leverage 3.1.0__tar.gz → 3.2.0__tar.gz

{leverage-3.1.0 → leverage-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: leverage
-Version: 3.1.0
+Version: 3.2.0
 Summary: Binbash Leverage Command-Line tool.
 Home-page: https://github.com/binbashar/leverage
 License: MIT
@@ -45,11 +45,9 @@ Description-Content-Type: text/markdown
 
 Leverage CLI is the tool used to manage and interact with any Leverage project.
 
-It transparently handles the most complex and error prone tasks that arise from working with a state-of-the-art
-infrastructure definition like our Leverage Reference Architecture. Leverage CLI uses a dockerized approach to
-encapsulate the tools needed to perform such tasks and to free the user from having to deal with the configuration and
-management of said tools.
-Provides the means to interact with your Leverage project and allows you to define custom tasks to run.
+It transparently handles the most complex and error-prone tasks that arise from working with a state-of-the-art infrastructure definition like our Leverage Reference Architecture. It understands the structure of the Leverage Reference Architecture and assists the user in their day-to-day operation.
+
+Leverage CLI orchestrates a set of tools used to operate in a Leverage project. Usually this means OpenTofu/Terraform, but also aws-cli, kubectl and more. 
 
 Reviewing and implementing the [Binbash Leverage Landing Zone for AWS](https://leverage.binbash.co/try-leverage/) would
 be a very good place to start!
@@ -61,10 +59,13 @@ to [this page](https://leverage.binbash.co/user-guide/leverage-cli/installation/
 
 ### Note for migration from previous versions
 
-If you come from Leverage CLI version <1.8.0 and want to install Leverage CLI version >= 1.8.0 keep into account the
+If you come from Leverage CLI version <3.0.0 and want to use Leverage CLI version >= 3.0.0 keep into account the
 following.
 
-The `build.env` file format has changed. As an example, this is the old format:
+Leverage CLI no longer runs tools inside a Docker container; it executes the OpenTofu/Terraform binaries installed on
+your host. Because of this, the `TERRAFORM_IMAGE_NAME`/`TF_IMAGE_NAME` and `TERRAFORM_IMAGE_TAG`/`TF_IMAGE_TAG`
+parameters in the `build.env` file no longer exist. In their place, the optional `TF_BINARY` parameter specifies the path
+to the OpenTofu/Terraform binary to use. As an example, this is the old format:
 
 ```
 # Project settings
@@ -74,8 +75,7 @@ PROJECT=bb
 MFA_ENABLED=false
 
 # Terraform
-TERRAFORM_IMAGE_NAME=binbash/terraform-awscli-slim
-TERRAFORM_IMAGE_TAG=1.1.9
+TF_IMAGE_TAG=1.5.0-0.2.0
 ```
 
 New version example:
@@ -87,16 +87,19 @@ PROJECT=bb
 # General
 MFA_ENABLED=false
 
-# Terraform
-TF_IMAGE_TAG=1.5.0-0.2.0
+# OpenTofu/Terraform binary
+TF_BINARY=/usr/local/bin/tofu
 ```
 
-So, if you have created a project with version <1.8.0 and want to use it with version >=1.8.0 you should:
-
-- remove TERRAFORM_IMAGE_NAME line
-- update TF_IMAGE_TAG from this form '9.9.9' to this one '9.9.9-9.9.9'.
+So, if you have created a project with version <3.0.0 and want to use it with version >=3.0.0 you should:
 
-For the second item you can check the version [here](https://hub.docker.com/r/binbash/leverage-toolbox/tags).
+- remove the `TERRAFORM_IMAGE_NAME`/`TF_IMAGE_NAME` and `TERRAFORM_IMAGE_TAG`/`TF_IMAGE_TAG` lines
+- install [OpenTofu](https://opentofu.org/docs/intro/install/) or [Terraform](https://developer.hashicorp.com/terraform/install)
+  on your host
+- optionally, set `TF_BINARY` to the path of the binary. This is useful when you have multiple versions of
+  OpenTofu/Terraform installed, or when the binary lives in an unconventional location. It can be an absolute path, a path starting with `~`, or a path
+  relative to the project root. If not set, the `tofu` or `terraform` binary is looked up in your `PATH`. Keep in mind
+  the binary must match the command you use: `leverage tofu` expects OpenTofu and `leverage terraform` expects Terraform.
 
 ## System requirements
 
@@ -221,12 +224,8 @@ poetry run pre-commit install
 To run unit tests, pytest is the tool of choice, and the required dependencies are available in the
 corresponding `dev-requirements.txt`.
 
-Integration tests are implemented using [bats](https://github.com/bats-core/bats-core/). Bear in mind that bats tests
-are meant to be run in a throwaway environment since they perform filesystem manipulations and installation and removal
-of packages, and the cleanup may not be completely thorough. As such, is highly recommended to run these tests using the
-docker image.
-
-### Manually
+Integration tests are implemented using [bats](https://github.com/bats-core/bats-core/). They drive the installed
+`leverage` command, and work on temporary directories of their own, so they can be run directly on your machine.
 
 1. Unit tests:
 
@@ -245,17 +244,21 @@ brew install bats-support
 brew install bats-assert
 ```
 
