local-devops-workbench 0.2.1__tar.gz

local_devops_workbench-0.2.1/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @AsemDevs

local_devops_workbench-0.2.1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,34 @@
+name: Bug report
+description: Report a reproducible Local DevOps Workbench defect.
+title: "bug: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include secrets. Use private vulnerability reporting for security issues.
+  - type: input
+    id: version
+    attributes:
+      label: Workbench version
+      placeholder: ldw --version
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      placeholder: macOS 15 arm64 or Ubuntu 24.04 amd64
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Provide minimal steps, expected behavior, and redacted actual output.
+    validations:
+      required: true
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Redacted doctor output
+      description: Paste `ldw doctor --json` after removing private values.

local_devops_workbench-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Setup and design questions
+    url: https://github.com/openplanr/ldw/discussions
+    about: Ask the community before filing a defect.
+  - name: Security vulnerability
+    url: https://github.com/openplanr/ldw/security/advisories/new
+    about: Report security issues privately.

local_devops_workbench-0.2.1/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Propose a project-neutral capability or provider improvement.
+title: "feat: "
+labels: [enhancement, triage]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the developer problem without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Explain the workflow and acceptance criteria.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

local_devops_workbench-0.2.1/.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      python-minor-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [minor, patch]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions-minor-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: [minor, patch]

local_devops_workbench-0.2.1/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Summary
+
+<!-- Explain the user-visible outcome and why this change is needed. -->
+
+## Verification
+
+- [ ] Tests cover the behavior or the PR explains why tests are not applicable.
+- [ ] Documentation and changelog are updated when behavior changes.
+- [ ] No secrets, personal paths, private project names, or generated local state are included.
+- [ ] I have run the relevant lint, type, unit, and integration checks.
+- [ ] Every commit has a GitHub-verified cryptographic signature (`git commit -S`).
+
+## Safety and compatibility
+
+<!-- Describe migrations, rollback behavior, destructive effects, and compatibility impact. -->

