hawk 2.0.0__tar.gz

hawk-2.0.0/.cursor/rules/api-patterns.mdc

@@ -0,0 +1,13 @@
+---
+description:
+globs: hawk/api/**/*.py
+alwaysApply: false
+---
+# API Development Patterns
+
+- Use FastAPI dependency injection for shared resources
+- Define Pydantic models for all request and response bodies
+- Use async def for all endpoint handlers
+- Use the `validate_access_token` middleware (automatically added to all endpoints) for authentication
+- Return appropriate HTTP status codes (201 for creation, 204 for deletion, etc.)
+- Include proper OpenAPI documentation in endpoints

hawk-2.0.0/.cursor/rules/architecture.mdc

@@ -0,0 +1,6 @@
+---
+description:
+globs:
+alwaysApply: true
+---
+@ARCHITECTURE.md

hawk-2.0.0/.cursor/rules/cli-structure.mdc

@@ -0,0 +1,31 @@
+---
+description:
+globs: hawk/*.py
+alwaysApply: false
+---
+# CLI Development Structure
+
+## Architecture
+- `cli.py` contains command definitions and presentation logic only
+- Each command's business logic lives in a separate file (e.g., `login.py`, `view.py`, `runs.py`)
+- Keep `cli.py` focused on:
+  - Command definitions with Click decorators
+  - Argument parsing and validation
+  - Output formatting and presentation
+  - User interaction logic
+
+## Click Patterns
+- Use `click.echo()` for output, not print()
+- Import business logic in-line, only in the command handlers where it is used
+
+Example structure:
+```python
+# In cli.py
+@click.command()
+@click.option('--format', type=click.Choice(['json', 'table']))
+def my_command(format):
+    import hawk.my_command
+
+    result = my_command()
+    click.echo(format_output(result, format))
+```

hawk-2.0.0/.cursor/rules/dev-workflow.mdc

@@ -0,0 +1,6 @@
+---
+description:
+globs:
+alwaysApply: true
+---
+@CONTRIBUTING.md

hawk-2.0.0/.cursor/rules/kubernetes-helm.mdc

@@ -0,0 +1,11 @@
+---
+description:
+globs: hawk/api/**/*.py,hawk/api/helm_chart/**/*
+alwaysApply: false
+---
+# Kubernetes Operations
+
+- **Important**: We use a Helm chart to create Kubernetes objects. Add new resources to the Helm chart instead of creating them directly with the k8s client
+  - The Helm chart is located at `hawk/api/helm_chart/`
+- The Hawk API server uses pyhelm3 (https://github.com/azimuth-cloud/pyhelm3) to execute Helm commands. Under the hood, this delegates to the helm CLI
+- Only the API server should execute Helm commands using pyhelm3. No other component should do that

hawk-2.0.0/.cursor/rules/python-standards.mdc

@@ -0,0 +1,42 @@
+---
+description:
+globs:
+alwaysApply: true
+---
+# Python Development Standards
+
+Based on the Google Python Style Guide with project-specific additions.
+
+## Imports
+- Use `import x` for packages and modules only, not for individual classes or functions
+- Import modules: `import pathlib` and reference `pathlib.Path` instead of `from pathlib import Path`
+- Importing with alias is acceptable: `import a.b.c as c`
+- Use full package names to avoid conflicts: `from sound.effects import echo`
+- Exceptions: typing, collections.abc, and typing_extensions symbols can be imported directly
+
+## Type Annotations
+- Use Pydantic models for all data structures that need validation
+
+## Comments and Docstrings
+- Keep comments minimal - explain WHY not WHAT
+- Use comments only when the reasoning behind code isn't obvious
+  - And, prefer to rewrite the code to be clearer instead of leaving such comments
+- Write docstrings when it isn't clear what a function does from its name and arguments, or for functions that are part of the public interface of some component of the system
+
+## Naming Conventions
+- Avoid single character names except for counters or iterators
+- Use descriptive names: `employee_ids` not `e_ids`
+
+## Language Features
+- Use list/dict/set comprehensions for simple cases
+- Use generators for large data processing
+- Properties: use `@property` for simple attribute access
+- Lambda functions: only for one-liners, otherwise use regular functions
+- Conditional expressions: use sparingly for simple cases
+- Avoid global state except for module-level constants
+
+## Error Handling
+- Document exceptions raised by a method using a "Raises" section in the docstring
+
+## Best Practices
+- Use parentheses for line continuation, not backslashes