+The cli runs the infrastructure binaries directly, so `terraform` and `tofu` need to be installed as well. See
+[System requirements](#system-requirements).
+
 ```bash
 bats -r tests/bats
 ```
 
-### Using docker image
+If `bats-support` and `bats-assert` are not installed in a location bats searches by default, point `BATS_LIB_PATH` at
+the directory holding them:
 
-A Docker image suitable for running all tests can be crafted by running `make build-image`. After crafting the image all
-tests can be executed.
+```bash
+BATS_LIB_PATH=/opt/homebrew/lib bats -r tests/bats
+```
 
-To run all tests, run `make tests`. Alternatively `make test-unit` or `make test-int` for unit or integration tests
-respectively.
+Alternatively, `make tests` runs both suites, and `make test-unit` or `make test-int` runs one of them.
 
 ## Release Process
 

{leverage-3.1.0 → leverage-3.2.0}/README.md

@@ -7,11 +7,9 @@
 
 Leverage CLI is the tool used to manage and interact with any Leverage project.
 
-It transparently handles the most complex and error prone tasks that arise from working with a state-of-the-art
-infrastructure definition like our Leverage Reference Architecture. Leverage CLI uses a dockerized approach to
-encapsulate the tools needed to perform such tasks and to free the user from having to deal with the configuration and
-management of said tools.
-Provides the means to interact with your Leverage project and allows you to define custom tasks to run.
+It transparently handles the most complex and error-prone tasks that arise from working with a state-of-the-art infrastructure definition like our Leverage Reference Architecture. It understands the structure of the Leverage Reference Architecture and assists the user in their day-to-day operation.
+
+Leverage CLI orchestrates a set of tools used to operate in a Leverage project. Usually this means OpenTofu/Terraform, but also aws-cli, kubectl and more. 
 
 Reviewing and implementing the [Binbash Leverage Landing Zone for AWS](https://leverage.binbash.co/try-leverage/) would
 be a very good place to start!
@@ -23,10 +21,13 @@ to [this page](https://leverage.binbash.co/user-guide/leverage-cli/installation/
 
 ### Note for migration from previous versions
 
-If you come from Leverage CLI version <1.8.0 and want to install Leverage CLI version >= 1.8.0 keep into account the
+If you come from Leverage CLI version <3.0.0 and want to use Leverage CLI version >= 3.0.0 keep into account the
 following.
 
