gitops 1.5.1__tar.gz → 1.6.0__tar.gz

gitops-1.6.0/.github/workflows/release-please.yaml

@@ -0,0 +1,110 @@
+name: Release Please
+on:
+  push:
+    branches:
+      - develop
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+env:
+  MISE_PYTHON_COMPILE: false
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      cli-release-created: ${{ steps.release.outputs['release_created'] }}
+      server-release-created: ${{ steps.release.outputs['release_created'] }}
+      helm-release-created: ${{ steps.release.outputs['charts/gitops--release_created'] }}
+      server-version: ${{ steps.release.outputs['tag_name'] }}
+      helm-version: ${{ steps.release.outputs['charts/gitops--tag_name'] }}
+      sha: ${{ steps.release.outputs.sha }}
+    steps:
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # ratchet:googleapis/release-please-action@v4
+        id: release
+        with: {}
+
+  publish_helm_chart:
+    runs-on: ubuntu-latest
+    needs: release-please
+    if: ${{ needs.release-please.outputs.helm-version }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
+      - name: Publish Helm charts
+        uses: stefanprodan/helm-gh-pages@89c6698c192e70ed0e495bee7d3d1ca5b477fe82 # ratchet:stefanprodan/helm-gh-pages@master
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  publish_to_pypi:
+    name: Publishes tag to pypi
+    runs-on: ubuntu-latest
+    needs: release-please
+    if: ${{ needs.release-please.outputs.cli-release-created }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
+
+      - uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # ratchet:jdx/mise-action@v3.5.1
+        with:
+          install: true
+          cache: true
+          experimental: true
+
+      - run: mise run build
+        shell: bash
+
+      - name: Publish Pypi Package
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # ratchet:pypa/gh-action-pypi-publish@release/v1
+
+  publish_docker_image:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-24.04
+    needs: release-please
+    if: ${{ needs.release-please.outputs.server-release-created }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
+        with:
+          fetch-depth: 2
+
+      - name: Set environment variables
+        run: |
+          echo "GIT_SHORT_HASH=$(echo ${{ github.sha }} | cut -c -7)" >> $GITHUB_ENV
+
+      - name: Decode cluster key
+        env:
+          SECRET_ENV: ${{ secrets.CLUSTER_KEY }}
+        run: echo $SECRET_ENV | base64 -d > cluster.key
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # ratchet:aws-actions/configure-aws-credentials@v5.1.1
+        with:
+          role-to-assume: arn:aws:iam::610829907584:role/default-github-actions-ci-role
+          role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}
+          aws-region: ap-southeast-2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3.12.0
+
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # ratchet:aws-actions/amazon-ecr-login@v2
+
+      - name: Build and push image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
+        with:
+          context: "."
+          file: Dockerfile
+          cache-from: type=gha
+          cache-to: type=gha, mode=max
+          provenance: false
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:${{ env.GIT_SHORT_HASH }}
+            610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:latest
+            610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:${{ needs.release-please.outputs.server-version }}

