gitops 1.6.3__tar.gz → 1.8.0__tar.gz

{gitops-1.6.3 → gitops-1.8.0}/.github/workflows/release-please.yaml

@@ -59,7 +59,7 @@ jobs:
         shell: bash
 
       - name: Publish Pypi Package
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # ratchet:pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # ratchet:pypa/gh-action-pypi-publish@release/v1
 
   publish_docker_image:
     name: Build and Push Docker Image

{gitops-1.6.3 → gitops-1.8.0}/.github/workflows/test.yml

@@ -36,6 +36,12 @@ jobs:
           cache: true
           experimental: true
 
+      # Secrets in the cluster repo are git-crypt encrypted, and the app
+      # definition loader decrypts them. Without this the coverage of that path
+      # silently skips.
+      - name: Install git-crypt
+        run: sudo apt-get update && sudo apt-get install -y git-crypt
+
       - name: Run CI
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -88,6 +94,8 @@ jobs:
           provenance: false
           platforms: linux/amd64,linux/arm64
           push: true
+          build-args: |
+            BUILD_KIND=test
           tags: |
             610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}
 

{gitops-1.6.3 → gitops-1.8.0}/.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
-    ".": "1.6.3",
+    ".": "1.8.0",
     "gitops_server": "0.15.1",
     "charts/gitops": "1.2.2"
 }

{gitops-1.6.3 → gitops-1.8.0}/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [1.8.0](https://github.com/uptick/gitops/compare/gitops-v1.7.1...gitops-v1.8.0) (2026-08-21)
+
+
+### Features
+
+* **worker:** bound concurrent deployments ([956c630](https://github.com/uptick/gitops/commit/956c6309516ba831805aa1df90fd4fdb7314cb43))
+
+
+### Bug Fixes
+
+* **security:** stop embedding the github token in clone URLs ([fd88bc1](https://github.com/uptick/gitops/commit/fd88bc1176a51caf9dddca37aee9d4ecfc0b5c78))
+* **security:** stop embedding the github token in clone URLs ([68b7225](https://github.com/uptick/gitops/commit/68b722547d83e2ab1560ef7af0bc925d893b7580))
+
+
+### Performance Improvements
+
+* **deploy:** read app definitions from git instead of checking out the repo ([0b21790](https://github.com/uptick/gitops/commit/0b2179084e8920790de70363cdb369558342e895))
+* **deploy:** read app definitions from git instead of checking out the repo ([f90bc3a](https://github.com/uptick/gitops/commit/f90bc3a60141423313574813adeb1313406f7168))
+
+## [1.7.1](https://github.com/uptick/gitops/compare/gitops-v1.7.0...gitops-v1.7.1) (2026-08-17)
+
+
+### Documentation
+
+* install the CLI from GitHub over SSH ([754e387](https://github.com/uptick/gitops/commit/754e3871ebafa7baf8d76990dee9dfc8d45aa892))
+* install the CLI from GitHub over SSH ([c76d41c](https://github.com/uptick/gitops/commit/c76d41cc3a274febded30bcc9661f8c6cefabd4a))
+
+## [1.7.0](https://github.com/uptick/gitops/compare/gitops-v1.6.3...gitops-v1.7.0) (2026-08-17)
+
+
+### Features
+
+* **cli:** add skip-deploy to setenv and unsetenv ([285ac87](https://github.com/uptick/gitops/commit/285ac872f94eba77636262f30998bca86b1c0d90))
+* **cli:** add skip-deploy to setenv and unsetenv ([de4ecd9](https://github.com/uptick/gitops/commit/de4ecd90dcbe8dea4e0e5ea6b7f93a05e36eae4b))
+
+
+### Bug Fixes
+
+* **build:** keep test and release images on distinct digests ([48c1c75](https://github.com/uptick/gitops/commit/48c1c750da2cc7f5fc86b8c52beee9abf07805db))
+* **build:** keep test and release images on distinct digests ([2c8bc3c](https://github.com/uptick/gitops/commit/2c8bc3cf1eeadf26a1127762c89bff60aa121db1))
+
 ## [1.6.3](https://github.com/uptick/gitops/compare/gitops-v1.6.2...gitops-v1.6.3) (2026-08-05)
 