-The `build.env` file format has changed. As an example, this is the old format:
+Leverage CLI no longer runs tools inside a Docker container; it executes the OpenTofu/Terraform binaries installed on
+your host. Because of this, the `TERRAFORM_IMAGE_NAME`/`TF_IMAGE_NAME` and `TERRAFORM_IMAGE_TAG`/`TF_IMAGE_TAG`
+parameters in the `build.env` file no longer exist. In their place, the optional `TF_BINARY` parameter specifies the path
+to the OpenTofu/Terraform binary to use. As an example, this is the old format:
 
 ```
 # Project settings
@@ -36,8 +37,7 @@ PROJECT=bb
 MFA_ENABLED=false
 
 # Terraform
-TERRAFORM_IMAGE_NAME=binbash/terraform-awscli-slim
-TERRAFORM_IMAGE_TAG=1.1.9
+TF_IMAGE_TAG=1.5.0-0.2.0
 ```
 
 New version example:
@@ -49,16 +49,19 @@ PROJECT=bb
 # General
 MFA_ENABLED=false
 
-# Terraform
-TF_IMAGE_TAG=1.5.0-0.2.0
+# OpenTofu/Terraform binary
+TF_BINARY=/usr/local/bin/tofu
 ```
 
-So, if you have created a project with version <1.8.0 and want to use it with version >=1.8.0 you should:
-
-- remove TERRAFORM_IMAGE_NAME line
-- update TF_IMAGE_TAG from this form '9.9.9' to this one '9.9.9-9.9.9'.
+So, if you have created a project with version <3.0.0 and want to use it with version >=3.0.0 you should:
 
-For the second item you can check the version [here](https://hub.docker.com/r/binbash/leverage-toolbox/tags).
+- remove the `TERRAFORM_IMAGE_NAME`/`TF_IMAGE_NAME` and `TERRAFORM_IMAGE_TAG`/`TF_IMAGE_TAG` lines
+- install [OpenTofu](https://opentofu.org/docs/intro/install/) or [Terraform](https://developer.hashicorp.com/terraform/install)
+  on your host
+- optionally, set `TF_BINARY` to the path of the binary. This is useful when you have multiple versions of
+  OpenTofu/Terraform installed, or when the binary lives in an unconventional location. It can be an absolute path, a path starting with `~`, or a path
+  relative to the project root. If not set, the `tofu` or `terraform` binary is looked up in your `PATH`. Keep in mind
+  the binary must match the command you use: `leverage tofu` expects OpenTofu and `leverage terraform` expects Terraform.
 
 ## System requirements
 
@@ -183,12 +186,8 @@ poetry run pre-commit install
 To run unit tests, pytest is the tool of choice, and the required dependencies are available in the
 corresponding `dev-requirements.txt`.
 
-Integration tests are implemented using [bats](https://github.com/bats-core/bats-core/). Bear in mind that bats tests
-are meant to be run in a throwaway environment since they perform filesystem manipulations and installation and removal
-of packages, and the cleanup may not be completely thorough. As such, is highly recommended to run these tests using the
-docker image.
-
-### Manually
+Integration tests are implemented using [bats](https://github.com/bats-core/bats-core/). They drive the installed
+`leverage` command, and work on temporary directories of their own, so they can be run directly on your machine.
 
 1. Unit tests:
 
@@ -207,17 +206,21 @@ brew install bats-support
 brew install bats-assert
 ```
 
+The cli runs the infrastructure binaries directly, so `terraform` and `tofu` need to be installed as well. See
+[System requirements](#system-requirements).
+
 ```bash
 bats -r tests/bats
 ```
 
-### Using docker image
+If `bats-support` and `bats-assert` are not installed in a location bats searches by default, point `BATS_LIB_PATH` at
+the directory holding them:
 
-A Docker image suitable for running all tests can be crafted by running `make build-image`. After crafting the image all
-tests can be executed.
+```bash
+BATS_LIB_PATH=/opt/homebrew/lib bats -r tests/bats
+```
 
-To run all tests, run `make tests`. Alternatively `make test-unit` or `make test-int` for unit or integration tests
-respectively.
+Alternatively, `make tests` runs both suites, and `make test-unit` or `make test-int` runs one of them.
 