gitops-1.6.0/.github/workflows/test.yml

@@ -0,0 +1,116 @@
+name: Test
+on:
+  push:
+    branches:
+      - develop
+  pull_request: ~
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+env:
+  PYTHONUNBUFFERED: 1
+
+jobs:
+  ci:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
+        with:
+          fetch-depth: 2
+
+      - name: Install Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # ratchet:actions/setup-python@v6.1.0
+        with:
+          python-version: "3.12"
+
+      - name: Setup mise
+        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # ratchet:jdx/mise-action@v3.5.1
+        with:
+          install: true
+          cache: true
+          experimental: true
+
+      - name: Run CI
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mise run install
+          mise run ci
+
+  build:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
+        with:
+          fetch-depth: 2
+
+      - name: Set environment variables
+        run: |
+          if [[ ${{ github.event_name }} != 'pull_request' ]]; then
+            echo "GIT_SHORT_HASH=$(echo ${{ github.sha }} | cut -c -7)" >> $GITHUB_ENV
+          else
+            echo "GIT_SHORT_HASH=$(echo ${{ github.event.pull_request.head.sha }} | cut -c -7)" >> $GITHUB_ENV
+          fi
+
+      - name: Decode cluster key
+        env:
+          SECRET_ENV: ${{ secrets.CLUSTER_KEY }}
+        run: echo $SECRET_ENV | base64 -d > cluster.key
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # ratchet:aws-actions/configure-aws-credentials@v5.1.1
+        with:
+          role-to-assume: arn:aws:iam::610829907584:role/default-github-actions-ci-role
+          role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}
+          aws-region: ap-southeast-2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3.12.0
+
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # ratchet:aws-actions/amazon-ecr-login@v2
+
+      - name: Build and push image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
+        with:
+          context: "."
+          file: Dockerfile
+          cache-from: type=gha
+          cache-to: type=gha, mode=max
+          provenance: false
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}
+
+      - name: Prepare Docker image comment
+        id: docker_comment
+        if: github.event_name == 'pull_request'
+        run: |
+          {
+            echo "comment<<EOF"
+            echo "## Docker Images"
+            echo ""
+            echo "**Commit:** \`${{ github.event.pull_request.head.sha }}\`"
+            echo ""
+            echo "| Tag |"
+            echo "| --- |"
+            echo "| \`610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}\` |"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Comment Docker images on PR
+        if: github.event_name == 'pull_request'
+        uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # ratchet:marocchino/sticky-pull-request-comment@v2.9.2
+        with:
+          header: docker-image-tags
+          message: ${{ steps.docker_comment.outputs.comment }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

{gitops-1.5.1 → gitops-1.6.0}/.mise.toml

@@ -1,6 +1,6 @@
 [tools]
-python = { version = "3.12.1", venv = ".venv" }
-uv = { version = "0.4.7"}
+python = { version = "3.12.13", venv = ".venv" }
+uv = { version = "0.9.9"}
 
 [env]
 _.python.venv = { path = "{{config_root}}/.venv", create = true }

{gitops-1.5.1 → gitops-1.6.0}/.pre-commit-config.yaml

@@ -1,16 +1,16 @@
 repos:
 - repo: https://github.com/charliermarsh/ruff-pre-commit
-  rev: v0.6.3
+  rev: 0839f92796ae388643a08a21640a029b322be5c2  # frozen: v0.15.2
   hooks:
   - id: ruff
     args:
     - --fix
 - repo: https://github.com/charliermarsh/ruff-pre-commit
-  rev: v0.6.3
+  rev: 0839f92796ae388643a08a21640a029b322be5c2  # frozen: v0.15.2
   hooks:
   - id: ruff-format
 - repo: https://github.com/commitizen-tools/commitizen
-  rev: v3.14.1
+  rev: 7179a42b3544e953e3683a670056ad385892365d  # frozen: v4.13.8
   hooks:
   - id: commitizen
     stages:

gitops-1.6.0/.release-please-manifest.json

@@ -0,0 +1,5 @@
+{
+    ".": "1.6.0",
+    "gitops_server": "0.15.1",
+    "charts/gitops": "1.2.1"
+}