 

{gitops-1.6.3 → gitops-1.8.0}/Dockerfile

@@ -56,7 +56,13 @@ COPY --link=true pyproject.toml uv.lock /app/
 RUN --mount=type=cache,target=/root/.cache/ \
     (uv sync --frozen --no-install-project --extra server || uv sync --frozen --no-install-project --extra server)
 # Install dependencies
-RUN git config --global advice.detachedHead false
+# Give git the token from the environment when it asks, so it is never embedded
+# in a clone URL, a command line, a log, or a repo's .git/config. The function
+# wrapper is the documented idiom -- git appends the operation (get/store/erase)
+# as an argument, which the wrapper discards. See gitcredentials(7).
+RUN git config --global advice.detachedHead false \
+    && git config --global credential.helper \
+       '!f() { printf "username=x-access-token\npassword=%s\n" "$GITHUB_OAUTH_TOKEN"; }; f'
 
 COPY cluster.key /app/
 COPY gitops /app/gitops/
@@ -66,4 +72,10 @@ ENV GIT_CRYPT_KEY_FILE=/app/cluster.key
 ENV PYTHONPATH="$PYTHONPATH:/app"
 ENV ACCESS_LOG=""
 
+# Keeps test and release builds on distinct digests. They build from the same
+# source and cache, so otherwise they dedupe into one manifest and a retention
+# rule targeting test tags expires the release image too.
+ARG BUILD_KIND=release
+LABEL build-kind=$BUILD_KIND
+
 CMD ["uvicorn", "--host", "0.0.0.0", "--port", "8000", "gitops_server.main:app"]

{gitops-1.6.3 → gitops-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: gitops
-Version: 1.6.3
+Version: 1.8.0
 Summary: Manage multiple apps across one or more k8s clusters.
 Author-email: Jarek Głowacki <jarekwg@gmail.com>
 License-File: LICENSE
@@ -69,7 +69,17 @@ This is a git repository that you set up, where you list out all of your applica
 
 ## Gitops CLI Installation
 
-1. Install the CLI tool with: `uv tool install gitops` and upgrade it with `uv tool upgrade gitops`.
+1. Install the CLI tool from GitHub over SSH, which needs an SSH key registered
+   with GitHub. Add `--verbose` to see what it is doing:
+
+   ```bash
+   uv tool install git+ssh://git@github.com/uptick/gitops
+   ```
+
+   Upgrade it with `uv tool upgrade gitops`.
+
+   Installing from PyPI (`uv tool install gitops`) still works, but we are
+   moving away from it — use the git install.
 
 2. Set up the environment variable `GITOPS_APPS_DIRECTORY` to invoke gitops from any directory.
 

{gitops-1.6.3 → gitops-1.8.0}/README.md

@@ -37,7 +37,17 @@ This is a git repository that you set up, where you list out all of your applica
 
 ## Gitops CLI Installation
 
-1. Install the CLI tool with: `uv tool install gitops` and upgrade it with `uv tool upgrade gitops`.
+1. Install the CLI tool from GitHub over SSH, which needs an SSH key registered
+   with GitHub. Add `--verbose` to see what it is doing:
+
+   ```bash
+   uv tool install git+ssh://git@github.com/uptick/gitops
+   ```
+
+   Upgrade it with `uv tool upgrade gitops`.
+
+   Installing from PyPI (`uv tool install gitops`) still works, but we are
+   moving away from it — use the git install.
 
