imbi-api 2.41.0__tar.gz → 2.42.0__tar.gz

{imbi_api-2.41.0 → imbi_api-2.42.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: imbi-api
-Version: 2.41.0
+Version: 2.42.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License-Expression: BSD-3-Clause
@@ -19,8 +19,8 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.41.0
-Requires-Dist: imbi-plugin-github==2.41.0
+Requires-Dist: imbi-common[databases,llm,mcp,sentry,server]==2.42.0
+Requires-Dist: imbi-plugin-github==2.42.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: limits<6,>=5

{imbi_api-2.41.0 → imbi_api-2.42.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.41.0"
+version = "2.42.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,8 +28,8 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,mcp,sentry,server]==2.41.0",
-  "imbi-plugin-github==2.41.0",
+  "imbi-common[databases,llm,mcp,sentry,server]==2.42.0",
+  "imbi-plugin-github==2.42.0",
   "jinja2",
   "jsonpatch>=1.33",
   "limits>=5,<6",

{imbi_api-2.41.0 → imbi_api-2.42.0}/src/imbi/api/endpoints/harness.py

@@ -688,7 +688,7 @@ async def _rendered_prompt(
     """Render the pinned prompt version; return it or the error.
 
     The template gets the variables that it declares among
-    ``organization``, ``agent``, ``task``, and ``project`` (slugs and
+    ``organization``, ``agent``, ``task``, and ``project_slug`` (slugs and
     the short id).
     """
     if bundle.prompt_ref is None or bundle.prompt_version is None:
@@ -705,7 +705,7 @@ async def _rendered_prompt(
             'organization': org_slug,
             'agent': bundle.agent_slug or '',
             'task': task['short_id'],
-            'project': task.get('project_slug') or '',
+            'project_slug': task.get('project_slug') or '',
         }
         rendered = await rendering.render(
             version,

{imbi_api-2.41.0 → imbi_api-2.42.0}/src/imbi/api/endpoints/project_deployments.py

@@ -2758,6 +2758,7 @@ async def _trigger_deployment(
     source: str | None,
     valkey_client: typing.Any,
 ) -> DeploymentTriggerResponse:
+    await _require_delivery_enabled(db, project_id)
     if body.action == 'promote':
         return await _handle_promote(
             db,
@@ -3024,6 +3025,7 @@ async def resync_project_deployments(
     button using the plugin manifest flag.  Returns ``enqueued=False``
     when the job was debounced or Valkey is unavailable.
     """
+    await _require_delivery_enabled(db, project_id)
     resolved = await resolve_capability(db, project_id, 'deployment', source)
     _require_deployment_sync_support(resolved)
     requested_by = auth.principal_name
@@ -3258,12 +3260,31 @@ async def _handle_deploy(
         if body.ref_label and _SEMVER_REF_RE.match(body.ref_label)
         else None
     )
+
+    async def _append(
+        release_id: str,
+    ) -> tuple[ReleaseEnvironmentEdgeResponse, AppendOutcome] | None:
+        appended = await append_deployment_event(
+            db,
+            org_slug=org_slug,
+            project_id=project_id,
+            release_id=release_id,
+            env_slug=body.environment,
+            status='in_progress',
+            note=note,
+            external_run_id=str(run.run_id) if run.run_id else None,
+            external_run_url=run.run_url,
+            credential=ctx.credential_note,
+        )
+        return None if isinstance(appended, str) else appended
+
     # Look up the release that was deployed. Try (committish, tag) first
     # so a SHA that ships under a tag matches the tagged Release node;
     # fall back to (committish, None) so a raw-SHA deploy still finds
     # an untagged Release if one exists.
     result: tuple[ReleaseEnvironmentEdgeResponse, AppendOutcome] | None = None
     matched_tag: str | None = None
+    release_found = False
     for try_tag in [candidate_tag, None] if candidate_tag else [None]:
         release_id = await _release_id_for(
             db,
@@ -3273,26 +3294,44 @@ async def _handle_deploy(
         )
         if release_id is None:
             continue
-        appended = await append_deployment_event(
-            db,
-            org_slug=org_slug,
-            project_id=project_id,
-            release_id=release_id,
-            env_slug=body.environment,
-            status='in_progress',
-            note=note,
-            external_run_id=str(run.run_id) if run.run_id else None,
-            external_run_url=run.run_url,
-            credential=ctx.credential_note,
-        )
-        if not isinstance(appended, str):
-            result = appended
+        release_found = True
+        result = await _append(release_id)
+        if result is not None:
             matched_tag = try_tag
             break
+    if not release_found:
+        # No Release names this deploy yet -- typically a raw commit
+        # shipped to the first environment.  Create it the way resync
+        # would on observing the same deployment, so the rollout is
+        # recorded now rather than only if a webhook later reports it.
+        try:
+            matched_tag = candidate_tag or await _existing_tag_for_committish(
+                db, project_id=project_id, committish=committish_short
+            )
+        except ValueError:
+            LOGGER.warning(
+                'Deploy triggered for project=%s committish=%s but several'
+                ' tagged Releases carry that commit; not recorded',
+                project_id,
+                committish_short,
+            )
+        else:
+            result = await _append(
+                await _upsert_release_node(
+                    db,
+                    project_id=project_id,
+                    tag=matched_tag,
+                    committish=committish_short,
+                    title=matched_tag or body.ref_label or committish_short,
+                    notes_markdown='',
+                    release_url=None,
+                    created_by=auth.principal_name,
+                )
+            )
     if result is None:
         LOGGER.warning(
-            'Deploy triggered for project=%s committish=%s tag=%s but no'
-            ' matching Release node was found; audit row suppressed',
+            'Deploy triggered for project=%s committish=%s tag=%s but it'
+            ' could not be recorded; audit row suppressed',
             project_id,
             committish_short,
             candidate_tag,
@@ -4546,26 +4585,79 @@ def _watcher_auth() -> permissions.AuthContext:
     )
 
