observal-cli 0.3.4__tar.gz → 0.4.0__tar.gz

observal_cli-0.4.0/.github/hooks/observal.json

@@ -0,0 +1,56 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "PreToolUse": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "PostToolUse": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "PreCompact": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "SubagentStart": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "SubagentStop": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      }
+    ],
+    "Stop": [
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-hook.sh"
+      },
+      {
+        "type": "command",
+        "command": "/home/haz3/code/blazeup/observal-insights-v2/observal_cli/hooks/observal-stop-hook.sh"
+      }
+    ]
+  }
+}

observal_cli-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,282 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Observal CI — runs on every PR targeting main and on pushes to main.
+#
+# Recommended branch-protection rules (Settings → Branches → main):
+#   Required status checks:
+#     • lint
+#     • test (3.11)
+#     • test (3.12)
+#     • test (3.13)
+#     • web-lint
+#     • docker-build
+#     • security-scan
+#   Require a pull request before merging
+#   Require approvals: 1
+#   Do not allow bypassing the above settings
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# ── Job 0: Path filtering ─────────────────────────────────────────────────────
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      python: ${{ steps.filter.outputs.python }}
+      web: ${{ steps.filter.outputs.web }}
+      docker: ${{ steps.filter.outputs.docker }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            python:
+              - 'observal_cli/**/*.py'
+              - 'observal-server/**/*.py'
+              - 'tests/**/*.py'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'Makefile'
+              - '.pre-commit-config.yaml'
+              - '.github/workflows/ci.yml'
+            web:
+              - 'web/**'
+              - '.github/workflows/ci.yml'
+            docker:
+              - 'docker/**'
+              - 'observal_cli/**'
+              - 'observal-server/**'
+              - 'web/**'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'web/package.json'
+              - 'web/pnpm-lock.yaml'
+              - '.env.example'
+              - '.github/workflows/ci.yml'
+
+# ── Job 1: Python lint ────────────────────────────────────────────────────────
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    needs: changes
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v8.1.0
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python 3.13
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install 3.13
+
+      - name: ruff check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.10 ruff check .
+
+      - name: ruff format --check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.10 ruff format --check .
+
+# ── Job 2: Python tests (matrix) ──────────────────────────────────────────────
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: changes
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping test"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v8.1.0
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python ${{ matrix.python-version }}
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install project dependencies
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv sync --python ${{ matrix.python-version }} --group dev
+
+      - name: Run pytest
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv run \
+            --python ${{ matrix.python-version }} \
+            --with asyncpg \
+            --with hypothesis \
+            --with pyarrow \
+            pytest ../tests/ -q
+
+# ── Job 3: Next.js lint + typecheck ───────────────────────────────────────────
+  web-lint:
+    name: web-lint
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Skip if no web changes
+        if: needs.changes.outputs.web != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No web changes detected, skipping web-lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.web == 'true'
+
+      - uses: pnpm/action-setup@v4
+        if: needs.changes.outputs.web == 'true'
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v6
+        if: needs.changes.outputs.web == 'true'
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: ESLint
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run lint
+
+      - name: TypeScript typecheck
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run typecheck
+
+# ── Job 4: Import boundary check ─────────────────────────────────────────────
+  import-boundary:
+    name: import-boundary
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check ee/ import boundary
+        run: |
+          echo "Checking that core does not import from ee/..."
+          VIOLATIONS=$(grep -rn "from ee\b\|import ee\b" observal-server/ observal_cli/ --include="*.py" | grep -v "main.py" || true)
+          if [ -n "$VIOLATIONS" ]; then
+            echo "::error::Import boundary violation — core must not import from ee/"
+            echo "$VIOLATIONS"
+            exit 1
+          fi
+          echo "✓ No import boundary violations found"
+
+# ── Job 5: Docker build ───────────────────────────────────────────────────────
+  docker-build:
+    name: docker-build
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: docker
+
+    steps:
+      - name: Skip if no Docker changes
+        if: needs.changes.outputs.docker != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No Docker changes detected, skipping docker-build"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.docker == 'true'
+
+      - name: Create stub .env
+        if: needs.changes.outputs.docker == 'true'
+        run: touch ../.env
+
+      - name: Build images
+        if: needs.changes.outputs.docker == 'true'
+        run: docker compose build
+
+# ── Job 5: Python SAST with bandit ──────────────────────────────────────────
+  security-scan:
+    name: security-scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+      - name: Install Python 3.12
+        run: uv python install 3.12
+      - name: Run bandit
+        run: uv run --with bandit bandit -r observal-server/ observal_cli/ -c pyproject.toml -f json -o bandit-report.json || true
+      - name: Check bandit results
+        run: uv run --with bandit bandit -r observal-server/ observal_cli/ -c pyproject.toml -ll
+
+# ── Job 6: Dependency audit ─────────────────────────────────────────────────
+  dependency-audit:
+    name: dependency-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Python dependency audit
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+      - name: Run pip-audit
+        # TODO: burn down pre-existing advisories then remove || true
+        run: |
+          uv python install 3.12
+          cd observal-server
+          uv run --with pip-audit pip-audit --strict --desc || true
+
+      - name: JS dependency audit
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Run pnpm audit
+        run: |
+          cd web
+          pnpm install --frozen-lockfile
+          pnpm audit --prod || true

