nac-cli 0.2.0__tar.gz → 0.2.1__tar.gz

{nac_cli-0.2.0 → nac_cli-0.2.1}/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.2.1
+
+- Read `nac.yaml` defaults from a `config` section in the module's `nac/manifest.yaml`: `render.resource` (relative to the module, e.g. `local_sensitive_file.model` becomes `module.nxos.local_sensitive_file.model`), `render.output` and `env.required`. Settings in the project's `nac.yaml` take precedence key by key, an explicit `null` turns a default off, and an invalid `config` section is ignored with a warning; `nac setup` lists the defaults taken from the module
+- Fail `nac validate` with a clear message if the render step didn't write `render.output` (e.g. because it doesn't match the module's `write_model_file`), and show the output path in the Render Summary
+
 ## 0.2.0
 
 - Only require `uv` when `nac-validate`/`nac-test` aren't installed locally in a satisfying version: `nac setup` no longer fails without `uv` if both tools resolve locally, and `nac validate`/`nac test` fail with a clear message (instead of a missing-executable error) when `uvx` would be needed but `uv` isn't on `PATH`

{nac_cli-0.2.0 → nac_cli-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nac-cli
-Version: 0.2.0
+Version: 0.2.1
 Summary: An umbrella CLI wrapping terraform/tofu, nac-validate, and nac-test for Network-as-Code workflows.
 Project-URL: homepage, https://github.com/netascode/nac
 Project-URL: repository, https://github.com/netascode/nac

{nac_cli-0.2.0 → nac_cli-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "nac-cli"
-version = "0.2.0"
+version = "0.2.1"
 description = "An umbrella CLI wrapping terraform/tofu, nac-validate, and nac-test for Network-as-Code workflows."
 license = { text = "MPL-2.0" }
 readme = "README.md"

nac_cli-0.2.1/release-notes.md

@@ -0,0 +1,3 @@
+
+- Read `nac.yaml` defaults from a `config` section in the module's `nac/manifest.yaml`: `render.resource` (relative to the module, e.g. `local_sensitive_file.model` becomes `module.nxos.local_sensitive_file.model`), `render.output` and `env.required`. Settings in the project's `nac.yaml` take precedence key by key, an explicit `null` turns a default off, and an invalid `config` section is ignored with a warning; `nac setup` lists the defaults taken from the module
+- Fail `nac validate` with a clear message if the render step didn't write `render.output` (e.g. because it doesn't match the module's `write_model_file`), and show the output path in the Render Summary

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/cli/main.py

@@ -12,12 +12,23 @@ from typing import NoReturn, cast
 import typer
 
 from nac import terraform
-from nac.config import DEFAULT_CONFIG_PATH, NacConfig, load_config
+from nac.config import (
+    DEFAULT_CONFIG_PATH,
+    NacConfig,
+    build_config,
+    merge_defaults,
+    read_raw_config,
+)
 from nac.exceptions import ConfigError, EngineNotFoundError, NoEngineAvailableError
+from nac.manifest import load_manifest
 from nac.output import ensure_utf8_streams
 
 from .options import ConfigPath, NoColor, Verbosity, VerbosityLevel, Version
 
+# ctx.meta keys set by get_config
+MANIFEST_META_KEY = "manifest"
+MODULE_DEFAULTS_META_KEY = "module_defaults"
+
 app = typer.Typer(
     add_completion=False,
     help="An umbrella CLI wrapping terraform/tofu, nac-validate, and nac-test.",
@@ -47,13 +58,27 @@ def get_config(ctx: typer.Context) -> NacConfig:
     file present. `ctx.obj` starts out holding the raw --config path and
     is replaced with the resolved NacConfig on first call, so repeated
     calls within the same invocation don't re-read the file.
+
+    nac.yaml settings the project leaves unset are filled from the `config`
+    section of the initialized module's manifest. The manifest and the
+    dotted keys taken from it are stashed on `ctx.meta`.
     """
     if isinstance(ctx.obj, NacConfig):
         return ctx.obj
+    path = cast(Path, ctx.obj)
     try:
-        cfg = load_config(cast(Path, ctx.obj))
+        raw = read_raw_config(path)
+        cfg = build_config(raw, path)
+        manifest = load_manifest(cfg.working_dir)
+        applied: list[str] = []
+        if manifest is not None and manifest.config:
+            merged, applied = merge_defaults(raw, manifest.config)
+            if applied:
+                cfg = build_config(merged, path)
     except ConfigError as exc:
         fail(str(exc))
+    ctx.meta[MANIFEST_META_KEY] = manifest
+    ctx.meta[MODULE_DEFAULTS_META_KEY] = applied
     ctx.obj = cfg
     return cfg
 

