graph-agents-cli 0.3.1__py3-none-any.whl

graph_agents_cli/scaffold/deployment_targets/kubernetes/python/tests/integration/test_chart.py

@@ -0,0 +1,269 @@
+# Copyright 2026 graph-agents-cli contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Lint and render the Helm chart when `helm` is on PATH (skipped otherwise).
+
+The chart declares optional subcharts; `helm dependency build` needs the
+chart registry, so it is attempted once and the test skips when it cannot run.
+
+The values files are yours: every expectation below is read from them
+(values.yaml overlaid with values-<env>.yaml, as helm merges them), so turning
+the gateway off, an ingress on or the bundled Postgres off keeps these tests
+green as long as the chart renders what the values ask for. They also hold
+whatever image tags the values files carry: in argocd mode CI and
+`graph-agents-cli deploy` commit the tag to values-<env>.yaml, and the pull
+request that does so runs them too. What stays fixed is the security posture:
+probes and metrics are never published, pods are hardened.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+import yaml
+
+PROJECT_NAME = "{{cookiecutter.project_name}}"
+CHART = Path(__file__).resolve().parents[2] / "deployment" / "helm" / PROJECT_NAME
+ENVIRONMENTS = ("dev", "staging", "prod")
+HELM = shutil.which("helm")
+# The Gateway the scaffolded staging/prod values leave for the operator to name.
+GATEWAY = ("--set", "gateway.parentRef.name=gw")
+# What `graph-agents-cli deploy` passes: the image tag it deploys (always as a
+# string), and the Gateway.
+DEPLOY_ARGS = ("--set-string", "image.tag=0123abc", *GATEWAY)
+
+pytestmark = pytest.mark.skipif(HELM is None, reason="helm is not installed")
+
+
+def _helm(*args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run([HELM or "helm", *args], capture_output=True, text=True, check=False)
+
+
+def _render(env: str, *extra: str) -> subprocess.CompletedProcess[str]:
+    return _helm(
+        "template",
+        PROJECT_NAME,
+        str(CHART),
+        "-f",
+        str(CHART / f"values-{env}.yaml"),
+        "--namespace",
+        f"{PROJECT_NAME}-{env}",
+        *extra,
+    )
+
+
+def _docs(manifests: str) -> list[dict]:
+    return [doc for doc in yaml.safe_load_all(manifests) if doc]
+
+
+def _agent_deployment(manifests: str) -> dict:
+    for doc in _docs(manifests):
+        if doc["kind"] == "Deployment" and doc["metadata"]["name"] == PROJECT_NAME:
+            return doc
+    raise AssertionError("the agent Deployment was not rendered")
+
+
+def _committed_tag(env: str) -> str:
+    values = yaml.safe_load((CHART / f"values-{env}.yaml").read_text()) or {}
+    return str((values.get("image") or {}).get("tag") or "")
+
+
+def _merge(base: dict, override: dict) -> dict:
+    """Helm's values merge: maps merge key by key, anything else is replaced."""
+    merged = dict(base)
+    for key, value in override.items():
+        if isinstance(value, dict) and isinstance(merged.get(key), dict):
+            merged[key] = _merge(merged[key], value)
+        else:
+            merged[key] = value
+    return merged
+
+
+def _values(env: str) -> dict:
+    """The values `helm template -f values-<env>.yaml` renders with."""
+    base = yaml.safe_load((CHART / "values.yaml").read_text()) or {}
+    return _merge(base, yaml.safe_load((CHART / f"values-{env}.yaml").read_text()) or {})
+
+
+def _enabled(values: dict, key: str) -> bool:
+    return bool((values.get(key) or {}).get("enabled"))
+
+
+def _published_paths(manifests: str) -> dict[str, str]:
+    """Every path the HTTPRoute and the Ingress publish: path -> match type."""
+    paths: dict[str, str] = {}
+    for doc in _docs(manifests):
+        if doc["kind"] == "HTTPRoute":
+            for rule in doc["spec"]["rules"]:
+                for match in rule["matches"]:
+                    paths[match["path"]["value"]] = match["path"]["type"]