local_devops_workbench-0.2.1/.github/workflows/integration.yml

@@ -0,0 +1,417 @@
+name: integration
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: integration-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect integration scope
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    outputs:
+      compose: ${{ steps.scope.outputs.compose }}
+      mixed: ${{ steps.scope.outputs.mixed }}
+      kind: ${{ steps.scope.outputs.kind }}
+      export: ${{ steps.scope.outputs.export }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Select expensive jobs
+        id: scope
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if test "${EVENT_NAME}" = pull_request; then
+            git diff --name-only -z "${BASE_SHA}" "${HEAD_SHA}" \
+              | python3 scripts/ci_scope.py integration --github-output "${GITHUB_OUTPUT}"
+          else
+            python3 scripts/ci_scope.py integration --all --github-output "${GITHUB_OUTPUT}"
+          fi
+
+  compose:
+    name: Exercise Docker Compose lifecycle
+    needs: changes
+    if: needs.changes.outputs.compose == 'true'
+    timeout-minutes: 25
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.12"
+          version: "0.12.1"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --extra dev --frozen
+      - run: uv run ldw project link four-service examples/four-service
+      - run: uv run ldw plan four-service --json
+      - run: uv run ldw up four-service --no-ui
+      - run: uv run ldw status four-service --json
+      - run: uv run ldw lab run container-crash --project four-service --target ldw-four-service-api-1
+      - run: uv run ldw test four-service --suite smoke
+      - name: Verify PostgreSQL and Redis backup restoration
+        run: uv run python examples/four-service/tests/backup_restore.py compose
+      - if: always()
+        run: uv run ldw down four-service
+
+  mixed:
+    name: Exercise reviewed mixed lifecycle
+    needs: changes
+    if: needs.changes.outputs.mixed == 'true'
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.12"
+          version: "0.12.1"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --extra dev --frozen
+      - name: Enable the fixture package manager
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.15.0 --activate
+      - name: Exercise one-command startup, Ctrl-C, adoption, and explicit down
+        run: uv run python scripts/mixed_runtime_acceptance.py
+
+  kind:
+    name: Exercise kind lifecycle
+    needs: changes
+    if: needs.changes.outputs.kind == 'true'
+    timeout-minutes: 35
+    runs-on: ubuntu-latest
+    env:
+      LDW_CI: "true"
+      LDW_HOME: /tmp/ldw-home
+      KUBECONFIG: /tmp/ldw-home/state/kubeconfigs/ldw-ci.yaml
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.12"
+          version: "0.12.1"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          version: v0.33.0
+          driver: docker
+      - name: Verify pinned Buildx CLI
+        run: |
+          buildx_version="$(docker buildx version)"
+          case " ${buildx_version} " in
+            *" v0.33.0 "*) ;;
+            *)
+              echo "expected Docker Buildx v0.33.0, received: ${buildx_version}" >&2
+              exit 1
+              ;;
+          esac
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      - uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0
+      - run: sudo apt-get update && sudo apt-get install -y mkcert
+      - run: uv sync --extra dev --frozen
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: /tmp/ldw-home/data/tools
+          key: ldw-tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('packages/ldw-core/src/local_devops_workbench/assets/runtime/tools.lock.toml') }}
+      - run: uv run ldw bootstrap --apply
+      - run: echo "${LDW_HOME}/data/tools/bin" >> "$GITHUB_PATH"
+      - run: uv run ldw project link four-service examples/four-service
+      - run: uv run ldw cluster create
+      - run: uv run ldw up four-service:kubernetes --no-ui
+      - name: Verify Kubernetes image attestations
+        run: |
+          plan_file="${RUNNER_TEMP}/ldw-kind-plan.json"
+          build_file="${RUNNER_TEMP}/ldw-kind-builds.tsv"
+          uv run ldw plan four-service:kubernetes --json > "${plan_file}"
+
+          jq -e '
+            [.[0].actions[] | select(.id | test(":up:build:[^:]+$"))] as $actions
+            | ($actions | length) > 0
+              and all($actions[];
+                ((.resource_id | type) == "string" and (.resource_id | length) > 0)
+                and .argv[0:3] == ["docker", "buildx", "build"]
+                and ([.argv[] | select(. == "--tag")] | length) == 1
+                and ([.argv[] | select(. == "--builder")] | length) == 1
+                and ([.argv[] | select(. == "--output")] | length) == 1
+                and ((.argv | index("--tag")) as $index
+                  | $index != null
+                    and $index + 1 < (.argv | length)
+                    and (.argv[$index + 1] | startswith("ldw-kind-registry:5000/")))
+                and ((.argv | index("--builder")) as $index
+                  | $index != null
+                    and $index + 1 < (.argv | length)
+                    and .argv[$index + 1] == "ldw-ci-builder")
+                and ((.argv | index("--output")) as $index
+                  | $index != null
+                    and .argv[$index + 1] == "type=registry,registry.insecure=true")
