pdt-cli 0.1.1__tar.gz → 0.1.2__tar.gz

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pdt-cli
-Version: 0.1.1
+Version: 0.1.2
 Summary: Easily deploy your process to AWS, Azure, Google Cloud, or Windows.
 License-Expression: MIT
 Requires-Python: >=3.12
@@ -17,6 +17,7 @@ Requires-Dist: shellingham
 Provides-Extra: apps
 Requires-Dist: adlfs; extra == 'apps'
 Requires-Dist: azure-identity; extra == 'apps'
+Requires-Dist: azure-keyvault-secrets; extra == 'apps'
 Requires-Dist: azure-storage-blob; extra == 'apps'
 Requires-Dist: boto3; extra == 'apps'
 Requires-Dist: cryptography; extra == 'apps'
@@ -40,7 +41,7 @@ uv tool install pdt-cli
 
 That puts a `pdt` command on your PATH. To update it later, run `uv tool upgrade pdt-cli`.
 
-The first interactive `pdt` command turns on tab completion without a prompt. It works in every new terminal: Tab finishes pdt commands, their options, your app names, example names for `new --from`, and AWS profile names for `--profile`. It supports bash, zsh, fish, and PowerShell. `pdt completion [SHELL]` sets up a second shell, and `pdt completion --script bash` prints the script instead of writing it, if you keep your own dotfiles.
+The first interactive `pdt` command turns on tab completion without a prompt. It works in every new terminal: Tab finishes pdt commands, their options, your app names, and example names for `new --from`. It supports bash, zsh, fish, and PowerShell. `pdt completion [SHELL]` sets up a second shell, and `pdt completion --script bash` prints the script instead of writing it, if you keep your own dotfiles.
 
 You can also clone this repository and run `./pdt` (or `.\pdt.bat` on Windows) instead. It installs `uv` for you if you do not have it. Both ways give you the same commands.
 
@@ -116,18 +117,22 @@ pdt login my-report
 | `pdt init [DIR]` | create a project here, or in DIR |
 | `pdt examples` | list the example apps bundled with pdt |
 | `pdt new APP --from EXAMPLE` | add an app to the project |
-| `pdt list` | show every app with its schedule and provider |
+| `pdt list` | show every app with its schedule and provider; `--names` prints only the enabled app names |
 | `pdt validate` | check the config files and the required env vars |
 | `pdt run APP` | run an app on this machine |
 | `pdt deploy APP` | deploy an app to its configured platform |
 | `pdt destroy APP` | remove everything deploy created |
+| `pdt secrets APP` | show which `.env` values differ from the deployed app |
+| `pdt secrets APP save` | send your `.env` values to the deployed app; the next run uses them |
+| `pdt secrets APP get` | copy the deployed values into a `.env.<provider>` file |
+| `pdt secrets APP set NAME` | put one value, read from stdin, into the deployed app's secrets |
 | `pdt login APP` | sign in again to the app's cloud provider |
 | `pdt storage APP ls|get|query|destroy` | look at, fetch, query, or delete the app's stored files |
 | `pdt az ...` | run the Azure CLI that pdt installs |
 | `pdt gcloud ...` | run the Google Cloud CLI that pdt installs |
 | `pdt completion [SHELL]` | turn on tab completion for a shell |
 
-Leave `APP` off `run`, `deploy`, `destroy`, or `login`, or mistype it, and pdt lists the apps in the project so you can pick one.
+Leave `APP` off `run`, `deploy`, `destroy`, `secrets`, or `login`, or mistype it, and pdt lists the apps in the project so you can pick one.
 
 `pdt az` and `pdt gcloud` hand your arguments straight to the cloud tool, and install it first if it is missing. For example, `pdt az account list`.
 
@@ -165,6 +170,8 @@ store.push(Path(".pdt-state"), "state/", lease)
 
 From your own computer, `pdt storage APP ls`, `get`, and `query` read the files with your own cloud sign-in. `pdt storage APP destroy` is the only command that deletes them, and it asks first. An app that needs none of this sets `storage: false` in its `config.yml`.
 