+        elif doc["kind"] == "Ingress":
+            for rule in doc["spec"]["rules"]:
+                for entry in rule["http"]["paths"]:
+                    kind = "Exact" if entry["pathType"] == "Exact" else "PathPrefix"
+                    paths[entry["path"]] = kind
+    return paths
+
+
+def _configured_paths(values: dict) -> dict[str, str]:
+    """route.publicPaths, plus route.devPaths while env.APP_ENV is exactly dev (as the chart does)."""
+    route = values.get("route") or {}
+    entries = list(route.get("publicPaths") or [])
+    if str((values.get("env") or {}).get("APP_ENV", "")) == "dev":
+        entries += list(route.get("devPaths") or [])
+    return {str(e["path"]): str(e["type"]) for e in entries}
+
+
+@pytest.fixture(scope="module")
+def chart_with_dependencies() -> Path:
+    if not (CHART / "charts").exists():
+        result = _helm("dependency", "build", str(CHART))
+        if result.returncode != 0:
+            pytest.skip(
+                f"helm dependency build failed (no registry access?): {result.stderr[-400:]}"
+            )
+    return CHART
+
+
+def test_helm_lint(chart_with_dependencies: Path) -> None:
+    for env in ENVIRONMENTS:
+        result = _helm(
+            "lint",
+            str(chart_with_dependencies),
+            "-f",
+            str(chart_with_dependencies / f"values-{env}.yaml"),
+            *DEPLOY_ARGS,
+        )
+        assert result.returncode == 0, f"{env}: {result.stdout}\n{result.stderr}"
+
+
+def test_helm_template_renders_every_environment(chart_with_dependencies: Path) -> None:
+    for env in ENVIRONMENTS:
+        values = _values(env)
+        result = _render(env, *DEPLOY_ARGS)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        out = result.stdout
+        assert "kind: Deployment" in out and "kind: Service" in out and "kind: ConfigMap" in out
+        kinds = {doc["kind"] for doc in _docs(out)}
+        container = _agent_deployment(out)["spec"]["template"]["spec"]["containers"][0]
+        secret_ref = container["envFrom"][0]["secretRef"]
+        assert secret_ref["name"] == f"{PROJECT_NAME}-app"
+        # secretOptional: false (the default) keeps pods without their keys from starting.
+        assert secret_ref["optional"] is bool(values.get("secretOptional", False)), env
+        assert ("HTTPRoute" in kinds) is _enabled(values, "gateway"), env
+        assert ("Ingress" in kinds) is _enabled(values, "ingress"), env
+        bundled = f"$(POSTGRES_PASSWORD)@{PROJECT_NAME}-postgresql" in out
+        assert bundled is _enabled(values, "postgresql"), env
+
+
+def test_the_route_publishes_the_api_but_not_probes_or_metrics(
+    chart_with_dependencies: Path,
+) -> None:
+    routed = [
+        env
+        for env in ENVIRONMENTS
+        if _enabled(_values(env), "gateway") or _enabled(_values(env), "ingress")
+    ]
+    if not routed:
+        pytest.skip("no environment enables gateway or ingress")
+    for env in routed:
+        values = _values(env)
+        result = _render(env, *DEPLOY_ARGS)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        paths = _published_paths(result.stdout)
+        # Exactly what the values list: nothing else reaches the Gateway or Ingress.
+        assert paths == _configured_paths(values), env
+        for private in ("/", "/health", "/ready", "/metrics"):
+            assert private not in paths, (env, private)
+
+
+def test_pods_are_hardened_probed_and_sized(chart_with_dependencies: Path) -> None:
+    for env in ENVIRONMENTS:
+        result = _render(env, *DEPLOY_ARGS)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        pod = _agent_deployment(result.stdout)["spec"]["template"]["spec"]
+        container = pod["containers"][0]
+        assert container["image"].endswith(":0123abc")
+        assert pod["automountServiceAccountToken"] is False