 ## Release Process
 

{leverage-3.1.0 → leverage-3.2.0}/leverage/__init__.py

@@ -4,7 +4,7 @@
 
 # pylint: disable=wrong-import-position
 
-__version__ = "3.1.0"
+__version__ = "3.2.0"
 
 import sys
 from shutil import which

{leverage-3.1.0 → leverage-3.2.0}/leverage/leverage.py

@@ -6,7 +6,7 @@ import click
 
 from leverage import __version__, conf
 from leverage._internals import pass_state
-from leverage.path import NotARepositoryError, PathsHandler
+from leverage.path import NotARepositoryError, build_paths_and_environment, is_project_yaml_only_bootstrap
 from leverage.modules import aws, credentials, run, project, tofu, terraform, tfautomv, kubectl
 
 
@@ -27,11 +27,21 @@ def leverage(context, state, verbose):
         state.config = conf.load()
     except NotARepositoryError:
         return
-    state.paths = PathsHandler(state.config)
-    state.environment = {
-        "AWS_SHARED_CREDENTIALS_FILE": str(state.paths.aws_credentials_file),
-        "AWS_CONFIG_FILE": str(state.paths.aws_config_file),
-    }
+
+    # The `project` commands bootstrap a project, so they run before its configuration exists.
+    # `project init` creates the git repository, so from that point on the config loads fine but
+    # still holds no project name, and building the paths would fail on a legitimate invocation.
+    if context.invoked_subcommand == project.name:
+        return
+
+    # `credentials configure` can legitimately run right after `project init` and before
+    # `project create`: only project.yaml exists, so no project name can be resolved yet and
+    # PathsHandler would abort. The `credentials` group callback derives the project name from
+    # project.yaml and builds state.paths itself in that case.
+    if context.invoked_subcommand == credentials.name and is_project_yaml_only_bootstrap():
+        return
+
+    state.paths, state.environment = build_paths_and_environment(state.config)
 
 
 # Add modules to leverage

{leverage-3.1.0 → leverage-3.2.0}/leverage/logger.py

@@ -174,7 +174,7 @@ def get_tasks_logger():
 
 def _raw_logger():
     """
-    Provide a raw logger, in case we need to print stuff that already comes formatted (like some container logs).
+    Provide a raw logger, in case we need to print stuff that already comes formatted.
     """
     logger = logging.getLogger("raw")
     logger.setLevel(logging.INFO)

{leverage-3.1.0 → leverage-3.2.0}/leverage/modules/credentials.py

@@ -16,13 +16,14 @@ from ruamel.yaml import YAML
 from questionary import Choice
 from click.exceptions import Exit
 
-from leverage import logger
+from leverage import conf, logger
 from leverage._utils import ExitError
 from leverage.modules.runner import Runner
 from leverage._internals import State, pass_runner, pass_paths, pass_state
 from leverage.path import (
     NotARepositoryError,
     PathsHandler,
+    build_paths_and_environment,
     get_global_config_path,
     get_project_root_or_current_dir_path,
 )
@@ -253,7 +254,6 @@ def credentials(state):
             raise an exception
 
     If we reached the only common.tfvars scenario, we have no project name nor TF_IMAGE_TAG.
-    So the best chance is to read the common.tfvars directly without a container, e.g. with sed or grep
     """
     project_config = _load_project_yaml()
     build_env = Path(f"{PROJECT_ROOT}/build.env")
@@ -265,6 +265,20 @@ def credentials(state):
         if short_name is None or not re.match("^[a-z]{2,4}$", short_name):
             logger.error("Invalid or missing project short name in project.yaml file.")
             raise Exit(1)
+
+        if not build_env.exists():
+            # Completes this branch's own docstring promise, mirroring the common.tfvars branch
+            # below. Guarded so a mature project that still has project.yaml on disk never has
+            # its real build.env clobbered (project create never deletes project.yaml).
+            logger.info("Writing project short name to build.env.")
+            build_env.write_text(f"PROJECT={short_name}\nTF_IMAGE_TAG=1.1.9")
+
+        if state.paths is None:
+            # Upstream (leverage.py) skipped PathsHandler because only project.yaml existed.
+            # build.env now has a project name (or already did) - reload config from disk and
+            # build real, project-scoped paths here instead of leaving state.paths/environment None.
+            state.config = conf.load()
+            state.paths, state.environment = build_paths_and_environment(state.config)
     elif not build_env.exists():
         # project_config is not empty
         # and build.env does not exist
@@ -372,7 +386,7 @@ def _profile_is_configured(awscli: Runner, profile: str):
     Returns:
         bool: Whether the profile was already configured or not.
     """
-    exit_code, _, _ = awscli.exec("configure", "list", "--profile", profile)
+    exit_code, _, _ = awscli.exec("configure", "list", "--profile", profile, raises=False)
 
