nac-cli 0.1.0__tar.gz

nac_cli-0.1.0/.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 3
+
+  # Native uv support updates pyproject.toml and uv.lock in the same pull request
+  - package-ecosystem: 'uv'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    allow:
+      - dependency-type: 'all'
+    cooldown:
+      default-days: 3

nac_cli-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,148 @@
+# Actions are pinned to commit SHAs (not version tags) to prevent supply chain attacks.
+# Version comments (e.g., "# v7") allow Dependabot to track and update to newer versions.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+
+      - name: Check tag matches project version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION=$(uv version --short)
+          if [ "$TAG" != "v$VERSION" ]; then
+            echo "Tag $TAG does not match pyproject.toml version $VERSION"
+            exit 1
+          fi
+
+      - name: Extract release notes from CHANGELOG.md
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Take the body of the "## <version>" section, up to the next "## " heading.
+          # Fails here, before anything is published, if the section is missing,
+          # still marked "unreleased" or empty.
+          VERSION="${TAG#v}"
+          rc=0
+          notes=$(awk -v v="$VERSION" '
+            /^## / {
+              if (found) exit
+              h = $2
+              gsub(/[][]/, "", h)
+              if (h == v) {
+                found = 1
+                if (tolower($0) ~ /unreleased/) unreleased = 1
+              }
+              next
+            }
+            found { print }
+            END {
+              if (!found) exit 2
+              if (unreleased) exit 3
+            }
+          ' CHANGELOG.md) || rc=$?
+          if [ "$rc" -eq 2 ]; then
+            echo "::error::No '## $VERSION' section found in CHANGELOG.md"
+            exit 1
+          elif [ "$rc" -eq 3 ]; then
+            echo "::error::CHANGELOG.md section for $VERSION is still marked unreleased"
+            exit 1
+          elif [ "$rc" -ne 0 ]; then
+            echo "::error::Failed to read CHANGELOG.md"
+            exit 1
+          fi
+          if [ -z "$(printf '%s' "$notes" | tr -d '[:space:]')" ]; then
+            echo "::error::CHANGELOG.md section for $VERSION is empty"
+            exit 1
+          fi
+          printf '%s\n' "$notes" > release-notes.md
+
+      - name: Build
+        run: uv build
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+      - name: Upload release notes
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: release-notes
+          path: release-notes.md
+          if-no-files-found: error
+
+  # Publishing is a separate job so that only it can mint the OIDC token PyPI
+  # trusts; the build step above never has access to it.
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write  # Required for PyPI trusted publishing
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+
+      - name: Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always
+
+  github-release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # Required to create the release
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+          path: dist/
+
+      - name: Download release notes
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: release-notes
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Versions with a letter (e.g. 1.0.0rc1) are marked as pre-releases
+          PRERELEASE=""
+          if [[ "${TAG#v}" =~ [a-zA-Z] ]]; then
+            PRERELEASE="--prerelease"
+          fi
+          gh release create "$TAG" dist/* \
+            --verify-tag \
+            --title "$TAG" \
+            --notes-file release-notes.md \
+            $PRERELEASE

