mcli-framework 8.0.48__tar.gz → 8.0.50__tar.gz

{mcli_framework-8.0.48/src/mcli_framework.egg-info → mcli_framework-8.0.50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.48
+Version: 8.0.50
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>
@@ -37,6 +37,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click<9.0.0,>=8.1.7
+Requires-Dist: ruamel.yaml<0.19,>=0.18
 Requires-Dist: rich<15.0.0,>=14.0.0
 Requires-Dist: requests<3.0.0,>=2.31.0
 Requires-Dist: tomli<3.0.0,>=2.2.1

{mcli_framework-8.0.48 → mcli_framework-8.0.50}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcli-framework"
-version = "8.0.48"
+version = "8.0.50"
 description = "Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job."
 readme = "README.md"
  requires-python = ">=3.10"
@@ -37,6 +37,7 @@ classifiers = [
 dependencies = [
   # Core CLI dependencies
   "click>=8.1.7,<9.0.0",
+  "ruamel.yaml>=0.18,<0.19",
   "rich>=14.0.0,<15.0.0",
   "requests>=2.31.0,<3.0.0",
   "tomli>=2.2.1,<3.0.0",

{mcli_framework-8.0.48 → mcli_framework-8.0.50}/src/mcli/app/main.py

@@ -447,6 +447,15 @@ def _add_lazy_commands(app: click.Group):
     except ImportError as e:
         logger.debug(f"Could not load sync group: {e}")
 
+    # mcli ci - act-first CI gate + hosted-trigger migration
+    try:
+        from mcli.workflow.ci.ci import ci
+
+        app.add_command(ci, name="ci")
+        logger.debug("Added ci group")
+    except ImportError as e:
+        logger.debug(f"Could not load ci group: {e}")
+
     # mcli setup - Onboarding wizard for new users
     try:
         from mcli.app.setup_cmd import setup

{mcli_framework-8.0.48 → mcli_framework-8.0.50}/src/mcli/lib/ipfs_sync.py

@@ -28,7 +28,7 @@ import hashlib
 import json
 import time
 from datetime import datetime
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Optional
 
 import requests
@@ -535,7 +535,19 @@ class IPFSSync:
                         f"hash mismatch for '{name}': expected {expected_value}, got {actual}"
                     )
 
-            target = workflows_dir / script_filename
+            # SECURITY: `script_filename` comes from a remote, untrusted manifest.
+            # Contain it inside workflows_dir so a crafted manifest cannot write
+            # outside the directory via '..' segments or an absolute path.
+            rel = PurePosixPath(script_filename)
+            if rel.is_absolute() or any(part == ".." for part in rel.parts):
+                raise ValueError(f"unsafe script path in manifest: {script_filename}")
+            base = Path(workflows_dir).resolve()
+            target = (base / Path(*rel.parts)).resolve()
+            if base != target and base not in target.parents:
+                raise ValueError(f"script path escapes workflows dir: {script_filename}")
+
+            # Recreate group subdirectories (e.g. "demo/hello.py") on pull.
+            target.parent.mkdir(parents=True, exist_ok=True)
             target.write_bytes(payload)
             written.append(target)
 

mcli_framework-8.0.50/src/mcli/workflow/ci/__init__.py

@@ -0,0 +1 @@
+"""act-first CI tooling: local act gate + hosted-trigger stripping for private repos."""

