer.secho(
+            "--profile is deprecated and only valid with --all-profiles; "
+            "run 'g3dt config discover <profile>' instead.",
+            fg=typer.colors.RED, err=True,
+        )
+        raise typer.Exit(1)
+    if profile:
+        typer.secho(
+            "--profile is deprecated and will be removed in the next major "
+            "release; run 'g3dt config discover <profile>' per profile "
+            "instead.",
+            fg=typer.colors.YELLOW, err=True,
+        )
+
+    import botocore.session
+
+    profiles_cfg = botocore.session.Session().full_config.get("profiles", {})
+
+    if not profile_arg and not all_profiles:
+        # Guidance mode: no network — explain the model and show what is
+        # available locally, so a first run of the bare command teaches the
+        # flow instead of surprising the operator with live AWS calls.
+        typer.echo(
+            "Discovery scans one AWS account at a time, through one SSO "
+            "profile:"
+        )
+        typer.echo("    g3dt config discover <profile> [--add]")
+        if profiles_cfg:
+            typer.echo(
+                f"Profiles in ~/.aws/config: {', '.join(sorted(profiles_cfg))}"
+            )
+        else:
             typer.secho(
-                "No contexts configured to verify. Try "
-                "`g3dt config discover --all-profiles [--add]`.",
+                "No profiles found in ~/.aws/config — configure AWS SSO "
+                "first (aws configure sso).",
                 fg=typer.colors.YELLOW,
             )
-            return
-        for ctx in ctxs.values():
-            state = _deployed_version(ctx)
-            if state.startswith("✓"):
-                label, color = f"OK ({state[2:]})", typer.colors.GREEN
-            elif state == "—":
-                label, color = "NOT DEPLOYED", typer.colors.YELLOW
-            else:
-                label, color = (
-                    f"AUTH FAILED (try: aws sso login --profile {ctx.profile})",
-                    typer.colors.RED,
-                )
-            typer.secho(f"  {ctx.name:<24} {label}", fg=color)
+        typer.echo(
+            "Sweep every profile with --all-profiles (stale SSO sessions "
+            "are skipped)."
+        )
+        typer.echo(
+            "To check contexts you already registered: "
+            "g3dt config contexts --verify"
+        )
         return
 
-    import botocore.session
+    from g3dt.cli._internal.aws_quiet import quiet_botocore
 
-    profiles_cfg = botocore.session.Session().full_config.get("profiles", {})
-    names = profile or sorted(profiles_cfg)
-    if not names:
-        typer.secho("No AWS profiles found in ~/.aws/config.",
-                    fg=typer.colors.YELLOW)
-        return
+    if profile_arg:
+        if profile_arg not in profiles_cfg:
+            typer.secho(
+                f"No profile '{profile_arg}' in ~/.aws/config. Configured: "
+                f"{', '.join(sorted(profiles_cfg)) or '(none)'}.",
+                fg=typer.colors.RED, err=True,
+            )
+            raise typer.Exit(1)
+        with quiet_botocore():
+            session_ok = _profile_session_valid(profile_arg)
+        if not session_ok:
+            typer.secho(
+                f"The SSO session for '{profile_arg}' is not valid.",
+                fg=typer.colors.YELLOW,
+            )
+            if not typer.confirm(
+                f"Run `aws sso login --profile {profile_arg}` now?",
+                default=True,
+            ):
+                typer.secho("Aborted — log in and re-run discover.",
+                            fg=typer.colors.YELLOW)
+                raise typer.Exit(1)
+            import subprocess
+
+            login = subprocess.run(
+                ["aws", "sso", "login", "--profile", profile_arg]
+            )
+            with quiet_botocore():
+                session_ok = _profile_session_valid(profile_arg)
+            if login.returncode != 0 or not session_ok:
+                typer.secho(
+                    f"Still no valid session for '{profile_arg}'. Aborting.",
+                    fg=typer.colors.RED, err=True,
+                )
+                raise typer.Exit(1)
+        names = [profile_arg]
+    else:
+        names = profile or sorted(profiles_cfg)
+        if not names:
+            typer.secho("No AWS profiles found in ~/.aws/config.",
+                        fg=typer.colors.YELLOW)
+            return
 