{gitops-1.5.1 → gitops-1.6.0}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [1.6.0](https://github.com/uptick/gitops/compare/gitops-v1.5.1...gitops-v1.6.0) (2026-05-06)
+
+
+### Features
+
+* allow deploy alerts to go to a different channel ([78d9d1a](https://github.com/uptick/gitops/commit/78d9d1a9945933858dd3ef1a43c5a4042eb935a3))
+* **cli:** add --limit flag to cap number of apps per command ([f85ce08](https://github.com/uptick/gitops/commit/f85ce081cb2732578a5d2fd764295f7447b56b9f))
+* **cli:** add --limit flag to cap number of apps per command ([309ad2b](https://github.com/uptick/gitops/commit/309ad2bf3d45cbb73786f9285978fa00ac9d4605))
+* **cli:** add dedicated redeploy command ([69d35ef](https://github.com/uptick/gitops/commit/69d35ef0b8699348449bb786a684ee7df600dd21))
+* **deploy:** add subpath support for git-based helm charts ([4016ee0](https://github.com/uptick/gitops/commit/4016ee03424860ba72069b8be26309090c698dc9))
+
+
+### Bug Fixes
+
+* add OTEL environment variables to helm chart and addDEFAULT_LOGGING_CONFIG_DICT ([fd07319](https://github.com/uptick/gitops/commit/fd07319a2160af58647556ef7ee377f1212be71d))
+* **cli:** run git commit in apps directory for all commands ([6f02e00](https://github.com/uptick/gitops/commit/6f02e00ed11f337dc89c7d7aa0ee3fcd2e7816e6))
+* **cli:** run git commit in apps directory for all commands ([c4b8b70](https://github.com/uptick/gitops/commit/c4b8b70f0681da31277152a060d818f370244e70))
+
+
+### Documentation
+
+* add KMS encryption design for gitops ([bb46610](https://github.com/uptick/gitops/commit/bb466100e098f6747ee1f7675b8c4045c8ca0e8f))
+
 ## [1.5.1](https://github.com/uptick/gitops/compare/gitops-v1.5.0...gitops-v1.5.1) (2025-08-04)
 
 

{gitops-1.5.1 → gitops-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitops
-Version: 1.5.1
+Version: 1.6.0
 Summary: Manage multiple apps across one or more k8s clusters.
 Author-email: Jarek Głowacki <jarekwg@gmail.com>
 License-File: LICENSE

{gitops-1.5.1 → gitops-1.6.0}/charts/gitops/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.2.1](https://github.com/uptick/gitops/compare/helm-v1.2.0...helm-v1.2.1) (2026-05-06)
+
+
+### Bug Fixes
+
+* add OTEL environment variables to helm chart and addDEFAULT_LOGGING_CONFIG_DICT ([fd07319](https://github.com/uptick/gitops/commit/fd07319a2160af58647556ef7ee377f1212be71d))
+
 ## [1.2.0](https://github.com/uptick/gitops/compare/helm-v1.1.2...helm-v1.2.0) (2025-05-09)
 
 

{gitops-1.5.1 → gitops-1.6.0}/charts/gitops/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: GitOps Server Helm chart.
 name: gitops
-version: 1.2.0
+version: 1.2.1

{gitops-1.5.1 → gitops-1.6.0}/charts/gitops/templates/deployment.yml

@@ -70,6 +70,33 @@ spec:
               secretKeyRef:
                 name: {{ .Release.Name }}-secret
                 key: GITHUB_WEBHOOK_KEY
+          - name: NODE_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.hostIP
+          - name: OTEL_EXPORTER_OTLP_ENDPOINT
+            value: "http://$(NODE_IP):4317"
+          - name: OTEL_PYTHON_LOG_CORRELATION
+            value: "True"
+          - name: OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED
+            value: "True"
+          - name: OTEL_LOGS_EXPORTER
+            value: "otlp"
+          - name: OTEL_METRICS_EXPORTER
+            value: "none"
+          - name: OTEL_TRACES_EXPORTER
+            value: "otlp"
+          - name: OTEL_SERVICE_NAME
+            value: "gitops"
+          - name: OTEL_EXPORTER_OTLP_TIMEOUT
+            value: "1"
+          - name: OTEL_RESOURCE_ATTRIBUTES: 
+            value: "cluster={{.Values.cluster}}"
+          # We want to limit the length of the attributes so that we don't store too much
+          - name: OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT
+            value: "512"
+          - name: OTEL_PYTHON_EXCLUDED_URLS
+            value: "pingz,livez,readyz,metrics,robots.txt,favicon.ico"
         volumeMounts:
         - name: git-crypt-key
           mountPath: "/etc/gitops"

