nyl 0.5.0__tar.gz → 0.6.0__tar.gz

nyl-0.6.0/.github/workflows/docs.yaml

@@ -0,0 +1,38 @@
+name: Documentation
+
+on:
+  push:
+    branches: [ develop ]
+    tags: [ '*' ]
+  pull_request:
+    branches: [ develop ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Nix flake Nixpkgs inputs
+        uses: DeterminateSystems/flake-checker-action@main
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: mycache
+          # If you chose signing key for write access
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          # If you chose API tokens for write access OR if you have a private cache
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build docs
+        run: nix run .#docs build
+
+      - name: Publish documentation
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          personal_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs/site

nyl-0.6.0/.github/workflows/python.yaml

@@ -0,0 +1,59 @@
+name: Python
+
+on:
+  push:
+    branches: [ develop ]
+    tags: [ '*' ]
+  pull_request:
+    branches: [ develop ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Nix flake Nixpkgs inputs
+        uses: DeterminateSystems/flake-checker-action@main
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: mycache
+
+      - run: nix flake check
+      - run: nix run .#test
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: test
+    environment: release
+    permissions:
+      id-token: write
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get tags
+        run: git fetch --tags origin
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Bump version
+        run: sed 's/version = "0.0.0"/version = "${{ github.ref_name }}"/' -i pyproject.toml && git diff
+
+      - name: Install uv
+        run: python -m pip install uv
+
+      - name: Build dist
+        run: uv build
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

{nyl-0.5.0 → nyl-0.6.0}/.gitignore

@@ -1,5 +1,6 @@
 .nyl/
 docs/site/
+/result
 
 # Python
 __pycache__/

{nyl-0.5.0 → nyl-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: nyl
-Version: 0.5.0
+Version: 0.6.0
 Summary: Advanced templating engine for Kubernetes and GitOps.
 Author-email: Niklas Rosenstein <rosensteinniklas@gmail.com>
 License: MIT
@@ -37,12 +37,22 @@ For some features, additional programs must be available:
 * [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
 * [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
 
+You can install Nyl with Nix to ensure all dependencies are met.
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).
 
     $ uv sync
 
+To lint, run
+
+    $ nix flake check
+
+And to format code, run
+
+    $ nix fmt
+
 ## Tracking upstream information
 
 * Discussion around ArgoCD supporting Helm lookups (maybe with Project-level service account?), see

{nyl-0.5.0 → nyl-0.6.0}/README.md

@@ -15,12 +15,22 @@ For some features, additional programs must be available:
 * [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
 * [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
 
+You can install Nyl with Nix to ensure all dependencies are met.
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).
 
     $ uv sync
 
+To lint, run
+
+    $ nix flake check
+
+And to format code, run
+
+    $ nix fmt
+
 ## Tracking upstream information
 
 * Discussion around ArgoCD supporting Helm lookups (maybe with Project-level service account?), see

{nyl-0.5.0 → nyl-0.6.0}/argocd-cmp/Dockerfile

@@ -2,8 +2,8 @@
 #: Build Nyl itself.
 #: -----------------
 
-FROM python:3.12-alpine AS build
-COPY --from=ghcr.io/astral-sh/uv:0.4.7 /uv /bin/uv
+FROM python:3.13-alpine AS build
+COPY --from=ghcr.io/astral-sh/uv:0.5.5 /uv /bin/uv
 
 WORKDIR /opt/nyl
 
@@ -39,7 +39,8 @@ RUN \
 
 FROM fetch-bin-base AS argocd-bin
 # Find ArgoCD releases at https://github.com/argoproj/argo-cd/releases
-ARG ARGOCD_VERSION=v2.12.0
+# renovate: datasource=github-releases depName=argocd packageName=argoproj/argo-cd
+ARG ARGOCD_VERSION=v2.13.1
 RUN curl -sSfLo /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-$(cat /BINARY_ARCH) \
     && chmod +x /usr/local/bin/argocd \
     && upx /usr/local/bin/argocd \
@@ -47,7 +48,8 @@ RUN curl -sSfLo /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releas
 
 FROM fetch-bin-base AS helm-bin
 # Find Helm releases at https://github.com/helm/helm/releases
-ARG HELM_VERSION=v3.15.3
+# renovate: datasource=github-releases depName=helm packageName=helm/helm
+ARG HELM_VERSION=v3.16.3
 RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \
     && chmod 700 get_helm.sh \
     && ./get_helm.sh --version $HELM_VERSION \
@@ -56,7 +58,8 @@ RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/s
 