mcli_framework-8.0.50/src/mcli/workflow/ci/act_runner.py

@@ -0,0 +1,61 @@
+"""Run `act` locally and classify the outcome for the PR gate."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from enum import Enum
+from pathlib import Path
+
+
+class PreflightResult(Enum):
+    PASS = "pass"
+    FAIL = "fail"
+    UNREACHABLE = "unreachable"
+
+
+def act_available() -> bool:
+    return shutil.which("act") is not None
+
+
+def docker_running() -> bool:
+    try:
+        proc = subprocess.run(["docker", "info"], capture_output=True, timeout=30)
+        return proc.returncode == 0
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return False
+
+
+def probe() -> bool:
+    """Can act actually run here? Needs the binary, a live docker daemon, and `act -l`."""
+    if not act_available() or not docker_running():
+        return False
+    try:
+        proc = subprocess.run(["act", "-l"], capture_output=True, text=True, timeout=60)
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return False
+    return proc.returncode == 0
+
+
+def build_act_command(event: str) -> list[str]:
+    cmd = ["act", event]
+    if Path(".secrets").exists():
+        cmd += ["--secret-file", ".secrets"]
+    return cmd
+
+
+def run_act(event: str = "pull_request") -> PreflightResult:
+    """Run act for `event`. PASS on exit 0, else FAIL. (Probe gates UNREACHABLE upstream.)"""
+    proc = subprocess.run(build_act_command(event))
+    return PreflightResult.PASS if proc.returncode == 0 else PreflightResult.FAIL
+
+
+def preflight(repo_slug: str, event: str = "pull_request") -> PreflightResult:
+    """Primary gate. PASS/FAIL if act can run; UNREACHABLE if act can't start here.
+
+    `repo_slug` is accepted for symmetry and future use; the runner fallback is
+    orchestrated by the CLI layer based on runner_status.has_online_runner.
+    """
+    if not probe():
+        return PreflightResult.UNREACHABLE
+    return run_act(event)