gitops-1.6.0/docs/plans/2026-03-13-kms-encryption-design.md

@@ -0,0 +1,176 @@
+# KMS Encryption for GitOps
+
+## Overview
+
+Replace git-crypt with a SOPS-inspired envelope encryption system using AWS KMS. Files are encrypted inline (value-level) so YAML structure remains readable and diffable. A crypt daemon caches unwrapped DEKs in memory to minimise KMS calls.
+
+## Phase 1: Manual CLI Commands
+
+### Core Encryption Model
+
+Envelope encryption with AES-256-GCM and KMS-wrapped DEKs.
+
+Each encrypted file gets one DEK (Data Encryption Key). The DEK is generated via KMS `GenerateDataKey`, giving both plaintext and ciphertext (wrapped) forms. Individual YAML values are encrypted locally using AES-256-GCM with the plaintext DEK — each value gets a unique IV and auth tag.
+
+The wrapped DEK is stored as a YAML comment header in the file, base64-encoded JSON containing one wrapped copy per KMS key in the rule set.
+
+**Deterministic IV:** The IV for each value is derived via `HMAC-SHA256(DEK, plaintext)` truncated to 12 bytes. This means identical plaintext values encrypted with the same DEK produce identical ciphertext, enabling diff and duplicate detection. This is safe because the DEK is unique per file — the (key, IV) pair never repeats across different files.
+
+### File Format
+
+After encryption:
+
+```yaml
+# gitops-crypt: eyJ2ZXJzaW9uIjogMSwgImRla3MiOiB7InByb2R1Y3Rpb24iOiAiYmFzZTY0Li4uIiwgImNpIjogImJhc2U2NC4uLiJ9fQ==
+secrets:
+    DB_PASSWORD: ENC[data:U2FsdGVk==,iv:AAAAAAAAAA==,tag:BBBBBBBBBB==]
+    API_KEY: ENC[data:Y2lwaGVy==,iv:CCCCCCCCCC==,tag:DDDDDDDDDD==]
+    NEW_SECRET: my-plaintext-value
+```
+
+Header payload (base64-decoded):
+
+```json
+{
+  "version": 1,
+  "deks": {
+    "production": "base64-wrapped-dek...",
+    "ci": "base64-wrapped-dek..."
+  }
+}
+```
+
+- `version` — format version for future changes
+- `deks` — the same DEK wrapped by each KMS key, keyed by name from `.gitops.toml`
+
+Encrypted value format:
+
+```
+ENC[data:<base64>,iv:<base64>,tag:<base64>]
+```
+
+- `data` — AES-256-GCM ciphertext
+- `iv` — 12-byte deterministic IV (HMAC-derived)
+- `tag` — 16-byte GCM authentication tag
+
+### Configuration: `.gitops.toml`
+
+```toml
+[encryption]
+daemon_idle_timeout = 3600  # seconds, default 1 hour
+
+[encryption.keys]
+production = "arn:aws:kms:ap-southeast-2:123456789:alias/gitops-prod"
+ci = "arn:aws:kms:ap-southeast-2:123456789:alias/gitops-ci"
+internal = "arn:aws:kms:ap-southeast-2:123456789:alias/gitops-internal"
+
+[[encryption.rules]]
+pattern = "apps/internal/*/secrets.yml"
+keys = ["internal", "ci"]
+
+[[encryption.rules]]
+pattern = "apps/*/secrets.yml"
+keys = ["production", "ci"]
+```
+
+- First matching rule wins (order matters — most specific first)
+- `--keys` CLI flag overrides the rule's key list for that invocation
+- Files not matching any rule are ignored
+
+### CLI Interface
+
+```bash
+# Encrypt all files matching rules in .gitops.toml
+gitops encrypt
+
+# Decrypt all files matching rules
+gitops decrypt
+
+# Operate on specific files
+gitops encrypt apps/billing/secrets.yml
+gitops decrypt apps/billing/secrets.yml
+
+# Override which keys wrap the DEK
+gitops encrypt apps/billing/secrets.yml --keys production,ci
+
+# Re-wrap DEK with a different key set (values unchanged)
+gitops encrypt apps/billing/secrets.yml --keys production,ci,new-team --rekey
+```
+
+Behaviour:
+- `encrypt` — encrypts plaintext values, skips already-encrypted ones (`ENC[...]` detection)
+- `decrypt` — decrypts `ENC[...]` values to plaintext, skips already-plaintext ones
