observal-cli 0.2.0__tar.gz → 0.3.3__tar.gz

{observal_cli-0.2.0 → observal_cli-0.3.3}/.env.example

@@ -20,6 +20,12 @@ EVAL_MODEL_API_KEY=
 EVAL_MODEL_NAME=
 EVAL_MODEL_PROVIDER=
 
+# Moonshot / Kimi example (OpenAI-compatible). URL and Thinking-Mode toggle
+# are handled automatically when PROVIDER=moonshot.
+# EVAL_MODEL_PROVIDER=moonshot
+# EVAL_MODEL_API_KEY=sk-...
+# EVAL_MODEL_NAME=kimi-k2.5-preview
+
 # Optional: AWS credentials for Bedrock eval engine
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
@@ -51,6 +57,10 @@ DEMO_REVIEWER_PASSWORD=reviewer-changeme
 DEMO_USER_EMAIL=user@demo.example
 DEMO_USER_PASSWORD=user-changeme
 
+# Resource limits (adjust based on your server's available RAM)
+# CLICKHOUSE_MEMORY_LIMIT=2G
+# OTEL_MEMORY_LIMIT=512M
+
 # Host port mappings (change these if defaults conflict with other services)
 # API_HOST_PORT=8000
 # POSTGRES_HOST_PORT=5432
@@ -60,3 +70,13 @@ DEMO_USER_PASSWORD=user-changeme
 # OTEL_GRPC_HOST_PORT=4317
 # OTEL_HTTP_HOST_PORT=4318
 # GRAFANA_HOST_PORT=3001
+
+# Horizontal scaling (multi-instance deployments)
+# API_REPLICAS=1
+# WORKER_REPLICAS=1
+# CLICKHOUSE_MEMORY_LIMIT=2G
+# DB_POOL_SIZE=10
+# DB_MAX_OVERFLOW=20
+# REDIS_MAX_CONNECTIONS=50
+# CLICKHOUSE_MAX_CONNECTIONS=20
+# GIT_MIRROR_BASE_PATH=

observal_cli-0.3.3/.gitbook.yaml

@@ -0,0 +1,11 @@
+root: ./docs/
+
+structure:
+  readme: README.md
+  summary: SUMMARY.md
+
+redirects:
+  cli: cli/README.md
+  eval: concepts/evaluation.md
+  kiro-setup: integrations/kiro.md
+  kiro-compatibility-matrix: integrations/kiro.md

{observal_cli-0.2.0 → observal_cli-0.3.3}/.github/workflows/ci.yml

@@ -142,6 +142,7 @@ jobs:
             --python ${{ matrix.python-version }} \
             --with asyncpg \
             --with hypothesis \
+            --with pyarrow \
             pytest ../tests/ -q
 
 # ── Job 3: Next.js lint + typecheck ───────────────────────────────────────────

observal_cli-0.3.3/.github/workflows/deploy.yml

@@ -0,0 +1,62 @@
+name: Deploy to EC2
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-ec2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Deploy to EC2
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script: |
+            set -e
+            cd ~/Observal
+            git fetch origin main
+            git reset --hard origin/main
+
+            cd docker
+            docker compose -f docker-compose.yml -f docker-compose.production.yml up -d --build --remove-orphans
+
+            # Phase 1: Wait for API container to be alive (bypasses nginx).
+            # Uses direct container exec because curl through nginx fails
+            # when nginx caches a stale upstream IP from the old container.
+            echo "Waiting for API container to start..."
+            for i in $(seq 1 60); do
+              if docker compose exec -T observal-api python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/livez')" 2>/dev/null; then
+                echo "API process is alive"
+                break
+              fi
+              echo "Waiting for API process... ($i/60)"
+              sleep 5
+            done
+
+            # Nginx caches upstream container IPs — after rebuild the API
+            # gets a new IP but nginx still routes to the old one.
+            docker compose -f docker-compose.yml -f docker-compose.production.yml restart observal-lb
+            sleep 3
+
+            # Phase 2: Verify health through nginx (the path clients use)
+            for i in $(seq 1 30); do
+              if curl -sf https://localhost/health -k > /dev/null 2>&1; then
+                echo "API is healthy (full stack verified)"
+                exit 0
+              fi
+              echo "Waiting for health check... ($i/30)"
+              sleep 5
+            done
+
+            echo "API failed health check"
+            docker compose logs observal-api observal-init observal-lb observal-db observal-clickhouse --tail 20
+            exit 1