 
-async def _project_is_deployable(db: graph.Graph, project_id: str) -> bool:
-    """True when any of the project's types is ``deployable``.
+async def _project_delivery(
+    db: graph.Graph, project_id: str
+) -> common_models.Delivery:
+    """Resolve how *project_id* is delivered: deploy, release, or neither.
 
-    A project can carry more than one ``ProjectType``, so this aggregates
+    The project's own ``delivery_mode`` wins; ``project-type`` (and a
+    node written before the property existed) defers to the types.  A
+    project can carry more than one ``ProjectType``, so this aggregates
     rather than reading one: ``deployable`` XOR ``releasable`` holds per
-    type, not per project.  A project with no type at all answers
-    ``False`` -- there is nothing to deploy into.
+    type, not per project.  A project with no type at all, or one that
+    does not exist, answers neither -- there is nothing to ship.
     """
     query: typing.LiteralString = """
     MATCH (p:Project {{id: {project_id}}})
     OPTIONAL MATCH (p)-[:TYPE]->(pt:ProjectType)
-    RETURN collect(COALESCE(pt.deployable, false)) AS flags
+    RETURN p.delivery_mode AS mode,
+           collect(COALESCE(pt.deployable, false)) AS flags,
+           collect(COALESCE(pt.releasable, false)) AS releasable
     """
-    rows = await db.execute(query, {'project_id': project_id}, ['flags'])
+    rows = await db.execute(
+        query, {'project_id': project_id}, ['mode', 'flags', 'releasable']
+    )
     if not rows:
-        return False
-    flags = typing.cast(
-        'list[object]', graph.parse_agtype(rows[0].get('flags')) or []
+        return common_models.Delivery(deployable=False, releasable=False)
+    row = rows[0]
+
+    def _any(column: str) -> bool:
+        flags = typing.cast(
+            'list[object]', graph.parse_agtype(row.get(column)) or []
+        )
+        return any(bool(flag) for flag in flags)
+
+    mode = graph.parse_agtype(row.get('mode'))
+    return common_models.resolve_delivery(
+        mode if isinstance(mode, str) else None,
+        deployable=_any('flags'),
+        releasable=_any('releasable'),
     )
-    return any(bool(flag) for flag in flags)
+
+
+async def _project_is_deployable(db: graph.Graph, project_id: str) -> bool:
+    """True when the project resolves to ``deployable``."""
+    return (await _project_delivery(db, project_id)).deployable
+
+
+async def _require_delivery_enabled(db: graph.Graph, project_id: str) -> None:
+    """Refuse to ship a project whose ``delivery_mode`` is ``disabled``.
+
+    Raises a 409: the project exists and the caller may act on it, but
+    its releases are governed outside Imbi, so deploying, promoting,
+    cutting a release, drafting notes, or resyncing it is off.
+    """
+    if await _delivery_mode_is_disabled(db, project_id):
+        raise fastapi.HTTPException(
+            status_code=409,
+            detail=(
+                'Release and deployment processing is disabled for this '
+                'project (delivery_mode is "disabled").'
+            ),
+        )
+
+
+async def _delivery_mode_is_disabled(db: graph.Graph, project_id: str) -> bool:
+    """True when the project node's ``delivery_mode`` is ``disabled``."""
+    query: typing.LiteralString = """
+    MATCH (p:Project {{id: {project_id}}})
+    RETURN p.delivery_mode AS mode
+    """
+    rows = await db.execute(query, {'project_id': project_id}, ['mode'])
+    if not rows:
+        return False
+    mode = graph.parse_agtype(rows[0].get('mode'))
+    return isinstance(mode, str) and mode == 'disabled'
 