observal_cli-0.4.0/.github/workflows/deploy-dev.yml

@@ -0,0 +1,63 @@
+name: Deploy Dev to EC2
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-dev-ec2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Deploy to EC2 (dev)
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST_DEV }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY_DEV }}
+          script: |
+            set -e
+            cd ~/Observal
+            git fetch origin main
+            git reset --hard origin/main
+
+            # Use SSL override from outside repo so git reset never wipes it
+            SSL_OVERRIDE=~/observal-ssl/docker-compose.ssl.yml
+            if [ -f "$SSL_OVERRIDE" ]; then
+              DEV_OVERRIDE="$SSL_OVERRIDE"
+            else
+              DEV_OVERRIDE="docker/docker-compose.dev.yml"
+            fi
+
+            docker compose -f docker/docker-compose.yml -f "$DEV_OVERRIDE" up -d --build --remove-orphans
+
+            echo "Waiting for API container to start..."
+            for i in $(seq 1 60); do
+              if docker compose -f docker/docker-compose.yml -f "$DEV_OVERRIDE" exec -T observal-api python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/livez')" 2>/dev/null; then
+                echo "API process is alive"
+                break
+              fi
+              echo "Waiting for API process... ($i/60)"
+              sleep 5
+            done
+
+            docker compose -f docker/docker-compose.yml -f "$DEV_OVERRIDE" restart observal-lb
+            sleep 3
+
+            for i in $(seq 1 30); do
+              if curl -sf http://localhost/health > /dev/null 2>&1; then
+                echo "API is healthy"
+                exit 0
+              fi
+              echo "Waiting for health check... ($i/30)"
+              sleep 5
+            done
+
+            echo "API failed health check"
+            docker compose -f docker/docker-compose.yml -f "$DEV_OVERRIDE" logs observal-api observal-init observal-lb observal-db observal-clickhouse --tail 20
+            exit 1

observal_cli-0.4.0/.github/workflows/deploy.yml

@@ -0,0 +1,62 @@
+name: Deploy to EC2
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-ec2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Deploy to EC2
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script: |
+            set -e
+            cd ~/Observal
+            git fetch origin --tags
+            git checkout ${{ github.ref_name }}
+
+            cd docker
+            docker compose -f docker-compose.yml -f docker-compose.production.yml up -d --build --remove-orphans
+
+            # Phase 1: Wait for API container to be alive (bypasses nginx).
+            # Uses direct container exec because curl through nginx fails
+            # when nginx caches a stale upstream IP from the old container.
+            echo "Waiting for API container to start..."
+            for i in $(seq 1 60); do
+              if docker compose exec -T observal-api python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/livez')" 2>/dev/null; then
+                echo "API process is alive"
+                break
+              fi
+              echo "Waiting for API process... ($i/60)"
+              sleep 5
+            done
+
+            # Nginx caches upstream container IPs — after rebuild the API
+            # gets a new IP but nginx still routes to the old one.
+            docker compose -f docker-compose.yml -f docker-compose.production.yml restart observal-lb
+            sleep 3
+
+            # Phase 2: Verify health through nginx (the path clients use)
+            for i in $(seq 1 30); do
+              if curl -sf https://localhost/health -k > /dev/null 2>&1; then
+                echo "API is healthy (full stack verified)"
+                exit 0
+              fi
+              echo "Waiting for health check... ($i/30)"
+              sleep 5
+            done
+
+            echo "API failed health check"
+            docker compose logs observal-api observal-init observal-lb observal-db observal-clickhouse --tail 20
+            exit 1

observal_cli-0.4.0/.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: Publish
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # required for PyPI Trusted Publishing
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+
+      - name: Verify tag matches pyproject version
+        run: |
+          tag="${GITHUB_REF#refs/tags/v}"
+          pkg=$(uv run --with tomli python -c "import tomli, pathlib; print(tomli.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::Tag v$tag does not match pyproject version $pkg"
+            exit 1
+          fi
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1