observal_cli-0.3.3/.github/workflows/release.yml

@@ -0,0 +1,383 @@
+# Automated release pipeline for Observal.
+#
+# Triggered automatically when a release PR merges to main (detected by
+# bump(release) commit), or manually via workflow_dispatch with a version input.
+# Creates the git tag, then builds: CLI binaries (6 platforms), Docker images
+# (GHCR), server tarball, PyPI package. All releases require approval.
+
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (e.g. 0.3.2). Leave empty to auto-detect from commit."
+        required: false
+        type: string
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+  attestations: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_PREFIX: ghcr.io/blazeup-ai/observal
+
+jobs:
+  # ── Preflight: detect release commit and create tag ────────
+  preflight:
+    name: Preflight checks
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      bump_type: ${{ steps.version.outputs.bump_type }}
+      is_release: ${{ steps.version.outputs.is_release }}
+    steps:
+      - name: Generate release app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Detect release version
+        id: version
+        run: |
+          # Manual dispatch with explicit version takes priority
+          if [ -n "${{ inputs.version }}" ]; then
+            VERSION="${{ inputs.version }}"
+            echo "is_release=true" >> "$GITHUB_OUTPUT"
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          else
+            COMMIT_MSG=$(git log -1 --pretty=%s)
+            if [[ "$COMMIT_MSG" =~ ^bump\(release\):\ v([0-9]+\.[0-9]+\.[0-9]+) ]]; then
+              VERSION="${BASH_REMATCH[1]}"
+              echo "is_release=true" >> "$GITHUB_OUTPUT"
+              echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+            else
+              echo "is_release=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          fi
+
+          # Validate version matches pyproject.toml
+          PKG_VERSION=$(python3 -c "import re, pathlib; m = re.search(r'^version\s*=\s*\"([^\"]+)\"', pathlib.Path('pyproject.toml').read_text(), re.M); print(m.group(1))")
+          if [ "$VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Release version v$VERSION does not match pyproject.toml ($PKG_VERSION)"
+            exit 1
+          fi
+
+          # Detect bump type by comparing to previous tag
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "v0.0.0")
+          PREV="${PREV_TAG#v}"
+          IFS='.' read -r PM PMI PP <<< "$PREV"
+          IFS='.' read -r CM CMI CP <<< "$VERSION"
+          if [ "$CM" != "$PM" ]; then
+            echo "bump_type=major" >> "$GITHUB_OUTPUT"
+          elif [ "$CMI" != "$PMI" ]; then
+            echo "bump_type=feature" >> "$GITHUB_OUTPUT"
+          else
+            echo "bump_type=patch" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create release tag
+        if: steps.version.outputs.is_release == 'true'
+        run: |
+          VERSION="v${{ steps.version.outputs.version }}"
+          git config user.name "observal-release[bot]"
+          git config user.email "observal-release[bot]@users.noreply.github.com"
+          git tag -a "$VERSION" -m "Release $VERSION"
+          git push origin "$VERSION"
+
+  # ── Job 1: Build CLI binaries (5-platform matrix) ──────────
+  cli-binaries:
+    name: CLI (${{ matrix.os }}-${{ matrix.arch }})
+    needs: preflight
+    if: needs.preflight.outputs.is_release == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: linux
+            arch: x64
+            runner: ubuntu-latest
+            artifact: observal-linux-x64
+          - os: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+            artifact: observal-linux-arm64
+          - os: macos
+            arch: arm64
+            runner: macos-15
+            artifact: observal-macos-arm64
+          - os: windows
+            arch: x64
+            runner: windows-latest
+            artifact: observal-windows-x64.exe
+          - os: windows
+            arch: arm64
+            runner: windows-latest
+            artifact: observal-windows-arm64.exe
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          pip install pyinstaller
+          pip install -e .
+
+      - name: Build binary
+        run: |
+          pyinstaller observal_cli/pyinstaller.spec --noconfirm
+        env:
+          TARGET_ARCH: ${{ matrix.arch }}
+
+      - name: Rename artifact (Unix)
+        if: matrix.os != 'windows'
+        run: mv dist/observal dist/${{ matrix.artifact }}
+
+      - name: Rename artifact (Windows)
+        if: matrix.os == 'windows'
+        run: mv dist/observal.exe dist/${{ matrix.artifact }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: dist/${{ matrix.artifact }}
+
+  # ── Job 2: Docker images to GHCR (native per-arch builds) ──
+  docker-build:
+    name: Docker (${{ matrix.image }}-${{ matrix.arch }})
+    needs: preflight
+    if: needs.preflight.outputs.is_release == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [api, web]
+        arch: [amd64, arm64]
