imbi-api 2.36.0__tar.gz → 2.37.0__tar.gz

{imbi_api-2.36.0 → imbi_api-2.37.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-api
-Version: 2.36.0
+Version: 2.37.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -19,7 +19,7 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,sentry,server]==2.36.0
+Requires-Dist: imbi-common[databases,llm,sentry,server]==2.37.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: mcp>=1.26.0

{imbi_api-2.36.0 → imbi_api-2.37.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.36.0"
+version = "2.37.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,sentry,server]==2.36.0",
+  "imbi-common[databases,llm,sentry,server]==2.37.0",
   "jinja2",
   "jsonpatch>=1.33",
   "mcp>=1.26.0",

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/endpoints/_helpers.py

@@ -14,7 +14,11 @@ import psycopg
 from imbi.common import graph
 from imbi.common import models as common_models
 from imbi.common import patch as json_patch
-from imbi.common.plugins.base import PluginContext, ServiceConnection
+from imbi.common.plugins.base import (
+    PluginContext,
+    ProjectDependency,
+    ServiceConnection,
+)
 
 LOGGER = logging.getLogger(__name__)
 
@@ -523,6 +527,151 @@ async def lookup_project_exists_in(
     return connections
 
 
+_DEPENDENCY_QUERIES: dict[str, typing.LiteralString] = {
+    'outbound': (
+        'MATCH (p:Project {{id: {project_id}}})-[:DEPENDS_ON]->(n:Project) '
+        'OPTIONAL MATCH (n)-[ei:EXISTS_IN]->(i:Integration) '
+        'RETURN n.id AS project_id, n.slug AS project_slug, '
+        'i.slug AS integration_slug, ei.identifier AS identifier, '
+        'ei.canonical_url AS canonical_url'
+    ),
+    'inbound': (
+        'MATCH (p:Project {{id: {project_id}}})<-[:DEPENDS_ON]-(n:Project) '
+        'OPTIONAL MATCH (n)-[ei:EXISTS_IN]->(i:Integration) '
+        'RETURN n.id AS project_id, n.slug AS project_slug, '
+        'i.slug AS integration_slug, ei.identifier AS identifier, '
+        'ei.canonical_url AS canonical_url'
+    ),
+}
+
+
+async def lookup_project_dependencies(
+    db: graph.Graph,
+    project_id: str,
+) -> list[ProjectDependency] | None:
+    """Return the project's ``DEPENDS_ON`` neighbours in both directions.
+
+    Each :class:`ProjectDependency` carries the neighbour's own
+    ``EXISTS_IN`` connections.  Populated onto
+    :attr:`PluginContext.dependencies`.  Returns ``None`` on lookup
+    failure, so callers can tell "no dependencies" from "unknown".
+    When the result is ``None``, the host must not wire
+    :attr:`PluginContext.resolve_linked_identifiers`: without a
+    resolver, capabilities do not remove remote state.
+    """
+    columns = [
+        'project_id',
+        'project_slug',
+        'integration_slug',
+        'identifier',
+        'canonical_url',
+    ]
+    dependencies: list[ProjectDependency] = []
+    for direction, query in _DEPENDENCY_QUERIES.items():
+        try:
+            records = await db.execute(
+                query, {'project_id': project_id}, columns
+            )
+        except Exception:  # noqa: BLE001
+            LOGGER.warning('Project dependency lookup failed', exc_info=True)
+            return None
+        by_id: dict[str, ProjectDependency] = {}
+        for r in records:
+            neighbour_id = graph.parse_agtype(r.get('project_id'))
+            if not neighbour_id:
+                continue
+            dep = by_id.get(str(neighbour_id))
+            if dep is None:
+                dep = ProjectDependency(
+                    direction=typing.cast(
+                        typing.Literal['inbound', 'outbound'], direction
+                    ),
+                    project_id=str(neighbour_id),
+                    project_slug=str(
+                        graph.parse_agtype(r.get('project_slug')) or ''
+                    ),
+                )
+                by_id[dep.project_id] = dep
+            slug = graph.parse_agtype(r.get('integration_slug'))
+            identifier = graph.parse_agtype(r.get('identifier'))
+            if not slug or not identifier:
+                continue
+            canonical_url = graph.parse_agtype(r.get('canonical_url'))
+            dep.service_connections.append(
+                ServiceConnection(
+                    integration_slug=str(slug),
+                    identifier=str(identifier),
+                    canonical_url=(
+                        None if canonical_url is None else str(canonical_url)
+                    ),
+                )
+            )
+        dependencies.extend(by_id.values())
+    return dependencies
+
+
+async def lookup_linked_identifiers(
+    db: graph.Graph,
+    org_slug: str,
+    integration_slug: str,
+    identifiers: list[str],
+) -> set[str]:
+    """Return the ``identifiers`` bound to a project in ``org_slug``.
+
+    Matches ``EXISTS_IN`` edges to the ``integration_slug`` Integration
+    from any project owned by a team in the organization.  Returns an
+    empty set on lookup failure, so a caller that removes remote state
+    only for linked identifiers fails safe.
+    """
+    if not identifiers:
+        return set()
+    query: typing.LiteralString = (
+        'MATCH (:Organization {{slug: {org_slug}}})<-[:BELONGS_TO]-(:Team)'
+        '<-[:OWNED_BY]-(:Project)-[ei:EXISTS_IN]->'
+        '(:Integration {{slug: {integration_slug}}}) '
+        'WHERE ei.identifier IN {identifiers} '
+        'RETURN DISTINCT ei.identifier AS identifier'
+    )
+    try:
+        records = await db.execute(
+            query,
+            {
+                'org_slug': org_slug,
+                'integration_slug': integration_slug,
+                'identifiers': identifiers,
+            },
+            ['identifier'],
+        )
+    except Exception:  # noqa: BLE001
+        LOGGER.debug('Linked identifier lookup failed', exc_info=True)
+        return set()
+    return {
+        str(value)
+        for r in records
+        if (value := graph.parse_agtype(r.get('identifier')))
+    }
+
+
+def linked_identifier_resolver(
+    db: graph.Graph, org_slug: str, integration_slug: str | None
+) -> (
+    collections.abc.Callable[[list[str]], collections.abc.Awaitable[set[str]]]
+    | None
+):
+    """Build the :attr:`PluginContext.resolve_linked_identifiers` hook.
+
+    Returns ``None`` for a capability not bound to an Integration.
+    """
+    if not integration_slug:
+        return None
+    slug = integration_slug
+
+    async def _resolve(identifiers: list[str]) -> set[str]:
+        return await lookup_linked_identifiers(db, org_slug, slug, identifiers)
+
+    return _resolve
+
+
 async def persist_service_writeback(
     db: graph.Graph, ctx: PluginContext
 ) -> None:

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/endpoints/project_analysis.py

@@ -29,6 +29,8 @@ from imbi.api.blueprint_compliance import (
     remediate_blueprint,
 )
 from imbi.api.endpoints._helpers import (
+    linked_identifier_resolver,
+    lookup_project_dependencies,
     lookup_project_exists_in,
     lookup_project_links,
     lookup_project_slugs,
@@ -110,6 +112,7 @@ async def _build_context(
     project_links = await lookup_project_links(db, project_id)
     project_type_slugs = await lookup_project_type_slugs(db, project_id)
     service_connections = await lookup_project_exists_in(db, project_id)
+    dependencies = await lookup_project_dependencies(db, project_id)
     return PluginContext(
         project_id=project_id,
         project_slug=project_slug,
@@ -122,6 +125,16 @@ async def _build_context(
         project_type_slugs=project_type_slugs,
         integration_slug=resolved.integration_slug,
         service_connections=service_connections,
+        dependencies=dependencies or [],
+        # No resolver when the dependency lookup failed, so a fix does
+        # not remove remote state on partial data.
+        resolve_linked_identifiers=(
+            None
+            if dependencies is None
+            else linked_identifier_resolver(
+                db, org_slug, resolved.integration_slug
+            )
+        ),
     )
 
 
@@ -669,6 +682,7 @@ async def remediate_all_for_project(
     org_slug: str,
     project_id: str,
     auth: permissions.AuthContext,
+    sweepable_only: bool = False,
 ) -> RemediateAllResponse | None:
     """Apply every fixable finding in a project's report (best-effort).
 
@@ -678,7 +692,10 @@ async def remediate_all_for_project(
     re-run once at the end so the returned report reflects every fix.
 