     found: List[contexts.Context] = []
+    seen_names = set()
     for prof in names:
         prof_region = (profiles_cfg.get(prof, {}).get("region")
                        or default_region)
         try:
-            pairs = _scan_profile(prof, prof_region)
+            with quiet_botocore():
+                pairs = _scan_profile(prof, prof_region)
         except Exception as exc:
             typer.secho(
                 f"  {prof}: skipped ({type(exc).__name__} — "
@@ -309,6 +427,12 @@ def discover(
             continue
         for project, env in pairs:
             name = f"{project}/{env}"
+            if name in seen_names:
+                # Same account visible through several profiles (e.g. a
+                # 'default' alias): the first profile wins; don't print
+                # duplicate suggestions.
+                continue
+            seen_names.add(name)
             ctx = contexts.Context(
                 name=name, project=project, env=env, profile=prof,
                 region=prof_region,
@@ -340,6 +464,23 @@ def discover(
             )
 
 
+def _profile_session_valid(profile: str) -> bool:
+    """Cheap credential check: can this profile sign a request right now?"""
+    import boto3
+    from botocore.config import Config as _BotoConfig
+
+    try:
+        session = boto3.Session(profile_name=profile)
+        session.client(
+            "sts",
+            config=_BotoConfig(connect_timeout=3, read_timeout=5,
+                               retries={"max_attempts": 1}),
+        ).get_caller_identity()
+        return True
+    except Exception:
+        return False
+
+
 def _scan_profile(profile: str, region: str) -> List[tuple]:
     """All deployed (project, env) pairs visible to one profile's account.
 
@@ -387,11 +528,14 @@ def envs() -> None:
 
 @app.command()
 def studies(
-    env: str = typer.Option(
+    env: Optional[str] = typer.Option(
         None,
         "--env",
         "-e",
-        help="Also check the env's S3 registry (s3://<metadata-bucket>/config/studies.yaml).",
+        help="Read the study registry from this env's S3 bucket "
+             "(s3://<metadata-bucket>/config/studies.yaml) instead of the "
+             "local marker — this changes the data source, not just the "
+             "target.",
     ),
 ) -> None:
     """List the configured studies (bare names).
@@ -418,11 +562,8 @@ def studies(
 
 @app.command()
 def show(
-    env: str = typer.Option(
-        None, "--env", "-e",
-        help="Environment; defaults to the current context.",
-    ),
-    study: str = typer.Option(
+    env: Optional[str] = typer.Option(None, "--env", "-e", help=ENV_OPT),
+    study: Optional[str] = typer.Option(
         None, "--study", "-s", help="Optional study to resolve against the env."
     ),
     full: bool = typer.Option(
@@ -480,14 +621,12 @@ def show(
 
 @app.command()
 def diff(
-    env: str = typer.Option(
-        None, "--env", "-e",
-        help="Environment; defaults to the current context.",
-    ),
+    env: Optional[str] = typer.Option(None, "--env", "-e", help=ENV_OPT),
     file: Path = typer.Option(
         ...,
         "--file",
-        "-f",
+        exists=True,
+        dir_okay=False,
         help="The env's INPUT file in the deployment wrapper, e.g. "
         "../myproj-pipeline-deploy/config/myproj.staging.json.",
     ),
@@ -565,10 +704,9 @@ def diff(
 
 @app.command("dbt-env")
 def dbt_env(
-    env: str = typer.Option(
+    env: Optional[str] = typer.Option(
         None, "--env", "-e",
-        help="Environment; defaults to the current context. CodeBuild always "
-             "passes this explicitly.",
+        help=ENV_OPT + " CodeBuild always passes this explicitly.",
     ),
 ) -> None:
     """Emit `export` lines for the env's dbt settings (resolved from SSM).