+- `--rekey` — unwraps DEK with an existing key, re-wraps with the new key set. Values untouched.
+- Both connect to the daemon for DEK caching, auto-starting it if needed
+- Progress output consistent with existing CLI style
+
+### Crypt Daemon
+
+Auto-starts on first `encrypt`/`decrypt` call. Caches unwrapped DEKs in memory keyed by hash of wrapped DEK ciphertext.
+
+```
+┌─────────────┐       Unix Socket       ┌──────────────────┐
+│  gitops CLI  │ <────────────────────>  │  crypt-daemon    │
+│              │   request: wrapped DEK  │                  │
+│  encrypt/    │   response: plain DEK   │  In-memory cache │
+│  decrypt     │                         │  {hash → DEK}    │
+└─────────────┘                          │                  │
+                                         │  KMS client      │
+                                         └────────┬─────────┘
+                                                  │ only on cache miss
+                                                  v
+                                         ┌──────────────────┐
+                                         │    AWS KMS       │
+                                         └──────────────────┘
+```
+
+- Socket: `~/.gitops/crypt-daemon.sock`
+- PID file: `~/.gitops/crypt-daemon.pid`
+- Auto-starts when CLI can't connect to socket
+- Auto-exits after configurable idle timeout (default 1 hour)
+- DEKs only in memory, never written to disk
+- Supports batch requests — CLI sends all unique wrapped DEKs in one call, daemon resolves cache hits instantly and makes concurrent KMS calls for misses
+
+### Batch Pipeline
+
+`gitops decrypt` (no args) flow:
+
+1. Scan all files matching `.gitops.toml` rules
+2. Parse headers, collect all unique wrapped DEKs
+3. Send all unique wrapped DEKs to daemon in one batch request
+4. Daemon returns all plaintext DEKs (cache hits instant, misses go to KMS concurrently)
+5. Decrypt all values locally with concurrency (implementation TBD — profile to pick threads vs multiprocessing vs asyncio)
+
+100 files sharing 3 unique DEKs = 3 KMS calls max on cold cache, 0 on warm.
+
+### Server Integration
+
+The gitops server (`gitops_server/`) runs continuously and decrypts on every webhook-triggered deploy. It uses the daemon for DEK caching — the daemon runs alongside the server process.
+
+Post-clone flow:
+1. Clone repo (as today)
+2. Run `gitops decrypt` (replaces both `git-crypt unlock` and `helm-secrets` decryption)
+3. Deploy from plaintext working tree
+
+Helm-secrets is no longer needed — all decryption happens via `gitops decrypt` before helm runs.
+
+### Migration from git-crypt
+
+Incremental, file-by-file. Both systems coexist during migration:
+
+1. Add `.gitops.toml` with encryption rules
+2. For each file: `git-crypt unlock` → file is plaintext → `gitops encrypt` → commit
+3. Update server's `clone_repo()` to run `gitops decrypt` after clone
+4. Once all files migrated, remove `git-crypt` dependency and `GIT_CRYPT_KEY_FILE` config
+
+## Phase 2: Git Filter Integration (Future)
+
+Wire up `.gitattributes` for automatic encrypt-on-add / decrypt-on-checkout:
+
+```
+apps/*/secrets.yml filter=gitops-crypt diff=gitops-crypt
+```
+
+Use git's **long-running filter process** protocol (`filter.gitops-crypt.process`) rather than per-file smudge/clean invocations. A single persistent process handles all files in a checkout via stdin/stdout, avoiding process startup overhead per file. The crypt daemon serves double duty — it acts as both the DEK cache and the long-running filter process.
+
+The phase 1 design (`.gitops.toml` config, file format, daemon) is built to accommodate this without rework.