     Shared by the per-project endpoint and the ``remediate`` maintenance
-    sweep, so both apply findings identically.
+    sweep, so both apply findings identically.  ``sweepable_only``
+    restricts the pass to offers marked
+    :attr:`RemediationOffer.sweepable` (the ``sync-fixes`` sweep) and
+    skips the closing re-analysis when nothing was applied.
     """
     report = await _fetch_report(db, project_id)
     if report is None:
@@ -692,6 +709,8 @@ async def remediate_all_for_project(
     for finding in report.results:
         if finding.remediation is None:
             continue
+        if sweepable_only and not finding.remediation.sweepable:
+            continue
         try:
             result = await _remediate_one(
                 db,
@@ -724,6 +743,8 @@ async def remediate_all_for_project(
                 result=result,
             )
         )
+    if sweepable_only and not outcomes:
+        return RemediateAllResponse(outcomes=outcomes, report=report)
     fresh = await run_and_persist(db, org_slug, project_id, auth)
     return RemediateAllResponse(outcomes=outcomes, report=fresh)
 

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/endpoints/project_deployments.py

@@ -5263,23 +5263,39 @@ async def complete_promote_build(
         resolved.plugin_slug,
         run.run_id,
     )
-    appended = await append_deployment_event(
-        db,
-        org_slug=org_slug,
-        project_id=project_id,
-        release_id=release_id,
-        env_slug=to_environment,
-        status='in_progress',
-        note=f'via {resolved.plugin_slug}',
-        external_run_id=str(run.run_id) if run.run_id else None,
-        external_run_url=run.run_url,
-        # The person who pressed promote, not the worker that got here.
-        performed_by=requested_by or None,
-        credential=ctx.credential_note,
-        # Stamps ``origin`` on the node, which is what lets a reclaimed
-        # job recognize its own in-flight deployment.
-        source='promote',
-    )
+    # The deployment is dispatched and will run whatever happens next, so
+    # recording it is best-effort from here on.  Raising would abandon the
+    # promote before the audit row below is written and before the watcher
+    # closes the deployment -- the two writes that attribute it to
+    # ``requested_by`` -- leaving the webhook's anonymous event as the only
+    # record and "Deployed by" blank.  The watcher's close re-creates the
+    # node on the same ``external_run_id`` if this write is lost.
+    try:
+        appended = await append_deployment_event(
+            db,
+            org_slug=org_slug,
+            project_id=project_id,
+            release_id=release_id,
+            env_slug=to_environment,
+            status='in_progress',
+            note=f'via {resolved.plugin_slug}',
+            external_run_id=str(run.run_id) if run.run_id else None,
+            external_run_url=run.run_url,
+            # The person who pressed promote, not the worker that got here.
+            performed_by=requested_by or None,
+            credential=ctx.credential_note,
+            # Stamps ``origin`` on the node, which is what lets a reclaimed
+            # job recognize its own in-flight deployment.
+            source='promote',
+        )
+    except Exception:
+        LOGGER.exception(
+            'release-promote could not record the dispatched deployment '
+            'for project %s release %s',
+            project_id,
+            release_id,
+        )
+        appended = None
     if isinstance(appended, str):
         LOGGER.warning(
             'release-promote could not record the deployment event for '

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/endpoints/projects.py

@@ -2918,6 +2918,29 @@ async def list_project_relationships(
     )
 
 
+async def _dispatch_dependencies_changed(
+    db: graph.Pool,
+    org_slug: str,
+    project_id: str,
+    auth: permissions.AuthContext,
+) -> None:
+    """Tell lifecycle plugins the source project's dependencies changed.
+
+    Only the source is dispatched: its plugin reconciles the dependency
+    in both directions, so the target needs no second call.  Failures
+    are logged and never undo the Imbi-side edge change.
+    """
+    try:
+        await dispatch_lifecycle(
+            db, project_id, org_slug, 'dependencies_changed', auth
+        )
+    except Exception:
+        LOGGER.exception(
+            'Lifecycle dependencies_changed dispatch failed for project %s',
+            project_id,
+        )
+
+
 @projects_router.post(
     '/{project_id}/relationships/{target_id}',
     status_code=204,
@@ -2975,6 +2998,7 @@ async def create_project_relationship(
                 f'Project {project_id!r} or target {target_id!r} not found'
             ),
         )
+    await _dispatch_dependencies_changed(db, org_slug, project_id, auth)
     # The source project gained a dependency, which can change a
     # condition-policy score that reads its neighbours. No-op unless a
     # condition policy exists.
@@ -3034,6 +3058,7 @@ async def delete_project_relationship(
                 f'Relationship from {project_id!r} to {target_id!r} not found'
             ),
         )
+    await _dispatch_dependencies_changed(db, org_slug, project_id, auth)
     # The source project lost a dependency; re-score it so a condition
     # policy reading its neighbours reflects the change. No-op unless a
     # condition policy exists.