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+            platform: linux/amd64
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            platform: linux/arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile.${{ matrix.image }}
+          platforms: ${{ matrix.platform }}
+          provenance: false
+          outputs: type=image,name=${{ env.IMAGE_PREFIX }}-${{ matrix.image }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=${{ matrix.image }}-${{ matrix.arch }}
+          cache-to: type=gha,scope=${{ matrix.image }}-${{ matrix.arch }},mode=max
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: docker-digest-${{ matrix.image }}-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  docker-merge:
+    name: Docker manifest (${{ matrix.image }})
+    needs: [preflight, docker-build]
+    if: needs.preflight.outputs.is_release == 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        image: [api, web]
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: docker-digest-${{ matrix.image }}-*
+          merge-multiple: true
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create manifest list and push
+        run: |
+          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.image }}"
+          VERSION="${{ needs.preflight.outputs.version }}"
+          docker buildx imagetools create \
+            -t "$IMAGE:$VERSION" \
+            -t "$IMAGE:latest" \
+            $(printf "$IMAGE@sha256:%s " $(ls /tmp/digests/))
+
+  # ── Job 3: Server deployment tarball ───────────────────────
+  server-package:
+    name: Server package
+    needs: preflight
+    if: needs.preflight.outputs.is_release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build server tarball
+        run: |
+          VERSION="${{ needs.preflight.outputs.version }}"
+          STAGING="observal-server-v${VERSION}"
+          mkdir -p "$STAGING/docker/server-package"
+          mkdir -p "$STAGING/docker/clickhouse"
+          mkdir -p "$STAGING/grafana"
+
+          # Docker Compose and configs
+          cp docker/docker-compose.yml "$STAGING/docker/"
+          cp docker/Dockerfile.api "$STAGING/docker/"
+          cp docker/Dockerfile.web "$STAGING/docker/"
+          cp docker/entrypoint.sh "$STAGING/docker/"
+          cp docker/nginx.conf "$STAGING/docker/"
+          cp -r docker/clickhouse/ "$STAGING/docker/clickhouse/"
+          cp -r docker/server-package/ "$STAGING/docker/server-package/"
+
+          # Application source
+          cp -r observal-server/ "$STAGING/observal-server/"
+          cp -r ee/ "$STAGING/ee/"
+          cp -r web/ "$STAGING/web/"
+          cp -r grafana/ "$STAGING/grafana/"
+          cp pyproject.toml "$STAGING/"
+          cp otel-collector-config.yaml "$STAGING/"
+          cp prometheus.yml "$STAGING/"
+          cp .env.example "$STAGING/"
+
+          tar -czf "observal-server-v${VERSION}.tar.gz" "$STAGING"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: observal-server-v${{ needs.preflight.outputs.version }}.tar.gz
+          path: observal-server-v${{ needs.preflight.outputs.version }}.tar.gz
+
+  # ── Approval gate (all releases) ────────────────────────────
+  approve:
+    name: Approval gate
+    needs: [preflight, cli-binaries, docker-merge, server-package]
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - run: echo "${{ needs.preflight.outputs.bump_type }} release v${{ needs.preflight.outputs.version }} approved"
+
+  # ── Job 4: PyPI publish (after approval) ───────────────────
+  pypi:
+    name: Publish to PyPI
+    needs: [preflight, approve]
+    if: needs.approve.result == 'success'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  # ── Final: Create GitHub Release with all artifacts ────────
+  release:
+    name: GitHub Release
+    needs: [preflight, cli-binaries, docker-merge, server-package, pypi, approve]
+    if: needs.approve.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          pattern: observal-*
+
+      - name: Flatten artifacts
+        run: |
+          mkdir -p release
+          find artifacts -type f \( -name 'observal-*' -o -name '*.tar.gz' \) -exec cp {} release/ \;
+
+      - name: Generate checksums
+        run: |
+          cd release
+          sha256sum * > checksums.txt
+
+      - name: Generate release notes
+        run: |
+          pip install git-cliff
+          git-cliff --config cliff.toml --latest --strip header > release/RELEASE_NOTES.md
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: "release/observal-*"
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="v${{ needs.preflight.outputs.version }}"
+
+          gh release create "$VERSION" \
+            --draft \
+            --title "Observal $VERSION" \
+            --notes-file release/RELEASE_NOTES.md \
+            --latest \
+            release/*
+
+      - name: Publish release (remove draft)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="v${{ needs.preflight.outputs.version }}"
+          gh release edit "$VERSION" --draft=false