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/cli/setup.py

@@ -19,7 +19,7 @@ from nac.manifest import MANIFEST_FILE
 from nac.output import apply_no_color_env, echo_summary, format_command
 from nac.tools import ToolSource
 
-from .main import app, fail, get_config, get_no_color
+from .main import MODULE_DEFAULTS_META_KEY, app, fail, get_config, get_no_color
 from .options import Prewarm, Yes
 from .versions import emit_warnings, get_manifest, tool_warnings
 
@@ -114,7 +114,14 @@ def setup(ctx: typer.Context, yes: Yes = False, prewarm: Prewarm = False) -> Non
 
     manifest = get_manifest(ctx, cfg)
     if manifest is not None:
-        lines.append(f"tested versions: {manifest.module} ({MANIFEST_FILE})")
+        if manifest.tools:
+            lines.append(f"tested versions: {manifest.module} ({MANIFEST_FILE})")
+        module_defaults = ctx.meta.get(MODULE_DEFAULTS_META_KEY) or []
+        if module_defaults:
+            lines.append(
+                f"module defaults: {', '.join(module_defaults)} "
+                f"(from {manifest.module})"
+            )
 
     missing_env = [name for name in cfg.env.required if name not in os.environ]
     if missing_env:

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/cli/validate.py

@@ -78,12 +78,19 @@ def validate(ctx: typer.Context, artifacts: Artifacts = False) -> None:
         log_written = True
         if code != 0:
             raise typer.Exit(code=code)
+        output = cfg.render.output
+        if output is not None and not (cfg.working_dir / output).exists():
+            fail(
+                f"Render step `{cfg.render.target}` did not write `{output}`. "
+                "Check that `render.output` matches the file written by the "
+                "render target (for Network-as-Code modules: `write_model_file`)."
+            )
         if quiet:
             echo_summary(
                 "Render Summary",
                 [
                     f"Render: {color(GREEN, 'OK', no_color=no_color)} "
-                    f"({cfg.render.target})"
+                    f"({cfg.render.target} -> {output})"
                 ],
                 no_color=no_color,
             )

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/cli/versions.py

@@ -19,14 +19,17 @@ from nac.config import NacConfig
 from nac.manifest import Manifest, load_manifest
 from nac.output import YELLOW, color
 
-_MANIFEST_KEY = "manifest"
+from .main import MANIFEST_META_KEY
 
 
 def get_manifest(ctx: typer.Context, cfg: NacConfig) -> Manifest | None:
-    """Load (once per invocation) the manifest of the initialized module."""
-    if _MANIFEST_KEY not in ctx.meta:
-        ctx.meta[_MANIFEST_KEY] = load_manifest(cfg.working_dir)
-    return cast("Manifest | None", ctx.meta[_MANIFEST_KEY])
+    """Load (once per invocation) the manifest of the initialized module.
+
+    Normally already loaded by `get_config`.
+    """
+    if MANIFEST_META_KEY not in ctx.meta:
+        ctx.meta[MANIFEST_META_KEY] = load_manifest(cfg.working_dir)
+    return cast("Manifest | None", ctx.meta[MANIFEST_META_KEY])
 
 
 def tool_warnings(

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/config.py

@@ -5,8 +5,9 @@
 # names as nac.yaml's own keys; pydantic only warns because they shadow
 # deprecated pydantic-v1 classmethods that this codebase never calls.
 import warnings
+from collections.abc import Mapping
 from pathlib import Path
-from typing import Literal
+from typing import Any, Literal
 
 import pydantic
 import ruamel.yaml
@@ -95,15 +96,28 @@ class NacConfig(BaseModel):
     env: EnvConfig = EnvConfig()
 
 
-def load_config(path: Path | str = DEFAULT_CONFIG_PATH) -> NacConfig:
+def load_config(
+    path: Path | str = DEFAULT_CONFIG_PATH,
+    *,
+    defaults: Mapping[str, Any] | None = None,
+) -> NacConfig:
     """Load, validate, and resolve conventions for a nac.yaml file.
 