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/maintenance/operations.py

@@ -31,6 +31,9 @@ from imbi.common import clickhouse, graph, iggy
 from imbi.common import models as common_models
 from imbi.common.plugins.errors import PluginRateLimited
 
+if typing.TYPE_CHECKING:
+    from imbi.api.endpoints.project_analysis import RemediateOutcome
+
 LOGGER = logging.getLogger(__name__)
 
 #: ``requested_by`` / ``principal_name`` recorded on work this runs.
@@ -144,32 +147,79 @@ async def execute_remediate(
         return _skip(
             ctx, 'remediate', 'No persisted report, or no fixable findings.'
         )
-    # One row per remediation that did not work: which finding, which
-    # plugin, and what it said. Successful fixes stay as a count -- a
-    # project with forty findings would otherwise write forty rows to
-    # say nothing an operator will read.
-    for outcome in response.outcomes:
+    return _record_remediations(ctx, 'remediate', response.outcomes)
+
+
+async def execute_sync_fixes(
+    db: graph.Graph,
+    client: valkey.Valkey,
+    project_id: str,
+    *,
+    ctx: log.MaintenanceContext,
+) -> ExecuteOutcome:
+    """Analyze one project, then apply only its sweepable fixes.
+
+    Unlike ``remediate`` this does not trust a stored report: it runs
+    the analysis first so drift that appeared since the last run is
+    found, then applies the findings whose offer is marked
+    :attr:`~imbi.common.plugins.base.RemediationOffer.sweepable` --
+    idempotent fixes that bring a remote back in line with Imbi, never
+    ones that create or delete a remote resource.
+    """
+    from imbi.api.endpoints import project_analysis
+
+    org_slug = await _org_slug_for(db, project_id)
+    if org_slug is None:
+        return _skip(ctx, 'no-organization', _NO_ORG)
+    auth = _system_auth()
+    await project_analysis.run_and_persist(db, org_slug, project_id, auth)
+    response = await project_analysis.remediate_all_for_project(
+        db,
+        org_slug=org_slug,
+        project_id=project_id,
+        auth=auth,
+        sweepable_only=True,
+    )
+    if response is None or not response.outcomes:
+        return _skip(ctx, 'sync-fixes', 'No sweepable findings.')
+    return _record_remediations(ctx, 'sync-fixes', response.outcomes)
+
+
+def _record_remediations(
+    ctx: log.MaintenanceContext,
+    action: str,
+    outcomes: list[RemediateOutcome],
+) -> ExecuteOutcome:
+    """Log a remediation pass and classify the item.
+
+    One row per remediation that did not work: which finding, which
+    plugin, and what it said. Successful fixes stay as a count -- a
+    project with forty findings would otherwise write forty rows to say
+    nothing an operator will read.  Raises
+    :class:`MaintenanceItemFailed` when any remediation failed.
+    """
+    for outcome in outcomes:
         if outcome.result.status == 'failed':
             ctx.log.record(
                 'failed',
-                'remediate',
+                action,
                 outcome.result.message,
                 finding=outcome.slug,
                 plugin=outcome.plugin_id,
             )
-    failed = sum(1 for o in response.outcomes if o.result.status == 'failed')
-    fixed = sum(1 for o in response.outcomes if o.result.status == 'fixed')
+    failed = sum(1 for o in outcomes if o.result.status == 'failed')
+    fixed = sum(1 for o in outcomes if o.result.status == 'fixed')
     ctx.log.record(
         'failed' if failed else 'succeeded',
-        'remediate',
-        f'{fixed} of {len(response.outcomes)} findings fixed.',
+        action,
+        f'{fixed} of {len(outcomes)} findings fixed.',
         fixed=fixed,
         failed=failed,
-        total=len(response.outcomes),
+        total=len(outcomes),
     )
     if failed:
         raise MaintenanceItemFailed(
-            f'{failed} of {len(response.outcomes)} remediations failed; '
+            f'{failed} of {len(outcomes)} remediations failed; '
             'see server logs for details.'
         )
     return 'succeeded'