hawk-2.0.0/.cursor/rules/testing-patterns.mdc

@@ -0,0 +1,57 @@
+---
+description:
+globs: **/tests/**/*
+alwaysApply: false
+---
+# Testing Standards
+
+## pytest Conventions
+- Use pytest-asyncio for testing async code
+- Always use `pytest-mock` with `autospec=True`:
+  ```python
+  mocker.patch('module.Class', autospec=True)
+  ```
+
+## Parameterization
+- Use `@pytest.mark.parametrize` instead of multiple similar tests
+- Use `pytest.param` with `id` parameter for descriptive test names
+- For error cases:
+  ```python
+  @pytest.mark.parametrize(
+      ("input", "expected_error"),
+      [
+          ("valid", None),
+          ("invalid", pytest.raises(ValueError)),
+      ]
+  )
+  def test_function(input, expected_error):
+      with expected_error or contextlib.nullcontext():
+          function(input)
+  ```
+- Avoid putting too much conditional logic in the test itself.
+  ```python
+  # Bad
+  if input1 == "abc":
+    assert result == "def"
+  else:
+    assert result == "ghi"
+
+  # Good
+  # Add an expected_result parameter to the test's pytest.params, then:
+  assert result == expected_result
+  ```
+
+## AWS Mocking
+- Use moto for mocking AWS services wherever possible:
+  ```python
+  @mock_s3
+  async def test_s3_operation():
+      # moto automatically mocks aioboto3 calls
+  ```
+
+## Assertions
+- If it's unclear at a glance what an assertion is testing, add a message, like `assert False, "Message here"`
+
+## Test Organization
+- Mirror the source code structure in tests/
+- Name test files as `test_<module>.py`

hawk-2.0.0/.dockerignore

@@ -0,0 +1,38 @@
+*
+
+!.python-version
+!uv.lock
+!pyproject.toml
+!README.md
+!.python-version
+
+!hawk
+hawk/**
+!hawk/**/*.py
+!hawk/api/helm_chart/**/*.yaml
+
+!services
+services/**
+!services/modules/**/*.py
+!services/modules/*/pyproject.toml
+!services/modules/*/README.md
+!services/modules/*/uv.lock
+!services/modules/viewer/nginx.conf
+
+!www
+www/**
+!www/package.json
+!www/pnpm-lock.yaml
+!www/pnpm-workspace.yaml
+!www/index.html
+!www/eslint.config.js
+!www/tsconfig.json
+!www/vite.config.ts
+!www/tailwind.config.js
+!www/src
+!www/src/**
+!www/public
+!www/public/**
+
+hawk/tests/**
+**/.venv/**

hawk-2.0.0/.editorconfig

@@ -0,0 +1,20 @@
+root = true
+
+[*]
+charset = utf-8
+indent_style = space
+indent_size = 2
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+indent_size = 4
+trim_trailing_whitespace = false
+insert_final_newline = false
+
+[*.{py,sh,ipynb}]
+indent_size = 4
+
+[{Dockerfile,uv.lock}]
+indent_size = 4