     return not exit_code
 
@@ -446,7 +460,7 @@ def configure_credentials(
     values = {"aws_access_key_id": key_id, "aws_secret_access_key": secret_key}
 
     for key, value in values.items():
-        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile, raises=False)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -467,7 +481,7 @@ def _credentials_are_valid(awscli: Runner, profile: str):
     Returns:
         bool: Whether the credentials are valid.
     """
-    error_code, output, _ = awscli.exec("sts", "get-caller-identity", "--profile", profile)
+    error_code, output, _ = awscli.exec("sts", "get-caller-identity", "--profile", profile, raises=False)
 
     return error_code != 255 and "InvalidClientTokenId" not in output
 
@@ -482,7 +496,9 @@ def _get_management_account_id(awscli: Runner, profile: str):
     Returns:
         str: Management account id.
     """
-    exit_code, caller_identity, _ = awscli.exec("sts", "get-caller-identity", "--output", "json", "--profile", profile)
+    exit_code, caller_identity, _ = awscli.exec(
+        "sts", "get-caller-identity", "--output", "json", "--profile", profile, raises=False
+    )
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {caller_identity}")
 
@@ -502,7 +518,7 @@ def _get_organization_accounts(awscli: Runner, profile: str, project_name: str):
         dict: Mapping of organization accounts names to ids.
     """
     exit_code, organization_accounts, _ = awscli.exec(
-        "organizations", "list-accounts", "--output", "json", "--profile", profile
+        "organizations", "list-accounts", "--output", "json", "--profile", profile, raises=False
     )
 
     if exit_code:
@@ -530,7 +546,9 @@ def _get_mfa_serial(awscli: Runner, profile: str):
     Returns:
         str: MFA device serial.
     """
-    exit_code, mfa_devices, _ = awscli.exec("iam", "list-mfa-devices", "--output", "json", "--profile", profile)
+    exit_code, mfa_devices, _ = awscli.exec(
+        "iam", "list-mfa-devices", "--output", "json", "--profile", profile, raises=False
+    )
     if exit_code:
         raise ExitError(exit_code, f"AWS CLI error: {mfa_devices}")
     mfa_devices = json.loads(mfa_devices)
@@ -558,7 +576,7 @@ def configure_profile(awscli: Runner, profile: str, values: dict):
     """
     logger.info(f"\tConfiguring profile [bold]{profile}[/bold]")
     for key, value in values.items():
-        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile)
+        exit_code, output, _ = awscli.exec("configure", "set", key, value, "--profile", profile, raises=False)
         if exit_code:
             raise ExitError(exit_code, f"AWS CLI error: {output}")
 
@@ -613,13 +631,78 @@ def configure_accounts_profiles(
         # A profile identifier looks like `le-security-oaar`
         account_profiles[f"{short_name}-{account_name}-{PROFILES[_type]['profile_role']}-mfa"] = account_profile
 
-    logger.info("Backing up account profiles file.")
-    shutil.copy(paths.aws_config_file, paths.aws_config_file.with_suffix(".bkp"))
+    if paths.aws_config_file.exists():
+        logger.info("Backing up account profiles file.")
+        shutil.copy(paths.aws_config_file, paths.aws_config_file.with_suffix(".bkp"))
 
     for profile_identifier, profile_values in account_profiles.items():
         configure_profile(profile_identifier, profile_values)
 