     A missing file is treated as an empty config -- every field defaults,
-    so `nac` works with zero config present. Raises ConfigError (never a
-    raw pydantic/ruamel traceback) on malformed YAML or a schema
-    validation failure.
+    so `nac` works with zero config present. `defaults` (a module's
+    manifest `config`) fills in whatever the file doesn't set; see
+    `merge_defaults`. Raises ConfigError (never a raw pydantic/ruamel
+    traceback) on malformed YAML or a schema validation failure.
     """
     path = Path(path)
+    raw = read_raw_config(path)
+    if defaults is not None:
+        raw, _ = merge_defaults(raw, defaults)
+    return build_config(raw, path)
+
+
+def read_raw_config(path: Path) -> dict[str, Any]:
+    """The nac.yaml mapping as written, without validation or defaults."""
     raw: object = {}
     if path.is_file():
         yaml = ruamel.yaml.YAML(typ="safe")
@@ -119,7 +133,11 @@ def load_config(path: Path | str = DEFAULT_CONFIG_PATH) -> NacConfig:
         raise ConfigError(
             f"Config file {path} must contain a YAML mapping at the top level"
         )
+    return raw
 
+
+def build_config(raw: Mapping[str, Any], path: Path) -> NacConfig:
+    """Validate a raw nac.yaml mapping and apply filesystem conventions."""
     try:
         cfg = NacConfig.model_validate(raw)
     except pydantic.ValidationError as exc:
@@ -128,6 +146,40 @@ def load_config(path: Path | str = DEFAULT_CONFIG_PATH) -> NacConfig:
     return _apply_filesystem_defaults(cfg, path)
 
 
+def merge_defaults(
+    raw: Mapping[str, Any], defaults: Mapping[str, Any]
+) -> tuple[dict[str, Any], list[str]]:
+    """Fill `raw` (nac.yaml as written) with `defaults` (from a manifest).
+
+    Mappings are merged key by key; any other value set in `raw` -- lists
+    and an explicit `null` included -- wins as a whole. So
+    `render: {output: x.yaml}` keeps the module's render target, while
+    `render: null` or `render: {target: null}` turns it off.
+
+    Returns the merged mapping and the dotted keys taken from `defaults`.
+    """
+    merged = dict(raw)
+    applied: list[str] = []
+    for key, value in defaults.items():
+        if key not in raw:
+            merged[key] = value
+            applied.extend(_leaf_keys(key, value))
+        elif isinstance(raw[key], Mapping) and isinstance(value, Mapping):
+            merged[key], nested = merge_defaults(raw[key], value)
+            applied.extend(f"{key}.{leaf}" for leaf in nested)
+    return merged, applied
+
+
+def _leaf_keys(prefix: str, value: Any) -> list[str]:
+    if isinstance(value, Mapping) and value:
+        return [
+            leaf
+            for key, nested in value.items()
+            for leaf in _leaf_keys(f"{prefix}.{key}", nested)
+        ]
+    return [prefix]
+
+
 def _format_validation_error(path: Path, exc: pydantic.ValidationError) -> str:
     lines = [f"Invalid config file: {path}"]
     for err in exc.errors():

{nac_cli-0.2.0 → nac_cli-0.2.1}/src/nac/manifest.py

@@ -1,29 +1,36 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Daniel Schmidt
 
-"""Tested-versions manifest shipped with a Network-as-Code Terraform module.
+"""Manifest shipped with a Network-as-Code Terraform module.
 
 A module may ship a `nac/manifest.yaml` (next to the rest of its nac-specific
-content: schema, rules, test templates) listing the nac-validate/nac-test
-versions it was tested with. terraform/tofu and provider versions are not
-part of it: the module's `versions.tf` already constrains those, and
-Terraform enforces them itself. After `terraform init`, `nac` finds it via
-`.terraform/modules/modules.json` and uses it purely as a hint: versions
-outside the tested, semver-compatible range produce a warning, never an
-error. A missing or unreadable manifest is silently ignored.
+content: schema, rules, test templates) with:
+
+- `tools`: the nac-validate/nac-test versions it was tested with.
+  terraform/tofu and provider versions are not part of it: the module's
+  `versions.tf` already constrains those, and Terraform enforces them
+  itself. Versions outside the tested, semver-compatible range produce a
+  warning, never an error.
+- `config`: module-specific `nac.yaml` defaults (render target, required
+  environment variables), so that projects using the module don't have to
+  repeat them. The project's own `nac.yaml` always takes precedence.
+
+After `terraform init`, `nac` finds it via `.terraform/modules/modules.json`.
+A missing or unreadable manifest is silently ignored; an invalid `config`
+section is ignored with a warning, keeping the rest of the manifest.
 """
 
 import json
 import logging
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Literal
+from typing import Any, Literal
 
 import pydantic
 import ruamel.yaml
 from packaging.specifiers import SpecifierSet
 from packaging.version import InvalidVersion, Version
-from pydantic import BaseModel, ConfigDict
+from pydantic import BaseModel, ConfigDict, field_validator, model_validator
 
 logger = logging.getLogger(__name__)
 