+                and (.argv | index("--provenance=mode=min,version=v1")) != null
+                and ([.argv[]
+                  | select(test(
+                      "^--sbom=generator=docker/buildkit-syft-scanner:stable-1@sha256:[0-9a-f]{64}$"
+                    ))] | length) == 1)
+              and ([$actions[].id] | length == (unique | length))
+              and ([
+                $actions[]
+                | (.argv | index("--tag")) as $index
+                | .argv[$index + 1]
+              ] | length == (unique | length))
+          ' "${plan_file}"
+
+          jq -er '
+            .[0].actions[]
+            | select(.id | test(":up:build:[^:]+$"))
+            | (.argv | index("--tag")) as $tag_index
+            | (.argv | index("--builder")) as $builder_index
+            | [.id, .resource_id, .argv[$tag_index + 1], .argv[$builder_index + 1]]
+            | @tsv
+          ' "${plan_file}" > "${build_file}"
+          test -s "${build_file}"
+
+          builder_name="$(cut -f4 "${build_file}" | sort -u)"
+          test "$(wc -l <<< "${builder_name}")" -eq 1
+          builder_driver="$(
+            docker buildx ls --format '{{ json . }}' \
+              | jq -sr --arg builder "${builder_name}" '
+                  [.[] | select(.Name == $builder) | .Driver]
+                  | unique
+                  | if length == 1 then .[0]
+                    else error("expected exactly one Buildx driver")
+                    end
+                '
+          )"
+          test "${builder_driver}" = "docker-container"
+
+          while IFS=$'\t' read -r action_id image_name internal_ref builder; do
+            test "${builder}" = "${builder_name}"
+            repository_path="${internal_ref#ldw-kind-registry:5000/}"
+            test "${repository_path}" != "${internal_ref}"
+            image_ref="localhost:5001/${repository_path}"
+
+            case "${image_ref}" in
+              "localhost:5001/ldw/four-service/${image_name}:"*) ;;
+              *)
+                echo "unexpected tag for ${action_id}: ${image_ref}" >&2
+                exit 1
+                ;;
+            esac
+
+            manifest_json="$(
+              docker buildx imagetools inspect "${image_ref}" --format '{{ json .Manifest }}'
+            )"
+            index_digest="$(
+              jq -er '.digest | select(test("^sha256:[0-9a-f]{64}$"))' <<< "${manifest_json}"
+            )"
+            subject_digest="$(
+              jq -er '
+                [.manifests[]
+                  | select(.platform.os != "unknown")
+                  | .digest]
+                | unique
+                | if length == 1 then .[0]
+                  else error("expected exactly one image subject")
+                  end
+              ' <<< "${manifest_json}"
+            )"
+            attested_subject="$(
+              jq -er '
+                [.manifests[]
+                  | select(
+                      .annotations["vnd.docker.reference.type"] == "attestation-manifest"
+                    )
+                  | .annotations["vnd.docker.reference.digest"]]
+                | unique
+                | if length == 1 then .[0]
+                  else error("expected attestations for exactly one subject")
+                  end
+              ' <<< "${manifest_json}"
+            )"
+            test "${attested_subject}" = "${subject_digest}"
+
+            repository="${image_ref%:*}"
+            canonical_ref="${repository}@${index_digest}"
+            canonical_manifest="$(
+              docker buildx imagetools inspect "${canonical_ref}" \
+                --format '{{ json .Manifest }}'
+            )"
+            test "$(jq -er '.digest' <<< "${canonical_manifest}")" = "${index_digest}"
+
+            docker buildx imagetools inspect "${canonical_ref}" \
+              --format '{{ json .Provenance.SLSA }}' \
+              | jq -e '
+                  .buildDefinition.buildType
+                    == "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md"
+                  and (
+                    .buildDefinition.externalParameters.request.frontend
+                    == "dockerfile.v0"
+                  )
+                  and (
+                    .buildDefinition.internalParameters.builderPlatform
+                    | type == "string"
+                  )
+                  and (.buildDefinition.resolvedDependencies | type == "array")
+                  and (.runDetails.builder | type == "object")
+                  and (.runDetails.metadata | type == "object")
+                '
+            docker buildx imagetools inspect "${canonical_ref}" \
+              --format '{{ json .SBOM.SPDX }}' \
+              | jq -e '
+                  [
+                    .. | objects
+                    | select(
+                        .SPDXID? == "SPDXRef-DOCUMENT"
+                        and (.spdxVersion? | startswith("SPDX-"))
+                      )
+                  ] | length > 0
+                '
+          done < "${build_file}"
+      - run: kubectl --kubeconfig "${KUBECONFIG}" --context kind-ldw-ci rollout restart deployment/api -n ldw-four-service
+      - run: kubectl --kubeconfig "${KUBECONFIG}" --context kind-ldw-ci rollout status deployment/api -n ldw-four-service --timeout=180s
+      - run: uv run ldw lab run k8s-pod-restart --project four-service --resource api
+      - name: Verify Kubernetes PostgreSQL and Redis backup restoration