mcli_framework-8.0.50/src/mcli/workflow/ci/ci.py

@@ -0,0 +1,172 @@
+"""`mcli ci` — act-first CI gate and hosted-trigger migration for private repos."""
+
+from __future__ import annotations
+
+import re
+import stat
+import subprocess
+from pathlib import Path
+
+import click
+
+from mcli.workflow.ci.act_runner import PreflightResult, act_available, docker_running
+from mcli.workflow.ci.act_runner import preflight as preflight_fn
+from mcli.workflow.ci.runner_status import has_online_runner
+from mcli.workflow.ci.workflow_transform import transform_file, write_self_hosted_workflow
+
+_GITHUB_REMOTE_RE = re.compile(
+    r"(?:git@github\.com:|https://github\.com/)([^/]+/[^/]+?)(?:\.git)?/?$"
+)
+
+
+def current_repo_slug() -> str | None:
+    """owner/name from a github.com origin remote, or None (non-GitHub or no remote)."""
+    try:
+        url = subprocess.run(
+            ["git", "remote", "get-url", "origin"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        ).stdout.strip()
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return None
+    if not url:
+        return None
+    match = _GITHUB_REMOTE_RE.match(url)
+    return match.group(1) if match else None
+
+
+def detect_test_command() -> str:
+    """Best-effort test command for the self-hosted fallback workflow."""
+    makefile = Path("Makefile")
+    if makefile.exists():
+        txt = makefile.read_text()
+        if "\ntest:" in txt or txt.startswith("test:"):
+            return "make test"
+    if Path("pyproject.toml").exists() or Path("pytest.ini").exists():
+        return "uv run pytest -v || pytest -v"
+    if Path("package.json").exists():
+        return "npm test"
+    if Path("mix.exs").exists():
+        return "mix test"
+    return "echo 'TODO: set test command' && exit 1"
+
+
+def workflows_dir() -> Path:
+    return Path(".github") / "workflows"
+
+
+@click.group()
+def ci():
+    """act-first CI: local act gate + stop billed hosted runners on private repos."""
+
+
+@ci.command()
+@click.option("--dry-run", is_flag=True, help="Show what would change without writing.")
+def migrate(dry_run):
+    """Strip hosted triggers from this repo's workflows + add self-hosted fallback."""
+    wfdir = workflows_dir()
+    if not wfdir.exists():
+        click.echo("No .github/workflows directory; nothing to migrate.")
+        return
+    slug = current_repo_slug()
+    has_runner = has_online_runner(slug) if slug else False
+    test_cmd = detect_test_command()
+
+    files = sorted(p for p in wfdir.glob("*.y*ml") if p.name != "self-hosted-ci.yml")
+    if dry_run:
+        from mcli.workflow.ci.workflow_transform import MARKER, _yaml, workflow_has_hosted_job
+
+        for f in files:
+            text = f.read_text()
+            if MARKER in text:
+                click.echo(f"  skip (already migrated): {f.name}")
+                continue
+            hosted = workflow_has_hosted_job(_yaml().load(text))
+            click.echo(f"  {'STRIP' if hosted else 'keep '}: {f.name}")
+        click.echo(f"  fallback self-hosted-ci.yml (pull_request={has_runner}, test='{test_cmd}')")
+        return
+
+    changed = [f.name for f in files if transform_file(f)]
+    created = write_self_hosted_workflow(wfdir, test_cmd, with_pull_request=has_runner)
+    for name in changed:
+        click.echo(f"  stripped: {name}")
+    if created:
+        click.echo(f"  created: self-hosted-ci.yml (pull_request={has_runner})")
+    click.echo(f"Done. {len(changed)} workflow(s) migrated.")
+
+
+@ci.command()
+@click.option("--event", default="pull_request", show_default=True, help="act event to simulate.")
+def preflight(event):
+    """Run act as the PR gate. Exit 0=pass, 1=fail, 2=cannot validate, 3=use runner."""
+    slug = current_repo_slug()
+    result = preflight_fn(slug, event)
+    if result == PreflightResult.PASS:
+        click.echo("✅ act passed — OK to open PR.")
+        raise SystemExit(0)
+    if result == PreflightResult.FAIL:
+        click.echo("❌ act failed — fix before opening PR.")
+        raise SystemExit(1)
+    # UNREACHABLE
+    if slug and has_online_runner(slug):
+        click.echo(
+            "⚠️  act unreachable here; an online runner exists — "
+            "push and let the self-hosted runner validate."
+        )
+        raise SystemExit(3)
+    click.echo("⚠️  act unreachable and no online runner — cannot validate this PR.")
+    raise SystemExit(2)
+
+
+@ci.command()
+def pr():
+    """preflight, then `gh pr create --fill --base main` if it passed."""
+    slug = current_repo_slug()
+    result = preflight_fn(slug)
+    if result == PreflightResult.PASS:
+        # check=False on purpose: let gh/git stream their own errors to the terminal
+        # rather than raising CalledProcessError and hiding their output.
+        subprocess.run(["gh", "pr", "create", "--fill", "--base", "main"], check=False)
+        return
+    if result == PreflightResult.FAIL:
+        click.echo("act failed; not opening PR.")
+        raise SystemExit(1)
+    if slug and has_online_runner(slug):
+        click.echo("act unreachable; pushing so the runner can validate.")
+        subprocess.run(["git", "push", "-u", "origin", "HEAD"], check=False)
+        subprocess.run(["gh", "pr", "create", "--fill", "--base", "main"], check=False)
+        return
+    click.echo("act unreachable and no runner; refusing to open an unvalidated PR.")
+    raise SystemExit(2)
+
+
+PRE_PUSH_HOOK = """#!/usr/bin/env bash
+# mcli-ci pre-push gate: validate with act before pushing.
+exec mcli ci preflight
+"""
+
+
+@ci.command()
+def doctor():
+    """Show act/docker/runner status for this repo."""
+    click.echo(f"act installed:  {act_available()}")
+    click.echo(f"docker running: {docker_running()}")
+    slug = current_repo_slug()
+    click.echo(f"repo:           {slug or '(no origin)'}")
+    if slug:
+        click.echo(f"online runner:  {has_online_runner(slug)}")
+
+
+@ci.command(name="install-hook")
+def install_hook():
+    """Install an opt-in pre-push hook that runs `mcli ci preflight`."""
+    hooks = Path(".git") / "hooks"
+    if not hooks.exists():
+        click.echo("Not a git repo (.git/hooks missing).")
+        raise SystemExit(1)
+    hook = hooks / "pre-push"
+    hook.write_text(PRE_PUSH_HOOK)
+    mode = hook.stat().st_mode
+    hook.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    click.echo(f"Installed pre-push hook at {hook}")

mcli_framework-8.0.50/src/mcli/workflow/ci/runner_status.py

@@ -0,0 +1,26 @@
+"""Query GitHub for self-hosted runner availability via the gh CLI."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+
+
+def has_online_runner(repo_slug: str) -> bool:
+    """True if `repo_slug` (owner/name) has at least one online self-hosted runner."""
+    try:
+        proc = subprocess.run(
+            ["gh", "api", f"repos/{repo_slug}/actions/runners"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return False
+    if proc.returncode != 0:
+        return False
+    try:
+        data = json.loads(proc.stdout or "{}")
+    except json.JSONDecodeError:
+        return False
+    return any(r.get("status") == "online" for r in data.get("runners", []))