+An app that is not ready sets `enabled: false` in its `config.yml`. `pdt list` still shows it, and every other command acts as if the app is not there. `uv run run.py` in the app folder still runs it.
+
 ## Running pdt from CI
 
 Every command reads its values from the environment it runs in. A build server sets them as CI variables, and no `.env` file is needed.
@@ -186,10 +193,14 @@ platform:
   subscription: 00000000-0000-0000-0000-000000000000
   region: eastus
   resource_group: pdt
+  # Optional. An environment you already own, as <resource-group>/<name>.
+  # environment: my-group/my-environment
 ```
 
 `subscription` is optional. When it is missing or wrong, the deploy asks you to choose one.
 
+Every pdt project in a subscription runs its jobs in one shared Container Apps environment per region, `pdt-<region>` in the resource group `pdt-shared`, because a subscription allows only a few environments. Destroying the last app that uses the environment removes it, and removes `pdt-shared` once it holds no environment. Set `environment` to use an environment you already have; pdt then never creates, changes, or deletes it.
+
 ### AWS
 
 ```yaml
@@ -198,8 +209,12 @@ platform:
   region: us-east-1
   # Written for you on the first deploy, from your credentials.
   account: "123456789012"
+  # Optional. Which profile in ~/.aws to use. Written for you if pdt has to ask.
+  profile: work
 ```
 
+`profile` is optional. When it is missing, pdt uses `AWS_PROFILE`, or the only profile on your computer. When there are several and none is chosen, or the one in the file is not on this computer, the deploy lists them and asks you to choose, then writes your answer here.
+
 ### Google Cloud
 
 ```yaml
@@ -289,7 +304,7 @@ An app is a folder with a `run.py` that has a `main()` function. It declares its
 ```python
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pdt-cli[apps]==0.1.0"]
+# dependencies = ["pdt-cli[apps]==0.1.2"]
 # ///
 from pathlib import Path
 

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/README.md

@@ -10,7 +10,7 @@ uv tool install pdt-cli
 
 That puts a `pdt` command on your PATH. To update it later, run `uv tool upgrade pdt-cli`.
 
-The first interactive `pdt` command turns on tab completion without a prompt. It works in every new terminal: Tab finishes pdt commands, their options, your app names, example names for `new --from`, and AWS profile names for `--profile`. It supports bash, zsh, fish, and PowerShell. `pdt completion [SHELL]` sets up a second shell, and `pdt completion --script bash` prints the script instead of writing it, if you keep your own dotfiles.
+The first interactive `pdt` command turns on tab completion without a prompt. It works in every new terminal: Tab finishes pdt commands, their options, your app names, and example names for `new --from`. It supports bash, zsh, fish, and PowerShell. `pdt completion [SHELL]` sets up a second shell, and `pdt completion --script bash` prints the script instead of writing it, if you keep your own dotfiles.
 
 You can also clone this repository and run `./pdt` (or `.\pdt.bat` on Windows) instead. It installs `uv` for you if you do not have it. Both ways give you the same commands.
 
@@ -86,18 +86,22 @@ pdt login my-report
 | `pdt init [DIR]` | create a project here, or in DIR |
 | `pdt examples` | list the example apps bundled with pdt |
 | `pdt new APP --from EXAMPLE` | add an app to the project |
-| `pdt list` | show every app with its schedule and provider |
+| `pdt list` | show every app with its schedule and provider; `--names` prints only the enabled app names |
 | `pdt validate` | check the config files and the required env vars |
 | `pdt run APP` | run an app on this machine |
 | `pdt deploy APP` | deploy an app to its configured platform |
 | `pdt destroy APP` | remove everything deploy created |
+| `pdt secrets APP` | show which `.env` values differ from the deployed app |
+| `pdt secrets APP save` | send your `.env` values to the deployed app; the next run uses them |
+| `pdt secrets APP get` | copy the deployed values into a `.env.<provider>` file |
+| `pdt secrets APP set NAME` | put one value, read from stdin, into the deployed app's secrets |
 | `pdt login APP` | sign in again to the app's cloud provider |
 | `pdt storage APP ls|get|query|destroy` | look at, fetch, query, or delete the app's stored files |
 | `pdt az ...` | run the Azure CLI that pdt installs |
 | `pdt gcloud ...` | run the Google Cloud CLI that pdt installs |
 | `pdt completion [SHELL]` | turn on tab completion for a shell |
 
-Leave `APP` off `run`, `deploy`, `destroy`, or `login`, or mistype it, and pdt lists the apps in the project so you can pick one.
+Leave `APP` off `run`, `deploy`, `destroy`, `secrets`, or `login`, or mistype it, and pdt lists the apps in the project so you can pick one.
 
 `pdt az` and `pdt gcloud` hand your arguments straight to the cloud tool, and install it first if it is missing. For example, `pdt az account list`.
 
@@ -135,6 +139,8 @@ store.push(Path(".pdt-state"), "state/", lease)
 
 From your own computer, `pdt storage APP ls`, `get`, and `query` read the files with your own cloud sign-in. `pdt storage APP destroy` is the only command that deletes them, and it asks first. An app that needs none of this sets `storage: false` in its `config.yml`.
 
+An app that is not ready sets `enabled: false` in its `config.yml`. `pdt list` still shows it, and every other command acts as if the app is not there. `uv run run.py` in the app folder still runs it.
+
 ## Running pdt from CI
 
 Every command reads its values from the environment it runs in. A build server sets them as CI variables, and no `.env` file is needed.
@@ -156,10 +162,14 @@ platform:
   subscription: 00000000-0000-0000-0000-000000000000
   region: eastus
   resource_group: pdt
+  # Optional. An environment you already own, as <resource-group>/<name>.
+  # environment: my-group/my-environment
 ```
 