 
 async def poll_artifact_run(
@@ -5813,6 +5905,7 @@ async def draft_release_notes(
     grouping with ``degraded=true`` when Claude is unavailable, the
     response can't be parsed, or schema validation fails.
     """
+    await _require_delivery_enabled(db, project_id)
     resolved, ctx, credentials = await _resolve_and_context(
         db, org_slug, project_id, auth, source=source
     )
@@ -6774,6 +6867,7 @@ async def cut_release(
     minus the deploy step), upsert the matching ``Release`` node, and
     record an audit row.
     """
+    await _require_delivery_enabled(db, project_id)
     tag_formats = await _resolve_tag_formats(db, org_slug, project_id)
     patterns = [fmt.pattern for fmt in tag_formats]
     if not versioning.matches_tag_formats(body.tag, patterns):

{imbi_api-2.41.0 → imbi_api-2.42.0}/src/imbi/api/endpoints/projects.py

@@ -95,6 +95,7 @@ class ProjectCreate(pydantic.BaseModel):
     )
     links: dict[str, pydantic.AnyUrl] = {}
     identifiers: dict[str, int | str] = {}
+    delivery_mode: models.DeliveryMode = 'project-type'
 
     @pydantic.field_validator('project_type_slugs')
     @classmethod
@@ -138,6 +139,7 @@ class ProjectUpdate(pydantic.BaseModel):
     )
     links: dict[str, pydantic.AnyUrl] | None = None
     identifiers: dict[str, int | str] | None = None
+    delivery_mode: models.DeliveryMode | None = None
 
 
 # ProjectRelationships now lives in imbi.common.models so the OpenAPI
@@ -214,6 +216,10 @@ class ReleaseSummary(pydantic.BaseModel):
     #: much of the range's ``drift_detected`` rests on verdicts rather
     #: than on the fail-closed default.
     drift_answered: int = 0
+    #: When the oldest unreleased commit that needs action landed:
+    #: the same commits ``drift_detected`` counts, so a commit CI
+    #: answered ``false`` is skipped.  ``None`` when none needs action.
+    oldest_actionable_at: datetime.datetime | None = None
 
 
 class ProjectListTeamRef(pydantic.BaseModel):
@@ -264,6 +270,7 @@ class ProjectListItem(pydantic.BaseModel):
     team: ProjectListTeamRef
     project_types: list[ProjectListProjectTypeRef] = []
     environments: list[ProjectListEnvironmentRef] = []
+    delivery_mode: models.DeliveryMode = 'project-type'
     open_pr_count: int = 0
     closed_pr_count: int = 0
     viewer_open_pr_count: int = 0
@@ -286,6 +293,13 @@ class ProjectListItem(pydantic.BaseModel):
     #: every pair it draws.  A pair with no entry was never evaluated,
     #: which the client must fail closed on and show.
     drift_ranges: dict[str, bool] = pydantic.Field(default_factory=dict)
+    #: ``"<base>..<head>"`` -> when the oldest commit that needs action
+    #: in that range landed.  Only ranges that ``drift_ranges`` marks
+    #: ``true`` from their commits have an entry: a range that needs
+    #: action only because it could not be evaluated has no date.
+    drift_range_oldest: dict[str, datetime.datetime] = pydantic.Field(
+        default_factory=dict
+    )
 
 
 class ProjectResponse(pydantic.BaseModel):
@@ -307,6 +321,7 @@ class ProjectResponse(pydantic.BaseModel):
     environments: list[EnvironmentRef] = []
     links: dict[str, pydantic.AnyUrl] = {}
     identifiers: dict[str, int | str] = {}
+    delivery_mode: models.DeliveryMode = 'project-type'
     # The project's EXISTS_IN connections, one entry per
     # ``(:Project)-[:EXISTS_IN]->(:Integration)`` edge.  Read-only
     # structured surface (identifier + canonical API URL + the dashboard
@@ -1089,9 +1104,21 @@ def _range_key(base: str, head: str) -> str:
     return f'{base}..{head}'
 