{observal_cli-0.2.0 → observal_cli-0.3.3}/.gitignore

@@ -7,13 +7,27 @@ dist/
 build/
 .eggs/
 
-# IDE
+# IDE / editor
 .vscode/
 .idea/
 *.swp
 *.swo
 *~
 
+# AI agent / coding tool configs
+.claude/
+CLAUDE.md
+.kiro/
+.cursor/
+.cursorignore
+.cursorindexingignore
+.gemini/
+GEMINI.md
+.opencode/
+.github/copilot-instructions.md
+.copilot/
+.worktrees/
+
 # OS
 .DS_Store
 Thumbs.db
@@ -32,10 +46,8 @@ observal-web/dist/
 
 # Docker
 docker/data/
+docker/clickhouse/users.d/default-user.xml
 
-# Local config
-.kiro/
-.claude/
-CLAUDE.md
-graphify-out/
-observal-web/tsconfig.tsbuildinfo
+# Local / ephemeral
+.playwright-mcp/
+e2e-screenshots/

{observal_cli-0.2.0 → observal_cli-0.3.3}/.pre-commit-config.yaml

@@ -24,6 +24,15 @@ repos:
       - id: no-commit-to-branch
         args: [--branch, main]
 
+  # ── Secrets / .env guard ───────────────────────────────
+  - repo: local
+    hooks:
+      - id: check-secrets
+        name: check for secrets and .env files
+        entry: scripts/check_secrets.sh
+        language: script
+        pass_filenames: false
+
   # ── Alembic migrations ─────────────────────────────────
   - repo: local
     hooks:
@@ -34,6 +43,17 @@ repos:
         files: ^observal-server/alembic/versions/.*\.py$
         pass_filenames: false
 
+  # ── DCO sign-off (pre-push) ────────────────────────────
+  - repo: local
+    hooks:
+      - id: check-dco
+        name: check DCO sign-off on all commits
+        entry: scripts/check_dco.sh
+        language: script
+        always_run: true
+        pass_filenames: false
+        stages: [pre-push]
+
   # ── Docker ─────────────────────────────────────────────
   - repo: https://github.com/hadolint/hadolint
     rev: v2.12.0