 
+def _find_matching_brace(content: str, start: int):
+    """Find the position of the brace closing the one opened at `start`.
+
+    Braces appearing inside double quoted strings are ignored.
+
+    Args:
+        content (str): Text to scan.
+        start (int): Position of the opening brace.
+
+    Returns:
+        int: Position of the matching closing brace, or None if it is unbalanced.
+    """
+    depth = 0
+    in_string = False
+    position = start
+
+    while position < len(content):
+        char = content[position]
+
+        if in_string:
+            if char == "\\":
+                position += 1
+            elif char == '"':
+                in_string = False
+        elif char == '"':
+            in_string = True
+        elif char == "{":
+            depth += 1
+        elif char == "}":
+            depth -= 1
+            if not depth:
+                return position
+
+        position += 1
+
+    return None
+
+
+def _replace_hcl_attribute(content: str, attribute: str, value: str):
+    """Replace the value of a brace delimited HCL attribute, honoring nested blocks.
+
+    A non greedy regex cannot be used for this: it stops at the first closing brace, which for a
+    nested block leaves the remaining entries orphaned and the file with unbalanced braces.
+
+    Args:
+        content (str): Full text of the HCL file.
+        attribute (str): Name of the attribute to replace, e.g. `accounts`.
+        value (str): New value for the attribute, enclosing braces included.
+
+    Returns:
+        str: Content with the attribute replaced, unchanged if the attribute was not found.
+    """
+    attribute_definition = re.search(rf"^{re.escape(attribute)}\s*=\s*\{{", content, flags=re.MULTILINE)
+    if attribute_definition is None:
+        return content
+
+    opening_brace = attribute_definition.end() - 1
+    closing_brace = _find_matching_brace(content, opening_brace)
+    if closing_brace is None:
+        return content
+
+    return f"{content[:attribute_definition.start()]}{attribute} = {value}{content[closing_brace + 1:]}"
+
+
 @pass_paths
 def _update_account_ids(paths: PathsHandler, config: dict):
     """Update accounts ids in global configuration file.
@@ -654,9 +737,7 @@ def _update_account_ids(paths: PathsHandler, config: dict):
     accs = f"{{{accs}\n}}"
 
     common_tfvars = paths.common_tfvars.read_text()
-    common_tfvars = re.sub(
-        r"accounts\s*=\s*\{.*?\}(?=\s*(?:\n|$))", f"accounts = {accs}", common_tfvars, flags=re.DOTALL
-    )
+    common_tfvars = _replace_hcl_attribute(common_tfvars, "accounts", accs)
     paths.common_tfvars.write_text(common_tfvars)
 
 

{leverage-3.1.0 → leverage-3.2.0}/leverage/modules/tf.py

@@ -23,8 +23,8 @@ REGION = r"(global|([a-z]{2}(-gov)?)-(central|(north|south)?(east|west)?)-\d)"
 @pass_state
 def tofu(state):
     """Run OpenTofu commands in the context of the current project.
-    All tofu subcommands that receive extra args will pass the given strings as is to their corresponding OpenTofu
-    counterparts in the container. For example as in `leverage tofu apply -auto-approve` or
+    All tofu subcommands that receive extra args will pass the given strings as is to the OpenTofu binary.
+    For example as in `leverage tofu apply -auto-approve` or
     `leverage tofu init -reconfigure`
     """
     state.runner = TFRunner(binary=state.paths.tf_binary, env_vars=state.environment)
@@ -34,8 +34,8 @@ def tofu(state):
 @pass_state
 def terraform(state):
     """Run Terraform commands in the context of the current project.
-    All terraform subcommands that receive extra args will pass the given strings as is to their corresponding Terraform
-    counterparts in the container. For example as in `leverage terraform apply -auto-approve` or
+    All terraform subcommands that receive extra args will pass the given strings as is to the Terraform binary.
+    For example as in `leverage terraform apply -auto-approve` or
     `leverage terraform init -reconfigure`
     """
     state.runner = TFRunner(binary=state.paths.tf_binary, terraform=True, env_vars=state.environment)
@@ -146,7 +146,8 @@ def tf_default_args(paths: PathsHandler) -> tuple:
 @pass_runner
 def version(tf):
     """Print version."""
-    tf.run("version")
+    if exit_code := tf.run("version"):
+        raise Exit(exit_code)
 