mcli_framework-8.0.50/src/mcli/workflow/ci/workflow_transform.py

@@ -0,0 +1,151 @@
+"""Transform GitHub Actions workflows for act-first CI on private repos."""
+
+from __future__ import annotations
+
+from io import StringIO
+from pathlib import Path
+
+from ruamel.yaml import YAML
+
+MARKER = "mcli-ci: hosted-triggers-stripped"
+SELF_HOSTED_FILENAME = "self-hosted-ci.yml"
+HOSTED_PREFIXES = ("ubuntu", "macos", "windows")
+
+
+def is_hosted_label(label: str) -> bool:
+    """True if a runs-on label names a GitHub-hosted runner image."""
+    return str(label).lower().startswith(HOSTED_PREFIXES)
+
+
+def runs_on_is_hosted(runs_on) -> bool:
+    """Classify a job's runs-on. Conservative: unknown expressions count as hosted."""
+    if runs_on is None:
+        return False
+    if isinstance(runs_on, (list, tuple)):
+        labels = [str(x) for x in runs_on]
+        if any("self-hosted" in lbl for lbl in labels):
+            return False
+        return any(is_hosted_label(lbl) for lbl in labels)
+    text = str(runs_on)
+    if "self-hosted" in text:
+        return False
+    if "${{" in text:
+        return True  # unknown matrix/expression -> assume hosted to stop cost
+    return is_hosted_label(text)
+
+
+# NOTE: ruamel.yaml round-trip (YAML(), typ='rt') is the SAFE, correct loader here.
+# It does NOT execute `!!python/object` tags like PyYAML's yaml.load(). Do not
+# "fix" this to PyYAML safe_load — that would strip comments/formatting and break
+# round-tripping. Round-trip preservation is a hard requirement of this transform.
+def _yaml() -> YAML:
+    y = YAML()
+    y.version = (1, 2)  # critical: keeps bare `on:` a string, not boolean True
+    y.preserve_quotes = True
+    y.width = 4096  # avoid reflowing long lines
+    y.indent(mapping=2, sequence=4, offset=2)
+    return y
+
+
+def workflow_has_hosted_job(doc) -> bool:
+    """True if any job in the parsed workflow targets a GitHub-hosted runner."""
+    if not isinstance(doc, dict):
+        return False
+    jobs = doc.get("jobs") or {}
+    for job in jobs.values():
+        if isinstance(job, dict) and runs_on_is_hosted(job.get("runs-on")):
+            return True
+    return False
+
+
+def strip_hosted_triggers(doc) -> bool:
+    """Remove push/pull_request from `on:`, ensure workflow_dispatch. Returns changed."""
+    on = doc.get("on")
+    if on is None:
+        return False
+    changed = False
+    if isinstance(on, dict):
+        for key in ("push", "pull_request"):
+            if key in on:
+                del on[key]
+                changed = True
+        if "workflow_dispatch" not in on:
+            on["workflow_dispatch"] = None
+            changed = True
+    elif isinstance(on, list):
+        for key in ("push", "pull_request"):
+            while key in on:
+                on.remove(key)
+                changed = True
+        if "workflow_dispatch" not in on:
+            on.append("workflow_dispatch")
+            changed = True
+    elif isinstance(on, str):
+        if on in ("push", "pull_request"):
+            doc["on"] = "workflow_dispatch"
+            changed = True
+    return changed
+
+
+def transform_file(path: Path) -> bool:
+    """Strip hosted triggers in-place if the workflow has a hosted job. Idempotent."""
+    path = Path(path)
+    text = path.read_text()
+    if MARKER in text:
+        return False
+    yaml = _yaml()
+    doc = yaml.load(text)
+    if not workflow_has_hosted_job(doc):
+        return False
+    # `on:` is workflow-level. If a workflow mixes hosted and self-hosted jobs,
+    # stripping push/pull_request also removes the self-hosted job's auto-trigger.
+    # Acceptable here: the separate self-hosted-ci.yml provides the runner PR path
+    # when a runner exists. Re-add triggers by hand if a single workflow needs both.
+    strip_hosted_triggers(doc)
+    doc.yaml_set_start_comment(f"{MARKER}\n")
+    # Pinning version=(1,2) at load keeps `on` a string key (not YAML 1.1 bool True).
+    # Reset it before dumping so ruamel does not prepend a `%YAML 1.2` / `---` directive
+    # to the workflow file (the key is already a plain string in the loaded document).
+    yaml.version = None
+    buf = StringIO()
+    yaml.dump(doc, buf)
+    path.write_text(buf.getvalue())
+    return True
+
+
+def render_self_hosted_workflow(test_command: str, with_pull_request: bool) -> str:
+    """Render the dormant self-hosted fallback workflow as YAML text."""
+    triggers = "  workflow_dispatch:\n"
+    if with_pull_request:
+        triggers += "  pull_request:\n"
+    ref = "${{ github.ref }}"
+    return (
+        f"# {MARKER}\n"
+        "name: self-hosted-ci\n"
+        "on:\n"
+        f"{triggers}"
+        "concurrency:\n"
+        f"  group: self-hosted-ci-{ref}\n"
+        "  cancel-in-progress: true\n"
+        "jobs:\n"
+        "  test:\n"
+        "    runs-on: [self-hosted, Linux, X64]\n"
+        "    timeout-minutes: 30\n"
+        "    steps:\n"
+        "      - uses: actions/checkout@v4\n"
+        "      - name: Run tests\n"
+        f"        run: {test_command}\n"
+    )
+
+
+def write_self_hosted_workflow(
+    workflows_dir: Path, test_command: str, with_pull_request: bool
+) -> bool:
+    """Write self-hosted-ci.yml if absent. Returns True if created."""
+    workflows_dir = Path(workflows_dir)
+    target = workflows_dir / SELF_HOSTED_FILENAME
+    if target.exists():
+        return False
+    workflows_dir.mkdir(parents=True, exist_ok=True)
+    target.write_text(render_self_hosted_workflow(test_command, with_pull_request))
+    return True

