observal-cli 1.4.4__tar.gz → 1.6.0__tar.gz

observal_cli-1.6.0/.dockerignore

@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-FileCopyrightText: 2026 SrihariLegend <sriharilegend23@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# Version control
+**/.git
+
+# Python artifacts
+**/__pycache__
+**/.venv
+*.pyc
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Node.js artifacts
+**/node_modules
+**/.next
+
+# Documentation assets (screenshots not needed in images)
+LICENSE
+screenshots/
+
+# Testing (not shipped in images)
+tests/
+
+# CLI tool (separate distribution, not in API or web image)
+observal_cli/
+
+# Development tooling
+.github/
+.vscode/
+.idea/
+*.code-workspace
+
+# Scripts and tools (not needed in containers)
+scripts/
+tools/
+
+# Demo configs
+demo/
+
+# Monitoring configs (volume-mounted at runtime, not baked in)
+grafana/
+prometheus.yml
+otel-collector-config.yaml
+
+# Docker sub-configs (not needed inside images)
+docker/docker-compose*.yml
+docker/clickhouse/
+docker/nginx.conf
+docker/nginx.dev.conf
+docker/nginx.production.conf
+docker/server-package/
+
+# Environment and logs
+.env
+.env.*
+!.env.example
+*.log
+
+# Misc
+renovate.json
+cliff.toml

observal_cli-1.6.0/.github/pull_request_template.md

@@ -0,0 +1,46 @@
+<!-- SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com> -->
+<!-- SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com> -->
+<!-- SPDX-FileCopyrightText: 2026 Piyush <pranyasharma55555@gmail.com> -->
+<!-- SPDX-License-Identifier: AGPL-3.0-only -->
+
+<!--- Please fill the necessary details below -->
+## Purpose / Description
+_Describe the problem or feature and motivation_
+
+## Fixes
+* Fixes #<!-- replace this comment with the issue number e.g. 'Fixes #100'-->
+
+## Approach
+_How does this change address the problem?_
+
+## How Has This Been Tested?
+
+Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
+
+## Learning (optional, can help others)
+_Describe the research stage_
+
+_Links to blog posts, patterns, libraries or addons used to solve this problem_
+
+## Checklist
+_Please, go through these checks before submitting the PR._
+
+- [ ] You have a descriptive commit message with a short title (first line, max 50 chars).
+- [ ] You have commented your code, particularly in hard-to-understand areas
+- [ ] You have performed a self-review of your own code
+- [ ] UI changes: include screenshots of all affected screens (in particular showing any new or changed strings)
+
+<!--- Uncomment this section ONLY if this PR introduces new resources (external libraries, icons etc)
+## Licenses
+_For each new external resource, add a row to the table below:_
+
+| Library | Description | License |
+| --- | --- | --- |
+| Sample Icon Library | Sample Description | [MIT License](https://opensource.org/licenses/MIT) |
+--->
+
+## AI Assistance
+_Was generative AI tooling used to co-author this PR?_
+
+- [ ] Yes(Please Specify the tool):
+- [ ] Was the generated code manually reviewed and tested?