nac_cli-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,194 @@
+# Actions are pinned to commit SHAs (not version tags) to prevent supply chain attacks.
+# Version comments (e.g., "# v7") allow Dependabot to track and update to newer versions.
+name: Tests
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_call:
+
+jobs:
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        with:
+          enable-cache: true
+
+      - name: Install bandit
+        run: uv tool install bandit[toml]
+
+      - name: Run bandit security scan
+        run: bandit -r src/nac/ -ll -f json -o bandit-security-report.json
+
+      - name: Upload security report
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        if: always()
+        with:
+          name: bandit-security-report
+          path: bandit-security-report.json
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        with:
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --extra dev
+
+      - name: Check License Headers
+        run: uv run python scripts/license_headers.py
+
+      - name: Pre-commit Checks
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
+
+  test:
+    name: Tests
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        python:
+          - "3.11"
+          - "3.12"
+          - "3.13"
+          - "3.14"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Python Setup
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        with:
+          enable-cache: true
+
+      - name: Install OpenTofu
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4  # v2.0.2
+        with:
+          tofu_version: latest
+          tofu_wrapper: false
+
+      - name: Test
+        shell: bash
+        run: |
+          uv sync --extra dev
+          uv run pytest
+
+  notification:
+    name: Notification
+    # github.workflow is the caller's name when run via workflow_call, so this
+    # skips the release run (reusable workflows don't receive the Webex secrets)
+    if: always() && github.event_name != 'pull_request' && github.workflow == 'Tests' && github.actor != 'dependabot[bot]'
+    needs: [security, lint, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Check Job Success
+        run: |
+          if [ ${{ needs.security.result }} == 'success' ] && [ ${{ needs.lint.result }} == 'success' ] && [ ${{ needs.test.result }} == 'success' ]; then
+            echo "All jobs succeeded"
+            echo "JOB_SUCCESS=success" >> $GITHUB_ENV
+          else
+            echo "Not all jobs succeeded"
+            echo "JOB_SUCCESS=fail" >> $GITHUB_ENV
+          fi
+        id: print_status
+
+      - name: Sanitize notification variables
+        env:
+          # Pass through env to avoid shell injection from server-side expression expansion
+          RAW_COMMIT_MSG: ${{ github.event.head_commit.message }}
+          RAW_PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          # Truncate to stay within Webex message size limits (500 chars for commit
+          # messages, 200 chars for PR titles are generous practical limits)
+          COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | head -c 500)
+          PR_TITLE=$(echo "$RAW_PR_TITLE" | head -c 200)
+
+          {
+            echo "SAFE_COMMIT_MSG<<EOF"
+            echo "$COMMIT_MSG"
+            echo "EOF"
+            echo "SAFE_PR_TITLE<<EOF"
+            echo "$PR_TITLE"
+            echo "EOF"
+          } >> "$GITHUB_ENV"
+
+      # Using direct curl to Webex API instead of a GitHub Action because:
+      # - qsnyder/action-wxt is unmaintained (last commit 2022, no releases)
+      # - Direct API call has no third-party action dependency to maintain
+      # - Gives full control over error handling and message format
+      - name: Webex Notification
+        if: always()
+        env:
+          # Pass sanitized env vars and static context values through env to avoid
+          # server-side expression expansion inside the shell script
+          JOB_SUCCESS: ${{ env.JOB_SUCCESS }}
+          SAFE_COMMIT_MSG: ${{ env.SAFE_COMMIT_MSG }}
+          SAFE_PR_TITLE: ${{ env.SAFE_PR_TITLE }}
+          WEBEX_TOKEN: ${{ secrets.WEBEX_TOKEN }}
+          WEBEX_ROOM_ID: ${{ secrets.WEBEX_ROOM_ID }}
+          COMMIT_URL: ${{ github.event.head_commit.url }}
+          AUTHOR: ${{ github.event.sender.login }}
+          REF: ${{ github.ref }}
+          HEAD_REF: ${{ github.head_ref }}
+          EVENT: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          RUN_NUM: ${{ github.run_number }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          # jq -n --arg handles all JSON escaping; avoids double-encoding from jq -Rs
+          PAYLOAD=$(jq -n \
+            --arg room_id "$WEBEX_ROOM_ID" \
+            --arg status "$JOB_SUCCESS" \
+            --arg repo "$REPO" \
+            --arg run_num "$RUN_NUM" \
+            --arg run_url "https://github.com/$REPO/actions/runs/$RUN_ID" \
+            --arg commit_msg "$SAFE_COMMIT_MSG" \
+            --arg commit_url "$COMMIT_URL" \
+            --arg pr_title "$SAFE_PR_TITLE" \
+            --arg author "$AUTHOR" \
+            --arg ref "$REF" \
+            --arg head_ref "$HEAD_REF" \
+            --arg event "$EVENT" \
+            '{roomId: $room_id, markdown: ("[**[\($status)] \($repo) #\($run_num)**](\($run_url))\n* Commit: [\($commit_msg)](\($commit_url))\($pr_title)\n* Author: \($author)\n* Branch: \($ref) \($head_ref)\n* Event: \($event)")}')
+          # --fail-with-body: exit non-zero on HTTP 4xx/5xx so the || warning fires
+          curl --silent --fail-with-body --max-time 30 \
+            --request POST \
+            --url https://webexapis.com/v1/messages \
+            --header "Authorization: Bearer $WEBEX_TOKEN" \
+            --header "Content-Type: application/json" \
+            --data "$PAYLOAD" \
+            || echo "::warning::Webex notification failed"

nac_cli-0.1.0/.gitignore

@@ -0,0 +1,85 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.coverage.*
+.cache
+coverage.xml
+*,cover
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# pyenv
+.python-version
+
+# dotenv
+.env
+
+# virtualenv
+.venv/
+venv/
+ENV/
+
+# Editor temp files
+.*.swp
+
+# Visual Studio Code
+.vscode
+
+tmp/
+
+.mypy_cache/
+
+logs/
+
+# Terraform/OpenTofu working dirs created when running fixtures directly
+.terraform/
+*.tfstate
+*.tfstate.backup
+

nac_cli-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,34 @@
+repos:
+  - repo: local
+    hooks:
+      - id: license-headers
+        name: Check license headers
+        entry: uv run python scripts/license_headers.py --fix
+        language: system
+        types: [python]
+
+      - id: ruff-check
+        name: ruff check
+        entry: uv run ruff check --fix --exit-non-zero-on-fix
+        language: system
+        types: [python]
+
+      - id: ruff-format
+        name: ruff format
+        entry: uv run ruff format
+        language: system
+        types: [python]
+
+      - id: ty
+        name: ty
+        entry: uv run ty check
+        language: system
+        types: [python]
+        pass_filenames: false
+
+      - id: bandit
+        name: bandit
+        entry: uv run bandit -r src/nac/ -ll
+        language: system
+        types: [python]
+        pass_filenames: false

nac_cli-0.1.0/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.1.0
+
+- Initial release