 `subscription` is optional. When it is missing or wrong, the deploy asks you to choose one.
 
+Every pdt project in a subscription runs its jobs in one shared Container Apps environment per region, `pdt-<region>` in the resource group `pdt-shared`, because a subscription allows only a few environments. Destroying the last app that uses the environment removes it, and removes `pdt-shared` once it holds no environment. Set `environment` to use an environment you already have; pdt then never creates, changes, or deletes it.
+
 ### AWS
 
 ```yaml
@@ -168,8 +178,12 @@ platform:
   region: us-east-1
   # Written for you on the first deploy, from your credentials.
   account: "123456789012"
+  # Optional. Which profile in ~/.aws to use. Written for you if pdt has to ask.
+  profile: work
 ```
 
+`profile` is optional. When it is missing, pdt uses `AWS_PROFILE`, or the only profile on your computer. When there are several and none is chosen, or the one in the file is not on this computer, the deploy lists them and asks you to choose, then writes your answer here.
+
 ### Google Cloud
 
 ```yaml
@@ -259,7 +273,7 @@ An app is a folder with a `run.py` that has a `main()` function. It declares its
 ```python
 # /// script
 # requires-python = ">=3.12"
-# dependencies = ["pdt-cli[apps]==0.1.0"]
+# dependencies = ["pdt-cli[apps]==0.1.2"]
 # ///
 from pathlib import Path
 

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/ci/tests/test_claude_task.py

@@ -204,6 +204,9 @@ def test_claude_command_shape(tmp_path):
     assert command[command.index("--disallowedTools") + 1] == "Bash(git push -f*)"
     assert command[command.index("--max-budget-usd") + 1] == "20.0"
     assert "--append-system-prompt-file" not in command
+    assert "--effort" not in command
+    high = runner.claude_command(runner.load_task("demo", make_task(tmp_path / "e", "effort: high\n")))
+    assert high[high.index("--effort") + 1] == "high"
     assert runner.claude_command(task, 0.1)[runner.claude_command(task, 0.1).index(
         "--max-budget-usd") + 1] == "0.1"
 

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/ci/tests/test_score_task.py

@@ -136,6 +136,21 @@ def test_a_simple_floor_says_why():
         "simple", ["only documentation, tests, or example apps changed"])
 
 
+def test_a_few_tested_lines_in_a_covered_file_floor_at_simple():
+    small = change("src/pdt/deploy_common.py", lines=4)
+    test = change("tests/test_dockerfile.py")
+    floor, reasons = select.rule_floor(mr(), [small, test])
+    assert floor == "simple" and "src/pdt/deploy_common.py" in reasons[0]
+    assert select.rule_floor(mr(), [small])[0] == "architectural"
+    assert select.rule_floor(mr(), [small, change("ci/tests/test_x.py")])[0] == "architectural"
+    five = change("src/pdt/deploy_common.py", lines=5)
+    assert select.rule_floor(mr(), [five, test])[0] == "architectural"
+    gated = change("src/pdt/cli.py", extra="+token = 1\n")
+    assert select.rule_floor(mr(), [gated, test])[0] == "architectural"
+    for path in ("src/pdt/utils/log.py", ".gitlab-ci.yml", "AGENTS.md", "pdt"):
+        assert select.rule_floor(mr(), [change(path), test])[0] == "architectural", path
+
+
 def test_deleted_renamed_and_large_files_bump_simple_to_review():
     for flag in ("deleted_file", "renamed_file", "too_large", "collapsed"):
         floor, reasons = select.rule_floor(mr(), [change("README.md", **{flag: True})])
@@ -265,6 +280,9 @@ def test_status_and_note_body():
     assert body.splitlines()[0] == check.format_marker("abc", "review", "architectural", "raised")
     assert "`tier::architectural`" in body and "Claude raised it" in body
     assert "- touches deploy dispatch" in body and "http://job" in body
+    assert check.MERGE_FOOTER not in body and check.FOOTER in body
+    simple = check.note_body("abc", check.Score("simple", "simple", [], "agree"), "")
+    assert check.MERGE_FOOTER in simple
 
 
 def test_label_change_leaves_exactly_one_tier_label():
@@ -276,16 +294,6 @@ def test_label_change_leaves_exactly_one_tier_label():
 