{mcli_framework-8.0.48 → mcli_framework-8.0.50/src/mcli_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcli-framework
-Version: 8.0.48
+Version: 8.0.50
 Summary: Portable workflow framework - transform any script into a versioned, schedulable command. Store in ~/.mcli/workflows/, version with lockfile, run as daemon or cron job.
 Author-email: Luis Fernandez de la Vara <luis@lefv.io>
 Maintainer-email: Luis Fernandez de la Vara <luis@lefv.io>
@@ -37,6 +37,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click<9.0.0,>=8.1.7
+Requires-Dist: ruamel.yaml<0.19,>=0.18
 Requires-Dist: rich<15.0.0,>=14.0.0
 Requires-Dist: requests<3.0.0,>=2.31.0
 Requires-Dist: tomli<3.0.0,>=2.2.1

{mcli_framework-8.0.48 → mcli_framework-8.0.50}/src/mcli_framework.egg-info/SOURCES.txt

@@ -165,6 +165,11 @@ src/mcli/workflow/__init__.py
 src/mcli/workflow/doc_convert.py
 src/mcli/workflow/lsh_integration.py
 src/mcli/workflow/workflow.py
+src/mcli/workflow/ci/__init__.py
+src/mcli/workflow/ci/act_runner.py
+src/mcli/workflow/ci/ci.py
+src/mcli/workflow/ci/runner_status.py
+src/mcli/workflow/ci/workflow_transform.py
 src/mcli/workflow/daemon/__init__.py
 src/mcli/workflow/daemon/async_command_database.py
 src/mcli/workflow/daemon/async_process_manager.py

{mcli_framework-8.0.48 → mcli_framework-8.0.50}/src/mcli_framework.egg-info/requires.txt

@@ -1,4 +1,5 @@
 click<9.0.0,>=8.1.7
+ruamel.yaml<0.19,>=0.18
 rich<15.0.0,>=14.0.0
 requests<3.0.0,>=2.31.0
 tomli<3.0.0,>=2.2.1