observal_cli-1.6.0/.github/workflows/ci.yml

@@ -0,0 +1,296 @@
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-FileCopyrightText: 2026 Lokesh Selvam <lokeshselvam7025@gmail.com>
+# SPDX-FileCopyrightText: 2026 Naraen Rammoorthi <naraen13@gmail.com>
+# SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com>
+# SPDX-FileCopyrightText: 2026 Vishnu Muthiah <vishnu.muthiah04@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Observal CI — runs on every PR targeting main and on pushes to main.
+#
+# Recommended branch-protection rules (Settings → Branches → main):
+#   Required status checks:
+#     • lint
+#     • reuse-lint
+#     • test (3.11)
+#     • test (3.12)
+#     • test (3.13)
+#     • web-lint
+#     • docker-build
+#     • import-boundary
+#     • dependency-audit
+#   Require a pull request before merging
+#   Require approvals: 1
+#   Do not allow bypassing the above settings
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# ── Job 0: Path filtering ─────────────────────────────────────────────────────
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      python: ${{ steps.filter.outputs.python }}
+      web: ${{ steps.filter.outputs.web }}
+      docker: ${{ steps.filter.outputs.docker }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            python:
+              - 'observal_cli/**/*.py'
+              - 'observal-server/**/*.py'
+              - 'tests/**/*.py'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'Makefile'
+              - '.pre-commit-config.yaml'
+              - '.github/workflows/ci.yml'
+            web:
+              - 'web/**'
+              - '.github/workflows/ci.yml'
+            docker:
+              - 'docker/**'
+              - 'observal_cli/**'
+              - 'observal-server/**'
+              - 'web/**'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'web/package.json'
+              - 'pnpm-lock.yaml'
+              - '.env.example'
+              - '.github/workflows/ci.yml'
+
+# ── Job 1: Python lint ────────────────────────────────────────────────────────
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    needs: changes
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v8.1.0
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python 3.13
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install 3.13
+
+      - name: ruff check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.12 ruff check .
+
+      - name: ruff format --check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.12 ruff format --check .
+
+# ── Job 2: REUSE license compliance ──────────────────────────────────────────────
+  reuse-lint:
+    name: reuse-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: REUSE compliance check
+        uses: fsfe/reuse-action@v6
+
+# ── Job 3: Python tests (matrix) ──────────────────────────────────────────────
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: changes
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping test"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v8.1.0
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python ${{ matrix.python-version }}
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install project dependencies
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv sync --python ${{ matrix.python-version }} --group dev
+
+      - name: Run pytest
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv run \
+            --python ${{ matrix.python-version }} \
+            --with asyncpg \
+            --with hypothesis \
+            --with pyarrow \
+            --with pytest-cov \
+            pytest ../tests/ -q \
+              ${{ matrix.python-version == '3.13' && '--cov=../observal_cli --cov=. --cov-report=xml' || '' }}
+
+      - name: Upload coverage to Codecov
+        if: needs.changes.outputs.python == 'true' && matrix.python-version == '3.13'
+        uses: codecov/codecov-action@v6
+        with:
+          files: observal-server/coverage.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+
+# ── Job 4: Next.js lint + typecheck ───────────────────────────────────────────
+  web-lint:
+    name: web-lint
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Skip if no web changes
+        if: needs.changes.outputs.web != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No web changes detected, skipping web-lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.web == 'true'
+
+      - uses: pnpm/action-setup@v6
+        if: needs.changes.outputs.web == 'true'
+
+      - uses: actions/setup-node@v6
+        if: needs.changes.outputs.web == 'true'
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        if: needs.changes.outputs.web == 'true'
+        working-directory: .
+        run: pnpm install --frozen-lockfile
+
+      - name: ESLint
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run lint
+
+      - name: TypeScript typecheck
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run typecheck
+
+# ── Job 5: Import boundary check ─────────────────────────────────────────────
+  import-boundary:
+    name: import-boundary
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check ee/ import boundary
+        run: |
+          echo "Checking that core does not import from ee/..."
+          VIOLATIONS=$(grep -rn "from ee\b\|import ee\b" observal-server/ observal_cli/ --include="*.py" | grep -v "main.py" | grep -v "services/insights/__init__.py" | grep -v "services/audit/__init__.py" | grep -v "/tests/" || true)
+          if [ -n "$VIOLATIONS" ]; then
+            echo "::error::Import boundary violation — core must not import from ee/"
+            echo "$VIOLATIONS"
+            exit 1
+          fi
+          echo "✓ No import boundary violations found"
+
+# ── Job 6: Docker build ───────────────────────────────────────────────────────
+  docker-build:
+    name: docker-build
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: docker
+
+    steps:
+      - name: Skip if no Docker changes
+        if: needs.changes.outputs.docker != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No Docker changes detected, skipping docker-build"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.docker == 'true'
+
+      - name: Create stub .env
+        if: needs.changes.outputs.docker == 'true'
+        run: touch ../.env
+
+      - name: Build images
+        if: needs.changes.outputs.docker == 'true'
+        run: docker compose build
+
+# ── Job 7: Dependency audit ─────────────────────────────────────────────────
+  dependency-audit:
+    name: dependency-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Run pip-audit
+        run: |
+          uv python install 3.12
+          cd observal-server
+          uv run --with pip-audit pip-audit --strict --desc --ignore-vuln PYSEC-2025-183 --ignore-vuln PYSEC-2026-161 --ignore-vuln CVE-2026-47265
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Run pnpm audit
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm audit --prod