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/maintenance/registry.py

@@ -22,6 +22,7 @@ from imbi.common import graph
 MaintenanceSlug = typing.Literal[
     'run-analysis',
     'remediate',
+    'sync-fixes',
     'rescore',
     'deployment-resync',
     'deployment-sweep',
@@ -104,6 +105,21 @@ OPERATIONS: dict[MaintenanceSlug, OperationDefinition] = {
             enumerate=operations.enumerate_all_projects,
             execute=operations.execute_remediate,
         ),
+        OperationDefinition(
+            slug='sync-fixes',
+            label='Apply Sync Fixes',
+            description=(
+                'Run the Project Doctor analysis for every project, then '
+                'apply only the fixes a plugin marks safe to sweep -- '
+                'e.g. repointing a PagerDuty escalation policy or syncing '
+                'PagerDuty service dependencies. Never creates or deletes '
+                'a remote resource. Projects with no such findings are '
+                'skipped.'
+            ),
+            pause_key=None,
+            enumerate=operations.enumerate_all_projects,
+            execute=operations.execute_sync_fixes,
+        ),
         OperationDefinition(
             slug='rescore',
             label='Recompute Scores',

{imbi_api-2.36.0 → imbi_api-2.37.0}/src/imbi/api/plugins/lifecycle_dispatch.py

@@ -39,6 +39,7 @@ from imbi.common.plugins.base import (
     LifecycleResult,
     LinkWriteback,
     PluginContext,
+    ProjectDependency,
     ServiceConnection,
     ServiceWriteback,
 )
@@ -60,6 +61,7 @@ LifecycleEvent = typing.Literal[
     'unarchived',
     'deleted',
     'relocated',
+    'dependencies_changed',
 ]
 
 #: Map of lifecycle events to the matching ``LifecycleCapability`` hook
@@ -72,6 +74,7 @@ _EVENT_METHOD: dict[LifecycleEvent, str] = {
     'unarchived': 'on_project_unarchived',
     'deleted': 'on_project_deleted',
     'relocated': 'on_project_relocated',
+    'dependencies_changed': 'on_project_dependencies_changed',
 }
 
 
@@ -137,6 +140,10 @@ class LifecycleContextBundle:
     )
     project_name: str | None = None
     project_description: str | None = None
+    # ``None`` when the dependency lookup failed.
+    dependencies: list[ProjectDependency] | None = dataclasses.field(
+        default_factory=list
+    )
 
 
 async def build_lifecycle_context_bundle(
@@ -148,6 +155,7 @@ async def build_lifecycle_context_bundle(
     write, and pass it as ``bundle=`` to :func:`dispatch_lifecycle`.
     """
     from imbi.api.endpoints._helpers import (
+        lookup_project_dependencies,
         lookup_project_exists_in,
         lookup_project_links,
         lookup_project_name_description,
@@ -163,12 +171,14 @@ async def build_lifecycle_context_bundle(
         project_type_slugs,
         service_connections,
         (project_name, project_description),
+        dependencies,
     ) = await asyncio.gather(
         lookup_project_slugs(db, project_id),
         lookup_project_links(db, project_id),
         lookup_project_type_slugs(db, project_id),
         lookup_project_exists_in(db, project_id),
         lookup_project_name_description(db, project_id),
+        lookup_project_dependencies(db, project_id),
     )
     return LifecycleContextBundle(
         project_slug=project_slug,
@@ -178,6 +188,7 @@ async def build_lifecycle_context_bundle(
         service_connections=service_connections,
         project_name=project_name,
         project_description=project_description,
+        dependencies=dependencies,
     )
 
 
@@ -225,6 +236,9 @@ async def dispatch_lifecycle(
     :class:`PluginContext` for plugins that need a before/after view
     (``'updated'`` / ``'relocated'``).
     """
+    # Lazy import to avoid the endpoints/_helpers <-> this-module cycle.
+    from imbi.api.endpoints._helpers import linked_identifier_resolver
+
     if resolved_list is None:
         resolved_list = await resolve_all_capabilities(
             db, project_id, 'lifecycle'
@@ -277,6 +291,16 @@ async def dispatch_lifecycle(
             integration_options=resolved.integration_options,
             capability_options=resolved.capability_options,
             service_connections=bundle.service_connections,
+            dependencies=bundle.dependencies or [],
+            # No resolver when the dependency lookup failed, so a
+            # capability does not remove remote state on partial data.
+            resolve_linked_identifiers=(
+                None
+                if bundle.dependencies is None
+                else linked_identifier_resolver(
+                    db, org_slug, resolved.integration_slug
+                )
+            ),
         )
         invocation = await _invoke_one(db, ctx, resolved, event, auth)
         results.append(invocation)