 FROM fetch-bin-base AS sops-bin
 # Find SOPS releases at https://github.com/getsops/sops/releases
-ARG SOPS_VERSION=v3.9.0
+# renovate: datasource=github-releases depName=sops packageName=getsops/sops
+ARG SOPS_VERSION=v3.9.1
 RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
     && mv sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) /usr/local/bin/sops \
     && chmod +x /usr/local/bin/sops \
@@ -64,7 +67,8 @@ RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/
     && sops --version
 
 FROM fetch-bin-base AS kyverno-bin
-ARG KYVERNO_VERSION=1.13.0
+# renovate: datasource=github-releases depName=kyverno packageName=kyverno/kyverno
+ARG KYVERNO_VERSION=1.13.1
 RUN \
     case "$(uname -m)" in \
         x86_64) KYVERNO_ARCH='x86_64' ;; \
@@ -79,7 +83,7 @@ RUN \
 #: Build the ArgoCD CMP server image.
 #: ----------------------------------
 
-FROM python:3.12-alpine AS nyl-cmp
+FROM python:3.13-alpine AS nyl-cmp
 RUN apk add git
 COPY --from=argocd-bin /usr/local/bin/argocd /usr/local/bin/argocd
 RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-cmp-server && chown 999:999 /usr/local/bin/argocd-cmp-server

{nyl-0.5.0 → nyl-0.6.0}/docs/content/reference/configuration-api/secrets.md

@@ -4,3 +4,8 @@
     options:
         show_root_heading: true
         show_source: false
+
+::: nyl.secrets.kubernetes
+    options:
+        show_root_heading: true
+        show_source: false

nyl-0.6.0/flake.lock

@@ -0,0 +1,348 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "lix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730846669,
+        "narHash": "sha256-HUdKD2GLudNnQm4yvakMSUhcHF2g0Nc+1QxgDwrlU90=",
+        "ref": "refs/heads/main",
+        "rev": "72292671a9e1c7600d1cc4240e717ac3bdd6cef0",
+        "revCount": 16450,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      }
+    },
+    "lix-unit": {
+      "inputs": {
+        "lix": "lix",
+        "mdbook-nixdoc": [
+          "pyproject-nix",
+          "mdbook-nixdoc"
+        ],
+        "nix-github-actions": [
+          "pyproject-nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "pyproject-nix",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730863251,
+        "narHash": "sha256-NoImlilaWPAGWz/Ja0uXcagQ8UK61KEev2jFDM+vgzQ=",
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "rev": "2893fe1a7e870a3da8a04be89ca494c1ff9c3e82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "type": "github"
+      }
+    },
+    "lix-unit_2": {
+      "inputs": {
+        "lix": "lix_2",
+        "mdbook-nixdoc": [
+          "uv2nix",
+          "mdbook-nixdoc"
+        ],
+        "nix-github-actions": [
+          "uv2nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "uv2nix",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730863251,
+        "narHash": "sha256-NoImlilaWPAGWz/Ja0uXcagQ8UK61KEev2jFDM+vgzQ=",
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "rev": "2893fe1a7e870a3da8a04be89ca494c1ff9c3e82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "type": "github"
+      }
+    },
+    "lix_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730846669,
+        "narHash": "sha256-HUdKD2GLudNnQm4yvakMSUhcHF2g0Nc+1QxgDwrlU90=",
+        "ref": "refs/heads/main",
+        "rev": "72292671a9e1c7600d1cc4240e717ac3bdd6cef0",
+        "revCount": 16450,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      }
+    },
+    "mdbook-nixdoc": {
+      "inputs": {
+        "nix-github-actions": [
+          "pyproject-nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708395692,
+        "narHash": "sha256-smf0VmxGbjJDZqKvxxG3ZVqubgbVwAWG26wPo+BT/A0=",
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "rev": "d6a71b114b9221c0b4f20d31b81766d072cc26be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "type": "github"
+      }
+    },
+    "mdbook-nixdoc_2": {
+      "inputs": {
+        "nix-github-actions": [
+          "uv2nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708395692,
+        "narHash": "sha256-smf0VmxGbjJDZqKvxxG3ZVqubgbVwAWG26wPo+BT/A0=",
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "rev": "d6a71b114b9221c0b4f20d31b81766d072cc26be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nix-github-actions_2": {
+      "inputs": {
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1730785428,
+        "narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "lix-unit": "lix-unit",
+        "mdbook-nixdoc": "mdbook-nixdoc",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1730863432,
+        "narHash": "sha256-xn3xCNJRrveAnAodqjZj0ZQ5kbrcnpcM3zUGlygoKbc=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "d78783b228419b475002e396c2433ecc82bbc7b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "lix-unit": "lix-unit_2",
+        "mdbook-nixdoc": "mdbook-nixdoc_2",
+        "nix-github-actions": "nix-github-actions_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1730876081,
+        "narHash": "sha256-lynNnnKxF4zNlmmMtCIrmbWM7V1GPEMWrFc8MXbmVJI=",
+        "owner": "adisbladis",
+        "repo": "uv2nix",
+        "rev": "7184376b4e8fbf80dcce44f9b48cd909176dd0f4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nyl-0.6.0/flake.nix