observal_cli-1.6.0/.github/workflows/terraform.yml

@@ -0,0 +1,194 @@
+# SPDX-FileCopyrightText: 2026 Apoorv Garg <apoorvgarg.21@gmail.com>
+# SPDX-FileCopyrightText: 2026 Vishnu Muthiah <vishnu.muthiah04@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Terraform — fmt + validate + tflint + env consistency for all modules.
+#
+# Runs on PRs and pushes to main that touch infra/terraform/**, .env.example,
+# or observal-server/config.py. No cloud credentials needed.
+#
+# Modules covered:
+#   • infra/terraform/aws  (ECS Fargate — full matrix)
+#   • infra/terraform/gcp  (Cloud Run — full matrix)
+#   • infra/terraform/aws-ec2 (single-instance — fmt+validate only)
+#
+# aws-ec2 is excluded from the matrix and consistency checks because it uses
+# different variable conventions (name vs name_prefix, no clickhouse_mode).
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: Terraform
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'infra/terraform/**'
+      - '.github/workflows/terraform.yml'
+      - '.env.example'
+      - 'observal-server/config.py'
+  push:
+    branches: [main]
+    paths:
+      - 'infra/terraform/**'
+      - '.github/workflows/terraform.yml'
+      - '.env.example'
+      - 'observal-server/config.py'
+
+concurrency:
+  group: terraform-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ── fmt + validate (aws, gcp) ──────────────────────────────────────────────
+  fmt-validate:
+    name: "${{ matrix.module }} fmt+validate"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [aws, gcp]
+        include:
+          - module: aws
+            working_dir: infra/terraform/aws
+            has_bootstrap: true
+          - module: gcp
+            working_dir: infra/terraform/gcp
+            has_bootstrap: false
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: 1.9.8
+          terraform_wrapper: false
+
+      - name: terraform fmt (recursive)
+        working-directory: ${{ matrix.working_dir }}
+        run: terraform fmt -check -recursive -diff
+
+      - name: terraform init (root module, no backend)
+        working-directory: ${{ matrix.working_dir }}
+        run: terraform init -backend=false -input=false
+
+      - name: terraform validate (root module)
+        working-directory: ${{ matrix.working_dir }}
+        run: terraform validate -no-color
+
+      - name: terraform init (examples/minimal)
+        working-directory: ${{ matrix.working_dir }}/examples/minimal
+        run: terraform init -backend=false -input=false
+
+      - name: terraform validate (examples/minimal)
+        working-directory: ${{ matrix.working_dir }}/examples/minimal
+        run: terraform validate -no-color
+
+      - name: Check examples/byovpc exists
+        id: byovpc
+        run: test -f "${{ matrix.working_dir }}/examples/byovpc/main.tf" && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
+
+      - name: terraform init (examples/byovpc)
+        if: steps.byovpc.outputs.exists == 'true'
+        working-directory: ${{ matrix.working_dir }}/examples/byovpc
+        run: terraform init -backend=false -input=false
+
+      - name: terraform validate (examples/byovpc)
+        if: steps.byovpc.outputs.exists == 'true'
+        working-directory: ${{ matrix.working_dir }}/examples/byovpc
+        run: terraform validate -no-color
+
+      - name: terraform init (bootstrap)
+        if: matrix.has_bootstrap
+        working-directory: ${{ matrix.working_dir }}/bootstrap
+        run: terraform init -backend=false -input=false
+
+      - name: terraform validate (bootstrap)
+        if: matrix.has_bootstrap
+        working-directory: ${{ matrix.working_dir }}/bootstrap
+        run: terraform validate -no-color
+
+  # ── tflint (aws, gcp) ─────────────────────────────────────────────────────
+  tflint:
+    name: "${{ matrix.module }} tflint"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [aws, gcp]
+        include:
+          - module: aws
+            working_dir: infra/terraform/aws
+          - module: gcp
+            working_dir: infra/terraform/gcp
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup tflint
+        uses: terraform-linters/setup-tflint@v6
+        with:
+          tflint_version: v0.55.0
+
+      - name: tflint init
+        working-directory: ${{ matrix.working_dir }}
+        run: tflint --init
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: tflint
+        working-directory: ${{ matrix.working_dir }}
+        run: tflint --recursive --format=compact
+
+  # ── aws-ec2 (lightweight, different conventions) ───────────────────────────
+  fmt-validate-ec2:
+    name: "aws-ec2 fmt+validate"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: 1.9.8
+          terraform_wrapper: false
+
+      - name: terraform fmt
+        working-directory: infra/terraform/aws-ec2
+        run: terraform fmt -check -diff
+
+      - name: terraform init + validate
+        working-directory: infra/terraform/aws-ec2
+        run: |
+          terraform init -backend=false -input=false
+          terraform validate -no-color
+
+  # ── Terraform <-> App env consistency ──────────────────────────────────────
+  consistency:
+    name: "terraform-env consistency"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run consistency checks
+        run: python scripts/check_terraform_consistency.py

observal_cli-1.6.0/.gitignore

@@ -0,0 +1,81 @@
+# SPDX-FileCopyrightText: 2026 Aryan Iyappan <aryaniyappan2006@gmail.com>
+# SPDX-FileCopyrightText: 2026 Subramania Raja <dhanpraja231@gmail.com>
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+__pycache__/
+*.pyc
+*.pyo
+.env
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# IDE / editor
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# AI agent / coding tool configs
+.claude/
+CLAUDE.md
+.kiro/
+.cursor/
+.cursorignore
+.cursorindexingignore
+.gemini/
+GEMINI.md
+.opencode/
+.github/copilot-instructions.md
+.github/hooks/
+.copilot/
+.worktrees/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Python
+.venv/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+htmlcov/
+.coverage
+*.cover
+
+# Node
+observal-web/node_modules/
+observal-web/dist/
+
+# Docker
+docker/data/
+docker/clickhouse/users.d/default-user.xml
+
+# Terraform
+**/.terraform/
+*.tfplan
+*.tfstate
+*.tfstate.backup
+
+# Local / ephemeral
+.playwright-mcp/
+e2e-screenshots/
+migration/
+*.pem
+test-scan.json
+
+# Private packages (symlinked for local Docker builds)
+observal-insights/
+.observal/
+.pi-lens/
+node_modules
+.pi/
+.mcp.json
+*.bak
+scripts/seed_demo.py
+.playwright-cli/