 2. Set up the environment variable `GITOPS_APPS_DIRECTORY` to invoke gitops from any directory.
 

{gitops-1.6.3 → gitops-1.8.0}/gitops/__init__.py

@@ -6,7 +6,7 @@ from gitops.utils.apps import App, get_app_details, get_apps  # type: ignore[att
 
 from .utils.cli import success, warning
 
-__version__ = "1.6.3"
+__version__ = "1.8.0"
 
 
 # Checking gitops version matches cluster repo version.

{gitops-1.6.3 → gitops-1.8.0}/gitops/core.py

@@ -340,13 +340,14 @@ def _sort_envs(envs: dict[str, Any]) -> dict[str, Any]:
 
 
 @task
-def setenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int = 0) -> None:
+def setenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int = 0, skip_deploy: bool = False) -> None:
     """Set one or more env vars on selected app(s).
 
     eg. inv setenv customer,sandbox BG_RUNNER=DRAMATIQ,BUMP=2
 
     NOTE: More broad-reaching environment changes should be made at the chart level.
     Provide `limit` to process only the first N matching apps.
+    Provide `skip_deploy` to skip deploying for non functional changes.
     """
     splitenvs = values.split(",")  # pardon the pun.
     formatted_splitenvs = "\n".join(splitenvs)
@@ -380,18 +381,21 @@ def setenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int = 0
     commit_message = f"Set env var(s) '{values}' on {filter}"
     if exclude:
         commit_message += f" (except {exclude})"
+    if skip_deploy:
+        commit_message += " --skip-deploy"
     run(f'cd {get_apps_directory()}; git commit -am "{commit_message}."')
     print(success("Done!"))
 
 
 @task
-def unsetenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int = 0) -> None:
+def unsetenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int = 0, skip_deploy: bool = False) -> None:
     """Unset one or more env vars on selected app(s).
 
     eg. inv unsetenv customer,sandbox BG_RUNNER,BUMP
 
     NOTE: More broad-reaching environment changes should be made at the chart level.
     Provide `limit` to process only the first N matching apps.
+    Provide `skip_deploy` to skip deploying for non functional changes.
     """
     splitenvs = values.split(",")  # pardon the pun.
     formatted_splitenvs = "\n".join(splitenvs)
@@ -416,6 +420,8 @@ def unsetenv(ctx: Any, filter: str, values: str, exclude: str = "", limit: int =
     commit_message = f"Unset env var(s) '{values}' on {filter}"
     if exclude:
         commit_message += f" (except {exclude})"
+    if skip_deploy:
+        commit_message += " --skip-deploy"
     run(f'cd {get_apps_directory()}; git commit -am "{commit_message}."')
     print(success("Done!"))
 

{gitops-1.6.3 → gitops-1.8.0}/gitops_server/settings.py

@@ -16,3 +16,8 @@ SLACK_ALERT_CHANNEL_ID = os.environ.get("SLACK_ALERT_CHANNEL_ID", "")
 
 # How many parallel deploys can be done at once
 GITOPS_MAX_PARALLEL_DEPLOYS = os.environ.get("GITOPS_MAX_PARALLEL_DEPLOYS", "5")
+
+# How many pushes can be processed at once. Each one loads app definitions for
+# two commits before it reaches GITOPS_MAX_PARALLEL_DEPLOYS, so without a bound
+# here a burst of pushes is only limited by how fast they arrive.
+GITOPS_MAX_CONCURRENT_DEPLOYMENTS = os.environ.get("GITOPS_MAX_CONCURRENT_DEPLOYMENTS", "20")