+        assert pod["securityContext"]["runAsNonRoot"] is True
+        assert pod["securityContext"]["seccompProfile"]["type"] == "RuntimeDefault"
+        security = container["securityContext"]
+        assert security["readOnlyRootFilesystem"] is True
+        assert security["allowPrivilegeEscalation"] is False
+        assert security["capabilities"]["drop"] == ["ALL"]
+        assert {"name": "tmp", "mountPath": "/tmp"} in container["volumeMounts"]
+        assert container["readinessProbe"]["httpGet"]["path"] == "/ready"
+        assert container["livenessProbe"]["httpGet"]["path"] == "/health"
+        assert container["startupProbe"]["httpGet"]["path"] == "/health"
+        assert container["resources"]["requests"]["cpu"]
+        assert container["resources"]["limits"]["memory"]
+
+
+def test_pods_drain_before_they_are_killed(chart_with_dependencies: Path) -> None:
+    """A stopping pod keeps serving during the preStop pause and drains within the grace period."""
+    for env in ENVIRONMENTS:
+        result = _render(env, *DEPLOY_ARGS)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        pod = _agent_deployment(result.stdout)["spec"]["template"]["spec"]
+        container = pod["containers"][0]
+        values = yaml.safe_load((CHART / "values.yaml").read_text()) or {}
+        overrides = yaml.safe_load((CHART / f"values-{env}.yaml").read_text()) or {}
+        shutdown = {**(values.get("shutdown") or {}), **(overrides.get("shutdown") or {})}
+        pause = int(shutdown.get("preStopSleepSeconds") or 0)
+        drain = int(shutdown.get("drainSeconds") or 0)
+        assert pod["terminationGracePeriodSeconds"] > pause + drain, env
+        if pause:
+            command = container["lifecycle"]["preStop"]["exec"]["command"]
+            assert command[-1] == f"sleep {pause}", env
+
+
+def test_the_network_policy_example_renders_a_valid_policy(chart_with_dependencies: Path) -> None:
+    """examples/networkpolicy.yaml, as documented: copied over the staging or prod values."""
+    example = CHART / "examples" / "networkpolicy.yaml"
+    if not example.is_file():
+        pytest.skip("no examples/networkpolicy.yaml")
+    for env in ("staging", "prod"):
+        result = _render(env, "-f", str(example), *DEPLOY_ARGS)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        policy = next(d for d in _docs(result.stdout) if d["kind"] == "NetworkPolicy")
+        spec = policy["spec"]
+        assert spec["policyTypes"] == ["Ingress", "Egress"], env
+        assert spec["ingress"] and all(rule.get("ports") for rule in spec["ingress"]), env
+        # Every egress rule names its ports: nothing is open to any port anywhere.
+        assert all(rule.get("ports") for rule in spec["egress"]), env
+        dns = {p["port"] for p in spec["egress"][0]["ports"]}
+        assert dns == {53}, env
+
+
+def test_the_chart_refuses_to_render_without_an_image_tag(chart_with_dependencies: Path) -> None:
+    # An explicit empty tag: the committed values-<env>.yaml may already name one.
+    for env in ENVIRONMENTS:
+        result = _render(env, "--set-string", "image.tag=", *GATEWAY)
+        assert result.returncode != 0, env
+        assert "image.tag is empty" in result.stderr, env
+
+
+def test_committed_image_tags_are_the_ones_deployed(chart_with_dependencies: Path) -> None:
+    """A tag written into values-<env>.yaml (argocd mode) renders as Argo CD renders it."""
+    tagged = {env: tag for env in ENVIRONMENTS if (tag := _committed_tag(env))}
+    if not tagged:
+        pytest.skip("no values-<env>.yaml names an image tag yet")
+    for env, tag in tagged.items():
+        result = _render(env, *GATEWAY)
+        assert result.returncode == 0, f"{env}: {result.stderr}"
+        container = _agent_deployment(result.stdout)["spec"]["template"]["spec"]["containers"][0]
+        assert container["image"].endswith(f":{tag}"), (env, container["image"])