hawk-2.0.0/.env.example

@@ -0,0 +1,77 @@
+# Hawk development environment configuration
+# Copy this file to .env and adjust values for your setup:
+#   cp .env.example .env
+
+# CLI
+HAWK_API_URL=http://localhost:8080
+
+# API service
+
+# Auth — REQUIRED. The API server will not start without these.
+# For local dev with docker compose, the bundled Dex IDP provides these automatically.
+# If not using Dex, set these to match your OIDC provider.
+# HAWK_API_MODEL_ACCESS_TOKEN_AUDIENCE=<your-oidc-audience>
+# HAWK_API_MODEL_ACCESS_TOKEN_AUTHORIZATION_ENDPOINT=
+# HAWK_API_MODEL_ACCESS_TOKEN_CLIENT_ID=<your-oidc-client-id>
+# HAWK_API_MODEL_ACCESS_TOKEN_DEFAULT_PERMISSIONS=
+# HAWK_API_MODEL_ACCESS_TOKEN_DEVICE_AUTHORIZATION_ENDPOINT=
+# HAWK_API_MODEL_ACCESS_TOKEN_EMAIL_FIELD=
+# HAWK_API_MODEL_ACCESS_TOKEN_ISSUER=<your-oidc-issuer>
+# HAWK_API_MODEL_ACCESS_TOKEN_JWKS_URI=
+# HAWK_API_MODEL_ACCESS_TOKEN_REVOCATION_ENDPOINT=
+# HAWK_API_MODEL_ACCESS_TOKEN_SCOPES=
+# HAWK_API_MODEL_ACCESS_TOKEN_SCOPES_SUPPORTED=<["your","idp","supported","scopes"]>
+# HAWK_API_MODEL_ACCESS_TOKEN_TOKEN_ENDPOINT=
+
+# Admin (owner-bypass) — both optional, off by default. A JWT claim whose
+# boolean-true value grants admin, and/or permission/group names that grant admin.
+# HAWK_API_MODEL_ACCESS_TOKEN_ADMIN_CLAIM=https://example.com/claims/admin
+# HAWK_API_ADMIN_PERMISSIONS=["hawk-admin"]
+
+HAWK_API_DATABASE_URL=postgresql://inspect:inspect@warehouse:5432/inspect
+HAWK_API_KUBECONFIG_FILE=/home/nonroot/.kube/config
+HAWK_API_MIDDLEMAN_API_URL=http://middleman:3500
+
+HAWK_API_S3_BUCKET_NAME=inspect-data
+
+# AWS credentials for API server to access MinIO
+AWS_ACCESS_KEY_ID=minioadmin
+AWS_SECRET_ACCESS_KEY=minioadmin
+AWS_ENDPOINT_URL_S3=http://minio:9000
+AWS_REGION=us-west-1
+
+HAWK_API_APP_NAME=inspect-ai
+HAWK_API_RUNNER_CLUSTER_ROLE_NAME=inspect-ai-runner
+HAWK_API_RUNNER_DEFAULT_IMAGE_URI=registry:5000/runner:latest
+HAWK_API_RUNNER_MEMORY=16Gi
+HAWK_API_RUNNER_NAMESPACE=inspect
+HAWK_API_RUNNER_NAMESPACE_PREFIX=inspect
+HAWK_API_TASK_BRIDGE_REPOSITORY=registry:5000/task-bridge
+HAWK_API_DOCKER_IMAGE_REPO=registry:5000/tasks
+HAWK_API_ALLOW_LOCAL_DEPENDENCY_VALIDATION=true
+HAWK_API_EVAL_SET_RETRY_ATTEMPTS=1
+
+# Runner
+INSPECT_METR_TASK_BRIDGE_REPOSITORY=registry:5000/task-bridge
+
+# Runner secrets: Forward env vars to runners automatically
+# Pattern: HAWK_API_RUNNER_SECRET_<VAR_NAME>=<value>
+# The prefix is stripped and the rest becomes the env var name in the runner
+# Example: HAWK_API_RUNNER_SECRET_OPENAI_API_KEY=sk-... forwards as OPENAI_API_KEY=sk-...
+HAWK_API_RUNNER_SECRET_AWS_ACCESS_KEY_ID=test
+HAWK_API_RUNNER_SECRET_AWS_SECRET_ACCESS_KEY=testtest
+HAWK_API_RUNNER_SECRET_AWS_ENDPOINT_URL_S3=http://minio:9000
+
+# Uncomment and set values to forward API keys to runners:
+# HAWK_API_RUNNER_SECRET_GITHUB_TOKEN=ghp_xxxx
+# HAWK_API_RUNNER_SECRET_OPENAI_API_KEY=sk-xxxx
+# HAWK_API_RUNNER_SECRET_ANTHROPIC_API_KEY=sk-ant-xxxx
+
+# UI
+VITE_API_BASE_URL=http://localhost:8080
+# These should be autodiscovered via Hawk API, set here to override
+# VITE_OIDC_ISSUER=
+# VITE_OIDC_CLIENT_ID=
+# VITE_OIDC_AUTHORIZE_ENDPOINT=
+# VITE_OIDC_SCOPES=
+VITE_LOG_LEVEL=debug