gitops-1.8.0/gitops_server/utils/git.py

@@ -0,0 +1,182 @@
+import asyncio
+import logging
+import os
+import re
+import tempfile
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+from pathlib import Path
+
+from opentelemetry.trace import get_tracer
+
+from . import run
+
+tracer = get_tracer(__name__)
+logger = logging.getLogger("gitops")
+
+REPO_CACHE_DIR = Path("/tmp/gitops/repocache")
+REPO_CACHE: dict[str, Path] = {}
+repo_lock = asyncio.Semaphore(1)
+
+# git-crypt prefixes every encrypted blob with this magic.
+GIT_CRYPT_MAGIC = b"\0GITCRYPT\0"
+
+# git-crypt has no batch mode: one process per file. Bounded so concurrent
+# loads can't fork-storm.
+decrypt_semaphore = asyncio.Semaphore(16)
+
+
+async def clone_repo(git_repo_url: str, path: str, sha: str | None = None, branch: str | None = None) -> None:
+    """Shallow Clones a git repo url to path and git-crypt unlocks all encrypted files"""
+    logger.info(f'Cloning "{git_repo_url}".')
+
+    with tracer.start_as_current_span("tempo_repo.clone_repo"):
+        if sha:
+            await run(f"git clone --depth 100 {git_repo_url} {path}; cd {path}; git checkout {sha}")
+        elif branch:
+            await run(f"git clone --depth 1 {git_repo_url} {path} --branch {branch}")
+        else:
+            await run(f"git clone --depth 100 {git_repo_url} {path};")
+
+    if GIT_CRYPT_KEY_FILE := os.environ.get("GIT_CRYPT_KEY_FILE"):
+        with tracer.start_as_current_span("temp_repo.git_crypt_unlock"):
+            await run(f"cd {path}; git-crypt unlock {GIT_CRYPT_KEY_FILE}")
+
+
+def is_sha(sha_or_ref: str | None) -> bool:
+    """Check if the given string is a valid SHA-1 hash or a short SHA."""
+    if not sha_or_ref:
+        return False
+    return bool(re.fullmatch(r"[a-fA-F0-9]{4,40}", sha_or_ref))
+
+
+@asynccontextmanager
+async def temp_repo(git_repo_url: str, ref: str | None) -> AsyncGenerator[str, None]:
+    """Checks out a git_repo_url to a temporary folder location. Returns temporary folder location"""
+    # Someone passed us a branch name, not a sha
+
+    if not is_sha(ref):
+        async with temp_repo_branch(git_repo_url, branch=ref) as temp_repo_path:
+            yield temp_repo_path
+            return
+
+    assert ref is not None  # is_sha() returns False for None
+    with tracer.start_as_current_span("checkout_temp_repo"):
+        cache_path = await ensure_repo_cache(git_repo_url, ref)
+
+        # Copy the repo cache to a temporary folder
+        with tempfile.TemporaryDirectory() as temporary_folder_path:
+            await run(f"rm -rf {temporary_folder_path}", suppress_errors=True)
+            await run(f"cp -r {cache_path} {temporary_folder_path}")
+            # ref is already in the cache, so no per-copy fetch.
+            await run(f"cd {temporary_folder_path};git checkout {ref}")
+
+            yield temporary_folder_path
+
+
+async def _git(repo: str, *args: str, stdin: bytes | None = None) -> bytes:
+    """Run git in `repo`, returning raw stdout.
+
+    Not `run()`: blobs are binary, and `run()` decodes and logs every line.
+    """
+    proc = await asyncio.create_subprocess_exec(
+        "git",
+        "-C",
+        repo,
+        *args,
+        stdin=asyncio.subprocess.PIPE if stdin is not None else None,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.PIPE,
+    )
+    stdout, stderr = await proc.communicate(stdin)
+    if proc.returncode != 0:
+        raise Exception(f"git {' '.join(args)} failed in {repo}: {stderr.decode(errors='replace')}")
+    return stdout