@@ -38,6 +45,54 @@ class _ManifestFile(BaseModel):
 
     schema_version: Literal[1] = pydantic.Field(alias="schema")
     tools: dict[str, str] = {}
+    # Validated separately (_ManifestConfig) so that a broken `config`
+    # section doesn't also discard the tested versions.
+    config: object = None
+
+
+class _RenderDefaults(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    # Resource address relative to the module, e.g.
+    # `local_sensitive_file.model`; nac prefixes the module's own address.
+    resource: str | None = None
+    output: str | None = None
+
+    @field_validator("resource")
+    @classmethod
+    def _relative_address(cls, value: str | None) -> str | None:
+        if value is not None and (not value.strip() or value.startswith("module.")):
+            raise ValueError(
+                "must be a resource address relative to the module, "
+                "e.g. `local_sensitive_file.model`"
+            )
+        return value
+
+    @model_validator(mode="after")
+    def _resource_requires_output(self) -> "_RenderDefaults":
+        if self.resource is not None and self.output is None:
+            raise ValueError("render.output must be set when render.resource is set")
+        return self
+
+
+class _EnvDefaults(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    required: list[str] | None = None
+
+
+class _ManifestConfig(BaseModel):
+    """`nac.yaml` defaults a module may provide.
+
+    Deliberately limited to module-specific settings; anything about the
+    project's layout or toolchain (working_dir, data paths, terraform
+    engine, ...) stays with the project's own `nac.yaml`.
+    """
+
+    model_config = ConfigDict(extra="ignore")
+
+    render: _RenderDefaults | None = None
+    env: _EnvDefaults | None = None
 
 
 @dataclass(frozen=True)
@@ -50,6 +105,10 @@ class Manifest:
 
     module: str
     tools: dict[str, str] = field(default_factory=dict)
+    # `nac.yaml`-shaped defaults (see config.merge_defaults), already
+    # resolved against the module's address, e.g.
+    # {"render": {"target": "module.nxos.local_sensitive_file.model", ...}}
+    config: dict[str, Any] = field(default_factory=dict)
 
     def check_tool(self, name: str, actual: str | None) -> str | None:
         """Warning message if `actual` is outside the tested range, else None."""
@@ -129,7 +188,9 @@ def load_manifest(working_dir: Path) -> Manifest | None:
     for module in candidates:
         path = working_dir / str(module["Dir"]) / MANIFEST_FILE
         if path.is_file():
-            manifest = _parse_manifest(path, _module_label(module))
+            manifest = _parse_manifest(
+                path, _module_label(module), _module_address(str(module["Key"]))
+            )
             if manifest is not None:
                 return manifest
     return None
@@ -144,7 +205,15 @@ def _module_label(module: dict[str, object]) -> str:
     return f"module.{module['Key']}"
 
 
-def _parse_manifest(path: Path, label: str) -> Manifest | None:
+def _module_address(key: str) -> str:
+    """Terraform address of a module from its modules.json key.
+
+    `nxos` -> `module.nxos`, `wrapper.nxos` -> `module.wrapper.module.nxos`.
+    """
+    return ".".join(f"module.{part}" for part in key.split("."))
+
+
+def _parse_manifest(path: Path, label: str, address: str) -> Manifest | None:
     yaml = ruamel.yaml.YAML(typ="safe")
     try:
         with path.open("r", encoding="utf-8") as fh:
@@ -152,4 +221,36 @@ def _parse_manifest(path: Path, label: str) -> Manifest | None:
     except (OSError, ruamel.yaml.YAMLError, pydantic.ValidationError) as exc:
         logger.debug("Ignoring unreadable manifest %s: %s", path, exc)
         return None
-    return Manifest(module=label, tools=dict(data.tools))
+    return Manifest(
+        module=label,
+        tools=dict(data.tools),
+        config=_parse_config(data.config, path, address),
+    )
+
+
+def _parse_config(raw: object, path: Path, address: str) -> dict[str, Any]:
+    """Translate the manifest's `config` into `nac.yaml`-shaped defaults."""
+    if raw is None:
+        return {}
+    try:
+        config = _ManifestConfig.model_validate(raw)
+    except pydantic.ValidationError as exc:
+        details = "; ".join(
+            f"{'.'.join(str(p) for p in err['loc']) or '<root>'}: {err['msg']}"
+            for err in exc.errors()
+        )
+        logger.warning("Ignoring invalid `config` in %s: %s", path, details)
+        return {}
+
+    result: dict[str, Any] = {}
+    if config.render is not None:
+        render: dict[str, Any] = {}
+        if config.render.resource is not None:
+            render["target"] = f"{address}.{config.render.resource}"
+        if config.render.output is not None:
+            render["output"] = config.render.output
+        if render:
+            result["render"] = render
+    if config.env is not None and config.env.required is not None:
+        result["env"] = {"required": list(config.env.required)}
+    return result