graph_agents_cli/scaffold/deployment_targets/none/README.md

@@ -0,0 +1,5 @@
+# Deployment target `none`
+
+Marker for the target that ships no deployment files. `python/` holds only a
+fallback README so a project built on the empty base has one; the langgraph
+template overlays its own.

graph_agents_cli/scaffold/deployment_targets/none/python/README.md

@@ -0,0 +1,6 @@
+# {{cookiecutter.project_name}}
+
+Created by graph-agents-cli with `--deployment-target none`: no `deployment/`
+directory, no CD workflows. Run it locally with `graph-agents-cli playground`
+or `graph-agents-cli run "prompt"`; add a Kubernetes target later with
+`graph-agents-cli scaffold enhance --deployment-target kubernetes`.

graph_agents_cli/scaffold/utils/__init__.py

@@ -0,0 +1,13 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

graph_agents_cli/scaffold/utils/backup.py

@@ -0,0 +1,212 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Shared backup utility for project directories.
+
+A backup is the undo of ``enhance`` and ``upgrade``, so it copies the whole
+project, ``.env`` included (both commands merge it, and a generated project
+gitignores it, so the backup may hold the user's only copy). Because of that it
+is private: the backups directory and every backup are 0700 and every ``.env*``
+file in them 0600. Only the newest ``KEEP_BACKUPS`` backups of a project are
+kept, so credentials do not pile up in the home directory.
+
+A backup is named ``<directory>_<project id>_<timestamp>[_n]``. The project id
+is a hash of the project's resolved absolute path and its manifest ``name``, so
+two checkouts with the same directory name (``my-agent`` in two places) never
+count as one project: pruning only ever deletes backups carrying the id of the
+project being backed up. Backups named without an id (made by an older CLI)
+are never pruned.
+"""
+
+import contextlib
+import datetime
+import hashlib
+import os
+import pathlib
+import re
+import shutil
+from collections.abc import Callable
+
+import click
+import yaml
+
+from graph_agents_cli._output import Console
+
+from .fs import standard_ignore_patterns
+
+BACKUP_BASE_DIR = pathlib.Path.home() / ".graph-agents-cli" / "backups"
+# Backups kept per project (by project id); older ones are deleted.
+KEEP_BACKUPS = 5
+_PRIVATE_DIR = 0o700
+_PRIVATE_FILE = 0o600
+_MANIFEST_FILENAME = "graph-agents-cli-manifest.yaml"
+_ID_LENGTH = 12
+
+
+def project_backup_id(project_dir: pathlib.Path) -> str:
+    """A stable id for ``project_dir``: its resolved absolute path plus its manifest ``name``."""
+    name = ""
+    try:
+        data = yaml.safe_load((project_dir / _MANIFEST_FILENAME).read_text(encoding="utf-8"))
+        if isinstance(data, dict) and data.get("name") is not None:
+            name = str(data["name"])
+    except (OSError, UnicodeDecodeError, yaml.YAMLError):
+        pass  # no (readable) manifest: the path alone identifies the directory
+    key = f"{project_dir.resolve()}\0{name}".encode()
+    return hashlib.sha256(key).hexdigest()[:_ID_LENGTH]
+
+
+def _backup_prefix(project_dir: pathlib.Path) -> str:
+    return f"{project_dir.name}_{project_backup_id(project_dir)}"
+
+
+def create_project_backup(
+    project_dir: pathlib.Path,
+    console: Console | None = None,
+    auto_approve: bool = False,
+    interactive: bool = False,
+) -> pathlib.Path | None:
+    """Create a backup of the project directory.
+
+    Backs up to ~/.graph-agents-cli/backups/<directory>_<project id>_<timestamp>/.
+
+    Args:
+        project_dir: Path to the project directory to back up.
+        console: Rich console for output. Created if not provided.
+        auto_approve: If True, skip confirmation prompts on failure.
+        interactive: If True, show interactive prompt on backup failure.
+
+    Returns:
+        Path to the backup directory on success, None if backup failed
+        but user chose to continue.
+
+    Raises:
+        click.Abort: If backup failed and user chose to cancel (interactive mode only).
+    """
+    if console is None:
+        console = Console()
+
+    timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
+    prefix = _backup_prefix(project_dir)
+    backup_dir = BACKUP_BASE_DIR / f"{prefix}_{timestamp}"
+    suffix = 1
+    while backup_dir.exists():  # two backups within the same second