 
+class EnvironmentDrift(typing.NamedTuple):
+    """The per-project results of :func:`_evaluate_environment_drift`.
+
+    Both map project id -> range key -> value.  ``ranges`` is whether
+    the range needs action; ``oldest`` is when its oldest commit that
+    needs action landed.
+    """
+
+    ranges: dict[str, dict[str, bool]]
+    oldest: dict[str, dict[str, datetime.datetime]]
+
+
 async def _evaluate_environment_drift(
     project_data_list: list[dict[str, typing.Any]],
-) -> dict[str, dict[str, bool]]:
+) -> EnvironmentDrift:
     """Apply the rule to every project's promotion steps.
 
     Two sequential reads: the endpoint commit times first, then the
@@ -1113,6 +1140,10 @@ async def _evaluate_environment_drift(
     range must not read as clean.  The same precision means a distinct
     commit can share the *base* commit's timestamp, so the lower bound
     is inclusive and only the base commit itself is excluded, by sha.
+
+    The oldest date comes from the same in-range commits, so it needs no
+    third read.  A range that needs action only because its endpoints
+    are unorderable or the verdict read failed gets no date.
     """
     ranges_by_pid: dict[str, list[tuple[str, str]]] = {}
     for project_data in project_data_list:
@@ -1123,7 +1154,7 @@ async def _evaluate_environment_drift(
         if found:
             ranges_by_pid[pid] = found
     if not ranges_by_pid:
-        return {}
+        return EnvironmentDrift({}, {})
     pids = list(ranges_by_pid)
     shas = sorted(
         {
@@ -1150,6 +1181,7 @@ async def _evaluate_environment_drift(
             )
     actionable = await _fetch_actionable_commit_times(windows)
     out: dict[str, dict[str, bool]] = {}
+    oldest: dict[str, dict[str, datetime.datetime]] = {}
     for pid, pairs in ranges_by_pid.items():
         marks = actionable.get(pid, []) if actionable is not None else None
         for base, head in pairs:
@@ -1158,16 +1190,18 @@ async def _evaluate_environment_drift(
             if lo is None or hi is None:
                 continue
             key = _range_key(base, head)
-            if hi <= lo:
-                out.setdefault(pid, {})[key] = True
-            elif marks is None:
+            if hi <= lo or marks is None:
                 out.setdefault(pid, {})[key] = True
-            else:
-                out.setdefault(pid, {})[key] = any(
-                    (lo < at <= hi) or (at == lo and sha != base)
-                    for sha, at in marks
-                )
-    return out
+                continue
+            in_range = [
+                at
+                for sha, at in marks
+                if (lo < at <= hi) or (at == lo and sha != base)
+            ]
+            out.setdefault(pid, {})[key] = bool(in_range)
+            if in_range:
+                oldest.setdefault(pid, {})[key] = min(in_range)
+    return EnvironmentDrift(out, oldest)
 
 
 def _release_range_cutoffs(
@@ -1361,6 +1395,18 @@ async def _fetch_authored_times(
     return authored_by_project
 