+
+
+async def ensure_repo_cache(git_repo_url: str, ref: str) -> str:
+    """Clone the shared cache if absent and ensure `ref` is in it."""
+    cache_path = REPO_CACHE_DIR / git_repo_url.split("/")[-1].split(".")[0]
+    async with repo_lock:
+        if not (cache_path / ".git").exists():
+            logger.info("Repo %s not in cache, cloning", git_repo_url)
+            if cache_path.exists():
+                await run(f"rm -rf {cache_path}", suppress_errors=True)
+            cache_path.mkdir(parents=True)
+            REPO_CACHE[git_repo_url] = cache_path
+            await clone_repo(git_repo_url, path=str(cache_path))
+
+        try:
+            await _git(str(cache_path), "cat-file", "-e", f"{ref}^{{commit}}")
+        except Exception:
+            logger.info("Ref %s not in cache, fetching", ref)
+            await _git(str(cache_path), "fetch", "--quiet", "origin")
+    return str(cache_path)
+
+
+async def list_tree_blobs(repo: str, sha: str, prefix: str) -> dict[str, str]:
+    """Map path -> blob oid for every file under `prefix` at `sha`."""
+    out = await _git(repo, "ls-tree", "-r", sha, "--", prefix)
+    blobs: dict[str, str] = {}
+    for line in out.decode().splitlines():
+        meta, _, path = line.partition("\t")
+        parts = meta.split()
+        if len(parts) == 3 and parts[1] == "blob":
+            blobs[path] = parts[2]
+    return blobs
+
+
+async def read_blobs(repo: str, oids: list[str]) -> dict[str, bytes]:
+    """Read many blobs in a single `git cat-file --batch` process."""
+    if not oids:
+        return {}
+    out = await _git(repo, "cat-file", "--batch", stdin=("\n".join(oids) + "\n").encode())
+
+    contents: dict[str, bytes] = {}
+    pos = 0
+    while pos < len(out):
+        eol = out.find(b"\n", pos)
+        if eol == -1:
+            break
+        header = out[pos:eol].decode()
+        pos = eol + 1
+        parts = header.split()
+        if len(parts) != 3:
+            # "<oid> missing" — nothing to consume for this entry.
+            continue
+        oid, _, size = parts[0], parts[1], int(parts[2])
+        contents[oid] = out[pos : pos + size]
+        pos += size + 1  # trailing newline
+    return contents
+
+
+async def decrypt_blob(repo: str, content: bytes) -> bytes:
+    """Decrypt a git-crypt blob; unencrypted content passes through.
+
+    Reading a blob bypasses the smudge filter, so apply it explicitly.
+    """
+    if not content.startswith(GIT_CRYPT_MAGIC):
+        return content
+    async with decrypt_semaphore:
+        proc = await asyncio.create_subprocess_exec(
+            "git-crypt",
+            "smudge",
+            cwd=repo,
+            stdin=asyncio.subprocess.PIPE,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+        )
+        stdout, stderr = await proc.communicate(content)
+    if proc.returncode != 0:
+        raise Exception(f"git-crypt smudge failed in {repo}: {stderr.decode(errors='replace')}")
+    return stdout
+
+
+@asynccontextmanager
+async def temp_repo_branch(git_repo_url: str, branch: str | None) -> AsyncGenerator[str, None]:
+    """Checks out a git_repo_url to a temporary folder location. Returns temporary folder location"""
+    with tracer.start_as_current_span("checkout_temp_repo_branch"):
+        # Copy the repo cache to a temporary folder
+        with tempfile.TemporaryDirectory() as temporary_folder_path:
+            await clone_repo(git_repo_url, path=str(temporary_folder_path), branch=branch)
+            yield temporary_folder_path