{gitops-1.5.1 → gitops-1.6.0}/gitops/__init__.py

@@ -2,11 +2,11 @@ import os
 import sys
 from pathlib import Path
 
-from gitops.utils.apps import App, get_app_details, get_apps
+from gitops.utils.apps import App, get_app_details, get_apps  # type: ignore[attr-defined]
 
 from .utils.cli import success, warning
 
-__version__ = "1.5.1"
+__version__ = "1.6.0"
 
 
 # Checking gitops version matches cluster repo version.

{gitops-1.5.1 → gitops-1.6.0}/gitops/common/app.py

@@ -21,8 +21,8 @@ class App:
         self,
         name: str,
         path: str | None = None,
-        deployments: dict | None = None,
-        secrets: dict | None = None,
+        deployments: dict[str, Any] | None = None,
+        secrets: dict[str, str] | None = None,
         load_secrets: bool = True,
         encode_secrets: bool = True,
         # deprecated
@@ -75,7 +75,7 @@ class App:
             current_dict = current_dict.setdefault(key, {})
         current_dict[keys[-1]] = value
 
-    def _make_values(self, deployments: dict, secrets: dict[str, str]) -> dict:
+    def _make_values(self, deployments: dict[str, Any], secrets: dict[str, str]) -> dict[str, Any]:
         def encode(value: str) -> str:
             return b64encode(str(value).encode()).decode() if self.encode_secrets else value
 
@@ -93,14 +93,17 @@ class App:
         values.pop("images", None)
         return values
 
-    def _make_image(self, deployment_config: dict) -> str:
+    def _make_image(self, deployment_config: dict[str, Any]) -> str:
         if "image-tag" in deployment_config:
-            return deployment_config["images"]["template"].format(
-                account_id=self.account_id,
-                tag=deployment_config["image-tag"],
+            return str(
+                deployment_config["images"]["template"].format(
+                    account_id=self.account_id,
+                    tag=deployment_config["image-tag"],
+                )
             )
         else:
-            return deployment_config.get("image", "")
+            image = deployment_config.get("image", "")
+            return str(image) if image else ""
 
     @property
     def image(self) -> str:
@@ -109,7 +112,7 @@ class App:
         if isinstance(image, dict):
             return f"{image['repository']}:{image.get('tag', 'latest')}"
         else:
-            return image
+            return str(image) if image else ""
 
     @property
     def image_repository_name(self) -> str:
@@ -139,20 +142,31 @@ class App:
 
     @property
     def cluster(self) -> str:
-        return self.values.get("cluster", "")
+        cluster = self.values.get("cluster", "")
+        return str(cluster)
 
     @property
     def tags(self) -> list[str]:
-        return self.values.get("tags", [])
+        tags = self.values.get("tags", [])
+        return list(tags)
 
     @property
     def service_account_name(self) -> str:
-        return self.values.get("serviceAccount", {}).get("name") or self.values.get("serviceAccountName") or "default"
+        service_account = self.values.get("serviceAccount", {})
+        if isinstance(service_account, dict):
+            name = service_account.get("name")
+            if name:
+                return str(name)
+        service_account_name = self.values.get("serviceAccountName")
+        if service_account_name:
+            return str(service_account_name)
+        return "default"
 
     @property
     def secrets(self) -> dict[str, str]:
         # TODO: This should be a first class property
-        return self.values.get("secrets", {})
+        secrets = self.values.get("secrets", {})
+        return dict(secrets)
 
 
 class Chart:
@@ -165,8 +179,9 @@ class Chart:
       type: git
       git_sha: develop
       git_repo_url: https://github.com/uptick/workforce
+      path: charts/myapp  # optional subpath within the repo
 
-    of
+    or
     chart:
       type: helm
       helm_repo: brigade
@@ -177,12 +192,13 @@ class Chart:
       chart: https://github.com/uptick/workforce
     """
 
-    def __init__(self, definition: dict | str):
+    def __init__(self, definition: dict[str, Any] | str):
         if isinstance(definition, str):
             # for backwards compat, any chart definition which is a string, is a git repo
             self.type = "git"
             self.git_sha = None
             self.git_repo_url = definition or None
+            self.path = None
         elif isinstance(definition, dict):
             self.type = definition["type"]
             self.git_sha = definition.get("git_sha")