 
+def _delivery_of(project_data: dict[str, typing.Any]) -> models.Delivery:
+    """Resolve a listed project's delivery flags from its graph record."""
+    project_types = typing.cast(
+        list[dict[str, typing.Any]], project_data.get('project_types') or []
+    )
+    return models.resolve_delivery(
+        project_data.get('delivery_mode'),
+        deployable=any(pt.get('deployable') for pt in project_types),
+        releasable=any(pt.get('releasable') for pt in project_types),
+    )
+
+
 async def _fetch_release_summaries(
     project_ids: list[str],
 ) -> dict[str, ReleaseSummary]:
@@ -1446,6 +1492,7 @@ async def _fetch_release_summaries(
     ]
     counts_since_tag: dict[str, int] = {}
     drift_by_pid: dict[str, tuple[bool, int]] = {}
+    oldest_by_pid: dict[str, datetime.datetime] = {}
     if tagged_pids:
         try:
             pid_cutoff = _release_range_cutoffs(
@@ -1469,7 +1516,12 @@ async def _fetch_release_summaries(
                     ' count() AS c,'
                     ' countIf(d.answered = 1 AND d.drift_detected)'
                     ' AS drifted,'
-                    ' countIf(d.answered = 1) AS answered'
+                    ' countIf(d.answered = 1) AS answered,'
+                    ' countIf(d.answered = 0 OR d.drift_detected)'
+                    ' AS actionable,'
+                    ' minIf(COALESCE(c.committed_at, c.authored_at),'
+                    ' d.answered = 0 OR d.drift_detected)'
+                    ' AS oldest_actionable_at'
                     ' FROM commits AS c FINAL'
                     ' LEFT JOIN (SELECT project_id, sha, drift_detected,'
                     ' toUInt8(1) AS answered FROM commit_drift FINAL'
@@ -1510,6 +1562,21 @@ async def _fetch_release_summaries(
                     for row in count_rows
                     if row.get('project_id') is not None
                 }
+                # ``minIf`` over no matching rows gives the type's zero
+                # (the epoch), not NULL, so read it only when a commit
+                # needs action.
+                oldest_by_pid = {
+                    str(row['project_id']): at
+                    for row in count_rows
+                    if row.get('project_id') is not None
+                    and int(row.get('actionable') or 0) > 0
+                    and (
+                        at := clickhouse.as_utc_or_none(
+                            row.get('oldest_actionable_at')
+                        )
+                    )
+                    is not None
+                }
         except Exception:  # noqa: BLE001
             LOGGER.warning(
                 'Failed to fetch commit counts since tag',
@@ -1559,6 +1626,7 @@ async def _fetch_release_summaries(
             commits_since_tag=counts_since_tag.get(pid, 0),
             drift_detected=drift_by_pid.get(pid, (False, 0))[0],
             drift_answered=drift_by_pid.get(pid, (False, 0))[1],
+            oldest_actionable_at=oldest_by_pid.get(pid),
         )
     return release_result
 
@@ -1765,6 +1833,7 @@ _SLIM_RETURN_FRAGMENT: typing.LiteralString = """
                       END) AS envs
     RETURN p{{.id, .name, .slug, .description, .score,
               archived: coalesce(p.archived, false),
+              delivery_mode: coalesce(p.delivery_mode, 'project-type'),
               team: t{{.name, .slug}},
               project_types: pts,
               environments: envs}} AS project
@@ -1819,6 +1888,7 @@ async def create_project(
             description=data.description,
             icon=data.icon,
             links=data.links,
+            delivery_mode=data.delivery_mode,
             **{
                 k: v
                 for k, v in typing.cast(
@@ -2409,14 +2479,7 @@ async def list_projects(
     releasable_ids = [
         str(p.get('id', ''))
         for p in project_data_list
-        if p.get('id')
-        and any(
-            pt.get('releasable')
-            for pt in typing.cast(
-                list[dict[str, typing.Any]],
-                p.get('project_types') or [],
-            )
-        )
+        if p.get('id') and _delivery_of(p).releasable
     ]
     viewer = auth.identity_for('github-enterprise-cloud')
     pr_counts, releases, release_summaries = await asyncio.gather(
@@ -2436,8 +2499,10 @@ async def list_projects(
         project_data['latest_deployments'] = releases.latest.get(pid, {})
     # Only ``ProjectListItem`` carries ``drift_ranges``, so the two
     # reads behind it are pure waste on the full-response path.
-    drift_ranges = (
-        await _evaluate_environment_drift(project_data_list) if slim else {}
+    drift = (
+        await _evaluate_environment_drift(project_data_list)
+        if slim
+        else EnvironmentDrift({}, {})
     )
 
     for project_data in project_data_list:
@@ -2449,7 +2514,8 @@ async def list_projects(
         project_data['closed_pr_count'] = closed_count
         project_data['viewer_open_pr_count'] = viewer_open
         project_data['viewer_closed_pr_count'] = viewer_closed
-        project_data['drift_ranges'] = drift_ranges.get(pid, {})
+        project_data['drift_ranges'] = drift.ranges.get(pid, {})
+        project_data['drift_range_oldest'] = drift.oldest.get(pid, {})
         summary = release_summaries.get(pid)
         if summary is not None:
             project_data['release_summary'] = summary.model_dump()
@@ -3347,6 +3413,11 @@ async def _execute_project_update(
             if data.identifiers is not None
             else existing_identifiers
         ),
+        'delivery_mode': (
+            data.delivery_mode
+            or existing_p.get('delivery_mode')
+            or 'project-type'
+        ),
     }
 
     # Merge blueprint extra fields: start from existing unknown keys,
@@ -3620,6 +3691,7 @@ async def patch_project(
         'environments': current_environments,
         'links': parsed_links,
         'identifiers': parsed_identifiers,
+        'delivery_mode': project_data.get('delivery_mode') or 'project-type',
         **extras,
     }