gitops-1.8.0/gitops_server/version.py

@@ -0,0 +1 @@
+__version__ = "1.8.0"

{gitops-1.6.3 → gitops-1.8.0}/gitops_server/workers/deployer/deploy.py

@@ -1,19 +1,23 @@
 import asyncio
+import copy
 import json
 import logging
 import os
+import posixpath
 import tempfile
 import time
 import uuid
 from typing import Any
 
+import yaml
 from opentelemetry import trace
 
 from gitops.common.app import App
+from gitops.common.utils import deep_merge
 from gitops_server import settings
 from gitops_server.types import AppDefinitions, RunOutput, UpdateAppResult
 from gitops_server.utils import get_repo_name_from_url, github, run, slack
-from gitops_server.utils.git import temp_repo
+from gitops_server.utils.git import decrypt_blob, ensure_repo_cache, list_tree_blobs, read_blobs, temp_repo
 from gitops_server.workers.deployer.semaphore_manager import AppSemaphoreManager
 
 from .hooks import handle_failed_deploy, handle_successful_deploy
@@ -41,12 +45,75 @@ async def post_result_summary(source: str, results: list[UpdateAppResult]) -> No
     )
 
 
+APPS_PREFIX = "apps/"
+# The shared definition every app `extends`.
+ROOT_DEPLOYMENT = "apps/deployment.yml"
+
+
+def _resolve_extends(
+    values: dict[str, Any],
+    path: str,
+    definitions: dict[str, dict[str, Any]],
+    resolved: dict[str, dict[str, Any]],
+) -> dict[str, Any]:
+    """Resolve `extends:` against blobs, not the filesystem.
+
+    Mirrors resolve_values(), which reads a checkout we no longer produce.
+    """
+    if "extends" not in values:
+        return values
+    parent_path = posixpath.normpath(posixpath.join(posixpath.dirname(path), values["extends"]))
+    if parent_path not in resolved:
+        parent = definitions.get(parent_path, {})
+        resolved[parent_path] = _resolve_extends(parent, parent_path, definitions, resolved)
+    # deep_merge mutates its first arg, and every app shares this parent.
+    return deep_merge(copy.deepcopy(resolved[parent_path]), values)
+
+
 @tracer.start_as_current_span("load_app_definitions")
 async def load_app_definitions(url: str, sha: str) -> AppDefinitions:
+    """Build this cluster's app definitions from git blobs, with no checkout.
+
+    `temp_repo` copies ~38MB per call, twice per push, to read <1MB of YAML.
+    `deployment.yml` is plaintext in git, so other clusters' apps are dropped
+    before anything is decrypted.
+    """
     logger.info(f'Loading app definitions at "{sha}".')
-    async with temp_repo(url, ref=sha) as repo:
-        app_definitions = AppDefinitions(name=get_repo_name_from_url(url), path=repo)
-        return app_definitions
+    repo = await ensure_repo_cache(url, sha)
+    blobs = await list_tree_blobs(repo, sha, APPS_PREFIX)
+
+    deployment_paths = {
+        path: oid for path, oid in blobs.items() if path == ROOT_DEPLOYMENT or path.endswith("/deployment.yml")
+    }
+    raw = await read_blobs(repo, list(set(deployment_paths.values())))
+    definitions = {path: (yaml.safe_load(raw.get(oid, b"")) or {}) for path, oid in deployment_paths.items()}
+
+    resolved: dict[str, dict[str, Any]] = {}
+    keep: dict[str, dict[str, Any]] = {}
+    for path, values in definitions.items():
+        # apps/<name>/deployment.yml; anything else is the shared parent.
+        parts = path.split("/")
+        if path == ROOT_DEPLOYMENT or len(parts) != 3:
+            continue
+        merged = _resolve_extends(values, path, definitions, resolved)
+        if merged.get("cluster") != settings.CLUSTER_NAME or "suspended" in (merged.get("tags") or []):
+            continue
+        keep[parts[1]] = merged
+
+    # Only our own apps pay for decryption.
+    secret_oids = {name: blobs.get(f"{APPS_PREFIX}{name}/secrets.yml") for name in keep}
+    raw_secrets = await read_blobs(repo, [oid for oid in secret_oids.values() if oid])
+
+    async def build(name: str, merged: dict[str, Any]) -> tuple[str, App]:
+        secrets: dict[str, str] = {}
+        oid = secret_oids.get(name)
+        if oid:
+            plaintext = await decrypt_blob(repo, raw_secrets.get(oid, b""))
+            secrets = (yaml.safe_load(plaintext) or {}).get("secrets", {})
+        return name, App(name, deployments=merged, secrets=secrets, account_id=settings.ACCOUNT_ID)
+
+    built = await asyncio.gather(*(build(name, merged) for name, merged in keep.items()))
+    return AppDefinitions(name=get_repo_name_from_url(url), apps=dict(built))
 
 
 class Deployer:

{gitops-1.6.3 → gitops-1.8.0}/gitops_server/workers/deployer/worker.py

@@ -4,6 +4,7 @@ from typing import Any
 
 from opentelemetry import trace
 
+from ... import settings
 from .deploy import Deployer
 from .semaphore_manager import AppSemaphoreManager
 