hawk-2.0.0/.gitattributes

@@ -0,0 +1 @@
+hawk/api/EvalSetConfig.schema.json linguist-generated=true

hawk-2.0.0/.github/workflows/weekly-release.yaml

@@ -0,0 +1,122 @@
+name: Weekly Release
+
+on:
+  schedule:
+    - cron: "0 9 * * 1" # Monday 9am UTC
+  workflow_dispatch:
+
+concurrency:
+  group: weekly-release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/create-github-app-token@v2.2.0
+        id: app-token
+        with:
+          app-id: ${{ vars.CI_BOT_APP_ID }}
+          private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+
+      - name: Set up Git user
+        env:
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)"
+          git config --global user.name "${APP_SLUG}[bot]"
+          git config --global user.email "${user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
+
+      - name: Checkout
+        uses: actions/checkout@v6.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+
+      - name: Determine next version
+        id: version
+        run: |
+          latest_tag=$(git tag --list 'v*' --sort=-version:refname | head -n1)
+          if [ -z "$latest_tag" ]; then
+            echo "No existing tag found"
+            exit 1
+          fi
+          echo "latest_tag=$latest_tag" >> "$GITHUB_OUTPUT"
+
+          if [ -z "$(git log "${latest_tag}..HEAD" --oneline)" ]; then
+            echo "No new commits since $latest_tag — skipping release"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # CalVer: vYYYY.MM.DD
+          next_tag="v$(date -u +'%Y.%m.%d')"
+
+          # Handle multiple releases on the same day
+          if git tag --list "$next_tag" | grep -q .; then
+            i=1
+            while git tag --list "${next_tag}.${i}" | grep -q .; do
+              i=$((i + 1))
+            done
+            next_tag="${next_tag}.${i}"
+          fi
+
+          echo "next_tag=$next_tag" >> "$GITHUB_OUTPUT"
+
+      - name: Create tag and release
+        if: steps.version.outputs.skip != 'true'
+        id: release
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          NEXT_TAG: ${{ steps.version.outputs.next_tag }}
+          LATEST_TAG: ${{ steps.version.outputs.latest_tag }}
+        run: |
+          git tag "$NEXT_TAG"
+          git push origin "$NEXT_TAG"
+          gh release create "$NEXT_TAG" \
+            --generate-notes \
+            --notes-start-tag "$LATEST_TAG"
+
+      - name: Post release summary to Slack
+        if: steps.release.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          SLACK_WEBHOOK_URL: ${{ secrets.RELEASE_SLACK_WEBHOOK_URL }}
+          NEXT_TAG: ${{ steps.version.outputs.next_tag }}
+        run: |
+          release_url="https://github.com/${{ github.repository }}/releases/tag/${NEXT_TAG}"
+          notes=$(gh release view "$NEXT_TAG" --json body -q .body)
+
+          summary=$(jq -n \
+            --arg notes "$notes" \
+            --arg tag "$NEXT_TAG" \
+            '{
+              model: "claude-opus-4-6",
+              max_tokens: 4096,
+              messages: [{
+                role: "user",
+                content: ("You are summarizing a weekly release of Hawk, an infrastructure system for running AI evaluations (via Inspect AI) and scans (via Inspect Scout) in Kubernetes. Given the GitHub release notes below, write a brief Slack update (3-8 bullet points) highlighting researcher- and user-facing changes. Omit internal refactors, CI changes, and dependency bumps unless they affect users. Use plain language, not raw PR titles. If there are no user-facing changes worth highlighting, just say \"Maintenance and internal improvements only — no user-facing changes this week.\"\n\nAfter the bullet points, add a blank line and then a short, fun inspirational or motivational quote that thematically relates to the changes in this release. Be creative — it can be a real quote, a playful riff, or something original. Format it in italics like: _\"The quote here.\"_\n\nIMPORTANT: Use Slack mrkdwn formatting, NOT standard Markdown. Bold is *single asterisks*, not **double**. Italic is _underscores_. Code is `backticks`. Do not use any other formatting.\n\nOutput ONLY the bullet points followed by the quote, no preamble or header.\n\nRelease: " + $tag + "\n\nRelease notes:\n" + $notes)
+              }]
+            }' \
+            | curl -sf https://api.anthropic.com/v1/messages \
+              -H "content-type: application/json" \
+              -H "x-api-key: $ANTHROPIC_API_KEY" \
+              -H "anthropic-version: 2023-06-01" \
+              -d @- \
+            | jq -r '.content[0].text')
+
+          if [ -z "$summary" ] || [ "$summary" = "null" ]; then
+            summary="(Could not generate AI summary for this release.)"
+          fi
+
+          slack_message=$(printf '*Hawk %s is out* :rocket:\n\n%s\n\n<%s|Full release notes>' "$NEXT_TAG" "$summary" "$release_url")
+
+          jq -n --arg text "$slack_message" '{text: $text}' \
+            | curl -sf -X POST -H 'Content-type: application/json' -d @- "$SLACK_WEBHOOK_URL"