+        suffix += 1
+        backup_dir = BACKUP_BASE_DIR / f"{prefix}_{timestamp}_{suffix}"
+
+    console.print("📦 [blue]Creating backup before modification...[/blue]")
+
+    try:
+        BACKUP_BASE_DIR.mkdir(parents=True, exist_ok=True)
+        _make_private_dir(BACKUP_BASE_DIR)
+        shutil.copytree(project_dir, backup_dir, ignore=standard_ignore_patterns)
+        _make_private_tree(backup_dir)
+        console.print(f"Backup created: [cyan]{backup_dir}[/cyan]")
+        pruned = prune_backups(project_dir, keep=KEEP_BACKUPS, current=backup_dir)
+        if pruned:
+            console.print(
+                f"[dim]Removed {len(pruned)} older backup(s) of {project_dir.name} "
+                f"(the newest {KEEP_BACKUPS} are kept).[/dim]"
+            )
+        return backup_dir
+    except Exception as e:
+        console.print(f"⚠️  [yellow]Warning: Could not create backup: {e}[/yellow]")
+        if interactive:
+            if not click.confirm("Continue without backup?", default=True):
+                raise click.Abort() from e
+        return None
+
+
+def _make_private_dir(path: pathlib.Path) -> None:
+    with contextlib.suppress(OSError):
+        os.chmod(path, _PRIVATE_DIR)
+
+
+def _make_private_tree(root: pathlib.Path) -> None:
+    """0700 on the backup and its directories, 0600 on the env files it holds."""
+    _make_private_dir(root)
+    for dirpath, dirnames, filenames in os.walk(root):
+        for name in dirnames:
+            _make_private_dir(pathlib.Path(dirpath) / name)
+        for name in filenames:
+            if name.startswith(".env"):
+                with contextlib.suppress(OSError):
+                    os.chmod(pathlib.Path(dirpath) / name, _PRIVATE_FILE)
+
+
+def prune_backups(
+    project_dir: pathlib.Path, *, keep: int = KEEP_BACKUPS, current: pathlib.Path | None = None
+) -> list[pathlib.Path]:
+    """Delete all but the newest ``keep`` backups of ``project_dir``; return what was removed.
+
+    Only directories named exactly ``<directory>_<project id>_<YYYYmmdd>_<HHMMSS>[_n]``
+    with this project's id are considered: another project is never touched,
+    whether its name shares a prefix or is the same (another checkout), backups
+    without an id are left alone, and ``current`` (the backup just made) is
+    never removed.
+    """
+    if not BACKUP_BASE_DIR.is_dir():
+        return []
+    prefix = _backup_prefix(project_dir)
+    pattern = re.compile(rf"^{re.escape(prefix)}_(\d{{8}}_\d{{6}})(?:_(\d+))?$")
+    found: list[tuple[str, int, pathlib.Path]] = []
+    for entry in BACKUP_BASE_DIR.iterdir():
+        match = pattern.match(entry.name)
+        if match and entry.is_dir() and not entry.is_symlink():
+            found.append((match.group(1), int(match.group(2) or 1), entry))
+    found.sort(reverse=True)
+    removed: list[pathlib.Path] = []
+    for _stamp, _n, entry in found[max(keep, 1) :]:
+        if current is not None and entry == current:
+            continue
+        shutil.rmtree(entry, ignore_errors=True)
+        removed.append(entry)
+    return removed
+
+
+def make_backup_pre_apply_hook(
+    *,
+    console: Console,
+    auto_approve: bool,
+    interactive: bool,
+) -> Callable[[pathlib.Path], bool]:
+    """Build a ``run_three_way_merge`` pre-apply hook that backs up the project.
+
+    The merge invokes the hook right before it writes changes; returning False
+    aborts the merge. This wraps ``create_project_backup`` so a user cancelling
+    the "continue without backup?" prompt cleanly stops the operation.
+
+    Args:
+        console: Rich console for output.
+        auto_approve: If True, skip confirmation prompts on failure.
+        interactive: If True, prompt the user on backup failure.
+
+    Returns:
+        A hook taking the project directory and returning True to proceed,
+        False if the user cancelled.
+    """
+
+    def _backup(proj_dir: pathlib.Path) -> bool:
+        try:
+            create_project_backup(
+                proj_dir,
+                console=console,
+                auto_approve=auto_approve,
+                interactive=interactive,
+            )
+            return True
+        except click.Abort:
+            return False  # user cancelled
+
+    return _backup