+        run: uv run python examples/four-service/tests/backup_restore.py kubernetes
+      - if: always()
+        run: uv run ldw down four-service:kubernetes
+      - if: always()
+        run: uv run ldw cluster delete --confirm ldw-ci
+
+  export:
+    name: Exercise the exported Tiltfile
+    needs: changes
+    if: needs.changes.outputs.export == 'true'
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    env:
+      LDW_HOME: /tmp/ldw-home
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.12"
+          version: "0.12.1"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - run: uv sync --extra dev --frozen
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: /tmp/ldw-home/data/tools
+          key: ldw-tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('packages/ldw-core/src/local_devops_workbench/assets/runtime/tools.lock.toml') }}
+      - name: Install the pinned tools, verifying each checksum
+        run: uv run ldw bootstrap --apply
+      - name: Enable the fixture package manager
+        run: |
+          corepack enable
+          corepack prepare pnpm@10.15.0 --activate
+      - name: Run the exported Tiltfile with plain tilt ci, without ldw
+        run: uv run python scripts/export_tilt_acceptance.py "${LDW_HOME}/data/tools/bin/tilt"
+
+  integration-gate:
+    name: Integration Gate
+    if: always()
+    needs: [changes, compose, mixed, kind, export]
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: needs.changes.outputs.compose == 'true' || needs.changes.outputs.mixed == 'true' || needs.changes.outputs.kind == 'true'
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        if: needs.changes.outputs.compose == 'true' || needs.changes.outputs.mixed == 'true' || needs.changes.outputs.kind == 'true'
+        with:
+          python-version: "3.12"
+          version: "0.12.1"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - if: needs.changes.outputs.compose == 'true' || needs.changes.outputs.mixed == 'true' || needs.changes.outputs.kind == 'true'
+        run: uv sync --extra dev --frozen
+      - name: Generate truthful integration acceptance evidence
+        id: report
+        if: needs.changes.outputs.compose == 'true' || needs.changes.outputs.mixed == 'true' || needs.changes.outputs.kind == 'true'
+        env:
+          COMPOSE_RESULT: ${{ needs.compose.result }}
+          MIXED_RESULT: ${{ needs.mixed.result }}
+          KIND_RESULT: ${{ needs.kind.result }}
+        run: |
+          mkdir -p acceptance/evidence acceptance/report
+          arguments=(--output-dir acceptance/report --source-revision "${GITHUB_SHA}")
+          for check_id in compose kind; do
+            if test "${check_id}" = compose; then
+              case "${COMPOSE_RESULT}:${MIXED_RESULT}" in
+                skipped:skipped) result=skipped ;;
+                success:success|success:skipped|skipped:success) result=success ;;
+                *) result="compose=${COMPOSE_RESULT},mixed=${MIXED_RESULT}" ;;
+              esac
+            else
+              result="${KIND_RESULT}"
+            fi
+            if test "${result}" = success; then
+              evidence="acceptance/evidence/${check_id}.txt"
+              if test "${check_id}" = compose; then
+                printf 'workflow=integration\ncheck=%s\nresult=%s\ncompose_result=%s\nmixed_result=%s\nrevision=%s\n' \
+                  "${check_id}" "${result}" "${COMPOSE_RESULT}" "${MIXED_RESULT}" \
+                  "${GITHUB_SHA}" > "${evidence}"
+              else
+                printf 'workflow=integration\ncheck=%s\nresult=%s\nrevision=%s\n' \
+                  "${check_id}" "${result}" "${GITHUB_SHA}" > "${evidence}"
+              fi
+              arguments+=(--result "${check_id}=passed" --evidence "${check_id}=${evidence}")
+            elif test "${result}" = skipped; then
+              arguments+=(--result "${check_id}=not-run" --detail "${check_id}=not selected")
+            else
+              arguments+=(--result "${check_id}=failed" --detail "${check_id}=${result}")
+            fi
+          done
+          uv run ldw acceptance report "${arguments[@]}"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always() && steps.report.outcome != 'skipped'
+        with:
+          name: acceptance-integration-${{ github.sha }}
+          path: acceptance/
+          if-no-files-found: error
+          retention-days: 7
+      - name: Enforce required integration results
+        env:
+          COMPOSE_RESULT: ${{ needs.compose.result }}
+          MIXED_RESULT: ${{ needs.mixed.result }}
+          KIND_RESULT: ${{ needs.kind.result }}
+          EXPORT_RESULT: ${{ needs.export.result }}
+          CHANGES_RESULT: ${{ needs.changes.result }}
+          COMPOSE_REQUIRED: ${{ needs.changes.outputs.compose }}
+          MIXED_REQUIRED: ${{ needs.changes.outputs.mixed }}
+          KIND_REQUIRED: ${{ needs.changes.outputs.kind }}
+          EXPORT_REQUIRED: ${{ needs.changes.outputs.export }}
+        run: |
+          require_result() {
+            case "$1:$2" in
+              true:success|false:skipped) return 0 ;;
+              *) return 1 ;;
+            esac
+          }
+          test "${CHANGES_RESULT}" = success
+          require_result "${COMPOSE_REQUIRED}" "${COMPOSE_RESULT}"
+          require_result "${MIXED_REQUIRED}" "${MIXED_RESULT}"
+          require_result "${KIND_REQUIRED}" "${KIND_RESULT}"
+          require_result "${EXPORT_REQUIRED}" "${EXPORT_RESULT}"