@@ -33,6 +34,10 @@ class DeployQueueWorker:
         self.queue: asyncio.Queue[Any] = asyncio.Queue()
         self.semaphore_manager = AppSemaphoreManager()
         self.active_deployments: set[asyncio.Task[None]] = set()
+        # Bounds work in flight ahead of GITOPS_MAX_PARALLEL_DEPLOYS, which only
+        # gates the helm stage. Everything before it -- loading app definitions
+        # for two commits -- was previously limited only by webhook arrival rate.
+        self.deployment_semaphore = asyncio.Semaphore(int(settings.GITOPS_MAX_CONCURRENT_DEPLOYMENTS))
 
     async def enqueue(self, work: Any) -> None:
         """Enqueue an item of work for future processing.
@@ -56,9 +61,17 @@ class DeployQueueWorker:
                 # Clean up completed tasks
                 self.active_deployments = {task for task in self.active_deployments if not task.done()}
 
-                # Process new work
-                work = await self.queue.get()
-                deployment_task = asyncio.create_task(self.process_deployment(work))
+                # Process new work. Acquire before dequeuing so a burst backs up
+                # in the queue rather than as in-flight tasks. Once the task
+                # exists it owns the release; until then this frame does, or the
+                # slot is lost for the life of the process.
+                await self.deployment_semaphore.acquire()
+                try:
+                    work = await self.queue.get()
+                    deployment_task = asyncio.create_task(self.process_deployment(work))
+                except BaseException:
+                    self.deployment_semaphore.release()
+                    raise
                 self.active_deployments.add(deployment_task)
 
                 # Log current status
@@ -79,6 +92,12 @@ class DeployQueueWorker:
         ref = work.get("ref")
         logger.info(f'Processing deployment for push to "{ref}".')
 
+        try:
+            await self._process_deployment(work, ref)
+        finally:
+            self.deployment_semaphore.release()
+
+    async def _process_deployment(self, work: Any, ref: str | None) -> None:
         if ref == "refs/heads/master":
             with tracer.start_as_current_span("gitops_process_webhook") as current_span:
                 try:

{gitops-1.6.3 → gitops-1.8.0}/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "gitops"
-version = "1.6.3"
+version = "1.8.0"
 description = "Manage multiple apps across one or more k8s clusters."
 requires-python = ">=3.12"
 readme = "README.md"
@@ -45,16 +45,16 @@ server = [
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
-[tool.uv]
-dev-dependencies = [
-    "pytest>=8.3.2",
+[dependency-groups]
+dev = [
+    "pytest>=9.0.3",
     "ruff>=0.6.3",
     "types-colorama>=0.4.15.20240311",
     "mypy>=1.15",
     "types-pyyaml>=6.0.12.20240808",
     "types-tabulate>=0.9.0.20240106",
     "boto3-stubs>=1.35.11",
-    "pytest-asyncio>=0.24.0",
+    "pytest-asyncio>=1.0.0",
     "types-invoke>=2.0.0.10",
 ]
 

gitops-1.8.0/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>uptick/renovate-config"
+  ]
+}

gitops-1.8.0/tests/test_clone_credentials.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+import gitops_server.utils.git as git
+
+TOKEN = "ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"  # noqa: S105
+URL = "https://github.com/uptick/uptick-cluster.git"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("kwargs", [{}, {"sha": "a" * 40}, {"branch": "master"}])
+async def test_clone_command_never_contains_the_token(monkeypatch, kwargs):
+    """Credentials come from the git credential helper configured in the image,
+    so nothing run() logs, raises or returns can carry the token."""
+    monkeypatch.setenv("GITHUB_OAUTH_TOKEN", TOKEN)
+    monkeypatch.delenv("GIT_CRYPT_KEY_FILE", raising=False)
+    with patch.object(git, "run", new=AsyncMock()) as run_mock:
+        await git.clone_repo(URL, path="/tmp/x", **kwargs)
+    commands = " ".join(str(c) for c in run_mock.call_args_list)
+    assert TOKEN not in commands
+    assert URL in commands
+
+
+def test_image_configures_a_helper_holding_no_secret():
+    """The Dockerfile is what makes the clean URLs above authenticate."""
+    dockerfile = (Path(__file__).parent.parent / "Dockerfile").read_text()
+    assert "credential.helper" in dockerfile
+    # A reference to the env var, never a value baked into the image.
+    assert "$GITHUB_OAUTH_TOKEN" in dockerfile
+    assert "ghp_" not in dockerfile