 
 @click.command("format", context_settings=CONTEXT_SETTINGS)
@@ -155,7 +156,8 @@ def version(tf):
 def _format(tf, args):
     """Check if all files meet the canonical format and rewrite them accordingly."""
     args = args if "-recursive" in args else (*args, "-recursive")
-    tf.run("fmt", *args)
+    if exit_code := tf.run("fmt", *args):
+        raise Exit(exit_code)
 
 
 @click.command("force-unlock")
@@ -165,7 +167,8 @@ def _format(tf, args):
 @pass_runner
 def force_unlock(tf, paths: PathsHandler, lock_id):
     """Force unlock the state file."""
-    tf.run("force-unlock", lock_id)
+    if exit_code := tf.run("force-unlock", lock_id):
+        raise Exit(exit_code)
 
 
 @click.command()
@@ -174,7 +177,8 @@ def force_unlock(tf, paths: PathsHandler, lock_id):
 @pass_runner
 def validate(tf, paths: PathsHandler):
     """Validate code of the current directory. Previous initialization might be needed."""
-    tf.run("validate", *tf_default_args())
+    if exit_code := tf.run("validate", *tf_default_args()):
+        raise Exit(exit_code)
 
 
 @click.command("validate-layout")
@@ -190,7 +194,8 @@ def validate_layout(paths):
 @pass_runner
 def _import(tf, address, _id):
     """Import a resource."""
-    tf.run("import", *tf_default_args(), address, _id)
+    if exit_code := tf.run("import", *tf_default_args(), address, _id):
+        raise Exit(exit_code)
 
 
 @click.command("refresh-credentials")
@@ -275,12 +280,11 @@ def invoke_for_all_commands(paths, layers, command, *args: Sequence[str], skip_v
             backend_key = backend_key_base.replace("/base-", "/").replace("/tools-", "/")
             set_backend_key(layer / "config.tf", backend_key)
 
-    # check layers existence
     for layer in layers:
         if len(layers) > 1:
             logger.info(f"Invoking command for layer {layer}...")
 
-        # execute the actual command
+        # execute the actual command; a failing layer raises Exit and stops the remaining ones
         command(args, working_dir=layer)
 
     return layers
@@ -320,7 +324,8 @@ def _init(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: P
     )
     init_args = (*filtered_args, f"-backend-config={paths.backend_tfvars}")
 
-    tf.run("init", *tf_default_args(), *init_args, working_dir=working_dir)
+    if exit_code := tf.run("init", *tf_default_args(), *init_args, working_dir=working_dir):
+        raise Exit(exit_code)
 
 
 @authenticate
@@ -328,7 +333,8 @@ def _init(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: P
 @pass_runner
 def _plan(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Generate an execution plan for this layer."""
-    tf.run("plan", *tf_default_args(), *args, working_dir=working_dir)
+    if exit_code := tf.run("plan", *tf_default_args(), *args, working_dir=working_dir):
+        raise Exit(exit_code)
 
 
 def has_a_plan_file(args: Sequence[str]) -> bool:
@@ -393,7 +399,9 @@ def _apply(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir:
     default_args = () if has_a_plan_file(args) else tf_default_args()
     logger.debug(f"Default args passed to apply command: {default_args}")
 
-    tf.run("apply", *default_args, *args, working_dir=working_dir)
+    if exit_code := tf.run("apply", *default_args, *args, working_dir=working_dir):
+        logger.error(f"Command execution failed with exit code: {exit_code}")
+        raise Exit(exit_code)
 
 
 @authenticate
@@ -401,7 +409,8 @@ def _apply(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir:
 @pass_runner
 def _output(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Show all output variables of this layer."""
-    tf.run("output", *args, working_dir=working_dir)
+    if exit_code := tf.run("output", *args, working_dir=working_dir):
+        raise Exit(exit_code)
 
 
 @authenticate
@@ -409,7 +418,8 @@ def _output(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir:
 @pass_runner
 def _destroy(tf: TFRunner, paths: PathsHandler, args: Sequence[str], working_dir: Path):
     """Destroy infrastructure in this layer."""
-    tf.run("destroy", *tf_default_args(), *args, working_dir=working_dir)
+    if exit_code := tf.run("destroy", *tf_default_args(), *args, working_dir=working_dir):
+        raise Exit(exit_code)
 