{nac_cli-0.2.0 → nac_cli-0.2.1}/tests/unit/test_cli_commands.py

@@ -166,6 +166,7 @@ def test_validate_without_uv_or_local_install_fails_before_render(tmp_path, mock
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     mocker.patch("shutil.which", side_effect=_which({"tofu": "/usr/bin/tofu"}))
     run_streaming_mock = mocker.patch("nac.cli.validate.runner.run_streaming")
 
@@ -185,6 +186,7 @@ def test_validate_with_render_target_runs_render_then_validate(
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=0
     )
@@ -204,7 +206,7 @@ def test_validate_with_render_target_runs_render_then_validate(
     assert run_streaming_mock.call_args_list[0].kwargs.get("quiet") is True
     assert "rendered/" in validate_argv
     assert "Render Summary" in result.output
-    assert "✓ Render: OK (module.example)" in result.output
+    assert "✓ Render: OK (module.example -> rendered/)" in result.output
     assert "─" * 80 in result.output
 
 
@@ -217,6 +219,7 @@ def test_validate_render_step_streams_live_at_info_verbosity_or_above(
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=0
     )
@@ -236,6 +239,7 @@ def test_validate_honors_global_no_color_flag(tmp_path, mocker, _tofu_on_path):
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=0
     )
@@ -253,7 +257,7 @@ def test_validate_honors_global_no_color_flag(tmp_path, mocker, _tofu_on_path):
     ]
     validate_env = run_streaming_mock.call_args_list[1].kwargs["env"]
     assert validate_env["NO_COLOR"] == "1"
-    assert "Render: OK (module.example)" in result.output
+    assert "Render: OK (module.example -> rendered/)" in result.output
 
 
 @pytest.mark.unit
@@ -262,6 +266,7 @@ def test_validate_aborts_when_render_step_fails(tmp_path, mocker, _tofu_on_path)
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=1
     )
@@ -309,6 +314,7 @@ def test_validate_with_artifacts_and_render_appends_second_call(
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=0
     )
@@ -332,6 +338,7 @@ def test_validate_with_artifacts_render_failure_only_logs_render_call(
         tmp_path,
         "render:\n  target: module.example\n  output: rendered/\n",
     )
+    (tmp_path / "rendered").mkdir()
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=1
     )
@@ -1034,3 +1041,78 @@ def test_tool_artifacts_env_override_is_kept(
 