@@ -0,0 +1,113 @@
+{
+  description = "Nyl is a high-level Kubernetes project management tool.";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+
+    pyproject-nix = {
+      url = "github:nix-community/pyproject.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    uv2nix = {
+      url = "github:adisbladis/uv2nix";
+      inputs.pyproject-nix.follows = "pyproject-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  # TODO: Build argocd-cmp Docker image with Nix.
+
+  outputs = { self, nixpkgs, flake-utils, pyproject-nix, uv2nix }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+        uv = pkgs.callPackage ./nix/uv.nix { inherit uv2nix pyproject-nix; };
+
+        uvProject = uv.loadProject {
+          workspaceRoot = ./.;
+          python = pkgs.python312;
+          # TODO: Pass runtimeInputs here?
+        };
+
+        mypyConfig = pkgs.writeText "mypy.ini" ''
+          [mypy]
+          explicit_package_bases = true
+          namespace_packages = true
+          show_column_numbers = true
+          strict = true
+          mypy_path = src
+        '';
+
+        ruffConfig = pkgs.writeText "ruff.toml" ''
+          line-length = 120
+        '';
+
+        dependencies =
+          [ pkgs.kubernetes-helm pkgs.kyverno pkgs.sops pkgs.kubectl ];
+      in rec {
+        packages.default =
+          uvProject.script "nyl" { runtimeInputs = dependencies; };
+
+        packages.docs = let
+          docs = uv.loadProject {
+            workspaceRoot = ./docs;
+            python = pkgs.python312;
+          };
+          mkdocs = docs.command "mkdocs";
+        in pkgs.writeShellScriptBin "docs" ''
+          set -eu
+          cd docs
+          ${mkdocs} $@
+        '';
+
+        # TODO: Use formatter.fmt, but it complains about missing type attribute
+        # TODO: Have it also fmt the nix code
+        formatter = pkgs.writeShellScriptBin "fmt" ''
+          set -x
+          ${uvProject.devCommand "ruff"} --config ${ruffConfig} format .
+          ${pkgs.nixfmt-classic}/bin/nixfmt .
+        '';
+
+        # TODO: Do not require ruff/mypy to be dependencies of the project?
+
+        packages.lint = pkgs.writeShellScriptBin "lint" ''
+          set -x
+          checkDir="''${1:-src}"
+          ${uvProject.devCommand "ruff"} --config ${ruffConfig} check "${
+            ./.
+          }/$checkDir"
+          ${
+            uvProject.devCommand "ruff"
+          } --config ${ruffConfig} format --check "${./.}/$checkDir"
+          # TODO: If we don't copy the workdir to the nix store we get more Mypy errors :(
+          ${uvProject.devCommand "dmypy"} run -- --config-file ${mypyConfig} "${
+            ./.
+          }/$checkDir"
+          ${pkgs.nixfmt-classic}/bin/nixfmt --check .
+        '';
+
+        packages.test = let
+          dependenciesPath = nixpkgs.lib.concatStringsSep ":"
+            (map (dep: "${dep}/bin") dependencies);
+        in pkgs.writeShellScriptBin "test"
+        "PATH=\${PATH}:${dependenciesPath} ${uvProject.devCommand "pytest"} ${
+          ./.
+        }";
+
+        checks.lint = pkgs.runCommand "lint" { } ''
+          # TODO: Is it an issue that this runs the Mypy daemon?
+          ${packages.lint}/bin/lint
+          echo Done > $out
+        '';
+
+        checks.test = pkgs.runCommand "test" { } ''
+          ${packages.test}/bin/test
+          echo Done > $out
+        '';
+
+        devShells.default =
+          pkgs.mkShell { buildInputs = [ uvProject.venv.dev ]; };
+      });
+}