 
 # ###########################################################################
@@ -485,7 +495,7 @@ def _make_layer_backend_key(cwd, account_dir, account_name):
 
 @pass_paths
 def _validate_layout(paths, layer: str):
-    paths.check_for_layer_location()
+    paths.check_for_layer_location(Path(layer))
 
     # Check for `environment = <account name>` in account.tfvars
     account_name = paths.account_conf.get("environment")

{leverage-3.1.0 → leverage-3.2.0}/leverage/modules/tfautomv.py

@@ -12,7 +12,7 @@ from leverage.modules.auth import authenticate
 @authenticate
 @pass_state
 def tfautomv(state, args):
-    """Run TFAutomv commands in the context of the current project.`"""
+    """Run TFAutomv commands in the context of the current project."""
     tf_default_args_string = " ".join(tf_default_args())
     state.environment["TF_CLI_ARGS_init"] = tf_default_args_string
     state.environment["TF_CLI_ARGS_plan"] = tf_default_args_string

{leverage-3.1.0 → leverage-3.2.0}/leverage/path.py

@@ -157,7 +157,7 @@ class PathsHandler:  # TODO: Turn this class into a something that represents a
         self.backend_conf = hcl2.loads(backend_config.read_text()) if backend_config.exists() else {}
 
         # Get MFA enabled status
-        self.mfa_enabled = env_conf.get("MFA_ENABLED", "false")
+        self.mfa_enabled = str(env_conf.get("MFA_ENABLED", "false")).strip().lower() == "true"
 
         # Get project name
         self.project = self.common_conf.get("project", env_conf.get("PROJECT", False))
@@ -183,11 +183,13 @@ class PathsHandler:  # TODO: Turn this class into a something that represents a
 
     @property
     def common_tfvars(self):
-        return f"{self.root_dir}/config/{self.COMMON_TF_VARS}"
+        # return f"{self.root_dir}/config/{self.COMMON_TF_VARS}"
+        return self.root_dir / "config" / self.COMMON_TF_VARS
 
     @property
     def account_tfvars(self):
-        return f"{self.account_dir}/config/{self.ACCOUNT_TF_VARS}"
+        # return f"{self.account_dir}/config/{self.ACCOUNT_TF_VARS}"
+        return self.account_dir / "config" / self.ACCOUNT_TF_VARS
 
     @property
     def backend_tfvars(self):
@@ -267,3 +269,25 @@ def get_project_root_or_current_dir_path() -> Path:
         root = Path.cwd()
 
     return root
+
+
+def is_project_yaml_only_bootstrap() -> bool:
+    """Whether only `project.yaml` exists yet: `project init` has run but `project create`
+    hasn't, so neither `build.env` nor `config/common.tfvars` exist. PathsHandler can't resolve
+    a project name in this state; callers should skip it and derive the name from project.yaml.
+    """
+    root = get_project_root_or_current_dir_path()
+    build_env = root / "build.env"
+    common_tfvars = Path(get_global_config_path()) / "common.tfvars"
+    return (root / "project.yaml").exists() and not build_env.exists() and not common_tfvars.exists()
+
+
+def build_paths_and_environment(config: dict) -> tuple[PathsHandler, dict]:
+    """Build a PathsHandler and the AWS cli environment variables derived from it. Shared by any
+    group callback that needs to resolve project paths from `state.config`."""
+    paths = PathsHandler(config)
+    environment = {
+        "AWS_SHARED_CREDENTIALS_FILE": str(paths.aws_credentials_file),
+        "AWS_CONFIG_FILE": str(paths.aws_config_file),
+    }
+    return paths, environment

{leverage-3.1.0 → leverage-3.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "leverage"
-version = "3.1.0"
+version = "3.2.0"
 description = "Binbash Leverage Command-Line tool."
 authors = ["BinBash Inc <leverage@binbash.com.ar>"]
 license = "MIT"