     assert result.exit_code == 0
     assert run_streaming_mock.call_args.kwargs["env"][env_var] == "false"
+
+
+# ---------------------------------------------------------------------------
+# Module defaults from the manifest `config`
+# ---------------------------------------------------------------------------
+
+_CONFIG_MANIFEST = """\
+schema: 1
+config:
+  render:
+    resource: local_sensitive_file.model
+    output: model.yaml
+  env:
+    required: [NXOS_USERNAME]
+"""
+
+
+@pytest.mark.unit
+def test_validate_uses_render_target_from_module_manifest(
+    tmp_path, mocker, _tofu_on_path, write_module
+):
+    write_module(tmp_path, manifest=_CONFIG_MANIFEST, key="fabric")
+    config_path = _write_config(tmp_path, "")
+    (tmp_path / "model.yaml").write_text("nxos: {}\n")
+    run_streaming_mock = mocker.patch(
+        "nac.cli.validate.runner.run_streaming", return_value=0
+    )
+
+    result = cli.invoke(app, ["--config", str(config_path), "validate"])
+
+    assert result.exit_code == 0, result.output
+    render_argv = run_streaming_mock.call_args_list[0].args[0]
+    validate_argv = run_streaming_mock.call_args_list[1].args[0]
+    assert "-target=module.fabric.local_sensitive_file.model" in render_argv
+    assert "model.yaml" in validate_argv
+
+
+@pytest.mark.unit
+def test_validate_project_render_null_overrides_module_manifest(
+    tmp_path, mocker, _tofu_on_path, write_module
+):
+    write_module(tmp_path, manifest=_CONFIG_MANIFEST)
+    config_path = _write_config(tmp_path, "render: null\n")
+    run_streaming_mock = mocker.patch(
+        "nac.cli.validate.runner.run_streaming", return_value=0
+    )
+
+    result = cli.invoke(app, ["--config", str(config_path), "validate"])
+
+    assert result.exit_code == 0, result.output
+    assert run_streaming_mock.call_count == 1
+
+
+@pytest.mark.unit
+def test_validate_fails_when_render_step_does_not_write_output(
+    tmp_path, mocker, _tofu_on_path
+):
+    config_path = _write_config(
+        tmp_path,
+        "render:\n  target: module.nxos.local_sensitive_file.model\n"
+        "  output: model.yaml\n",
+    )
+    run_streaming_mock = mocker.patch(
+        "nac.cli.validate.runner.run_streaming", return_value=0
+    )
+
+    result = cli.invoke(app, ["--config", str(config_path), "validate"])
+
+    assert result.exit_code == 1
+    assert run_streaming_mock.call_count == 1  # nac-validate never runs
+    assert (
+        "Render step `module.nxos.local_sensitive_file.model` did not write "
+        "`model.yaml`" in result.output
+    )
+    assert "write_model_file" in result.output

{nac_cli-0.2.0 → nac_cli-0.2.1}/tests/unit/test_cli_setup.py

@@ -399,3 +399,49 @@ def test_setup_fails_without_uv_when_a_tool_needs_uvx(tmp_path, mocker):
     )
     assert "install nac-test>=0.9,<1.0 yourself" in result.output
     assert "nac-validate" not in result.output
+
+
+_CONFIG_MANIFEST = """\
+schema: 1
+config:
+  env:
+    required: [NXOS_USERNAME]
+"""
+
+
+@pytest.mark.unit
+def test_required_env_from_module_manifest_is_checked(
+    tmp_path, mocker, monkeypatch, write_module
+):
+    monkeypatch.delenv("NXOS_USERNAME", raising=False)
+    write_module(tmp_path, manifest=_CONFIG_MANIFEST)
+    config_path = _write_config(tmp_path, "")
+    mocker.patch(
+        "shutil.which",
+        side_effect=_which({"uv": "/usr/bin/uv", "tofu": "/usr/bin/tofu"}),
+    )
+
+    result = cli.invoke(app, ["--config", str(config_path), "setup"])
+
+    assert result.exit_code != 0
+    assert "Missing required environment variable(s): NXOS_USERNAME" in result.output
+
+
+@pytest.mark.unit
+def test_setup_reports_module_defaults(tmp_path, mocker, monkeypatch, write_module):
+    monkeypatch.setenv("NXOS_USERNAME", "admin")
+    write_module(tmp_path, manifest=_CONFIG_MANIFEST)
+    config_path = _write_config(tmp_path, "")
+    mocker.patch(
+        "shutil.which",
+        side_effect=_which({"uv": "/usr/bin/uv", "tofu": "/usr/bin/tofu"}),
+    )
+
+    result = cli.invoke(app, ["--config", str(config_path), "setup"])
+
+    assert result.exit_code == 0, result.output
+    assert (
+        "module defaults: env.required (from netascode/nac-nxos/nxos 0.3.0)"
+        in result.output
+    )
+    assert "tested versions" not in result.output

{nac_cli-0.2.0 → nac_cli-0.2.1}/tests/unit/test_cli_versions.py

@@ -183,6 +183,7 @@ def test_validate_with_render_artifacts_keep_warnings_first(
         "render:\n  target: module.nxos.model\n  output: model.yaml\n"
         "tools:\n  nac_validate: 1.2.0\n",
     )
+    (tmp_path / "model.yaml").write_text("nxos: {}\n")
     run_streaming_mock = mocker.patch(
         "nac.cli.validate.runner.run_streaming", return_value=0
     )