 # --- select hook end to end ---------------------------------------------------
 
-def webhook_event(tmp_path, monkeypatch, iid, action="open", changes=None) -> None:
-    """Point TRIGGER_PAYLOAD at a merge request webhook payload for ``iid``."""
-    payload = {"object_kind": "merge_request", "event_type": "merge_request",
-               "object_attributes": {"iid": iid, "action": action},
-               "changes": changes or {}}
-    path = tmp_path / "payload.json"
-    path.write_text(json.dumps(payload))
-    monkeypatch.setenv("TRIGGER_PAYLOAD", str(path))
-
-
 def run_select(monkeypatch, capsys, mrs, notes, dry_run="false"):
     arm(monkeypatch, dry_run)
     fetches = []
@@ -389,61 +397,8 @@ def test_select_names_missing_variables(monkeypatch, capsys):
 
 # --- a webhook run looks at one MR --------------------------------------------
 
-def test_event_scope_names_the_mr_or_says_there_is_nothing_to_do():
-    def event(action, changes=None, **attrs):
-        return {"object_kind": "merge_request",
-                "object_attributes": {"iid": 5, "action": action, **attrs},
-                "changes": changes or {}}
-
-    assert select.event_scope(None) == ("all", None)
-    assert select.event_scope({"object_kind": "push"}) == ("all", None)
-    assert select.event_scope({"object_kind": "merge_request", "object_attributes": {}}) == (
-        "all", None)
-    ready = {"draft": {"previous": True, "current": False}, "title": {}, "updated_at": {}}
-    assert select.event_scope(event("open")) == ("one", 5)
-    assert select.event_scope(event("reopen")) == ("one", 5)
-    assert select.event_scope(event("update", ready)) == ("one", 5)
-    assert select.event_scope(event("update", {"work_in_progress": ready["draft"]})) == ("one", 5)
-    # Everything else does nothing: pushes, rebases, labels, edits, going to Draft, closing.
-    assert select.event_scope(event("update", {"last_commit": {}, "updated_at": {}})) == ("none", 5)
-    assert select.event_scope(event("update", {"labels": {}, "updated_at": {}})) == ("none", 5)
-    assert select.event_scope(event("update", {"draft": {"previous": False, "current": True}})) == (
-        "none", 5)
-    assert select.event_scope(event("update", {"description": {}})) == ("none", 5)
-    assert select.event_scope(event("update")) == ("none", 5)
-    assert select.event_scope(event("approved")) == ("none", 5)
-    assert select.event_scope(event("close")) == ("none", 5)
-    assert select.event_scope(event("merge")) == ("none", 5)
-
-
-def test_gate_says_skip_for_an_event_that_does_nothing_and_run_otherwise(monkeypatch, capsys, tmp_path):
-    monkeypatch.delenv("TRIGGER_PAYLOAD", raising=False)
-    assert select.main(["--gate"]) == 0
-    assert capsys.readouterr().out.strip() == "run"
-    webhook_event(tmp_path, monkeypatch, 4, action="update", changes={"last_commit": {}})
-    assert select.main(["--gate"]) == 0
-    out, err = capsys.readouterr()
-    assert out.strip() == "skip" and "webhook event for !4 is 'update'" in err
-    webhook_event(tmp_path, monkeypatch, 4, action="update",
-                  changes={"draft": {"previous": True, "current": False}})
-    assert select.main(["--gate"]) == 0
-    assert capsys.readouterr().out.strip() == "run"
-    webhook_event(tmp_path, monkeypatch, 4)
-    assert select.main(["--gate"]) == 0
-    assert capsys.readouterr().out.strip() == "run"
-
-
-def test_the_ci_job_gates_on_the_event_before_installing_anything():
-    ci = yaml.safe_load((REPO / ".gitlab-ci.yml").read_text())
-    gate = ci[".claude-task"]["before_script"][0]
-    assert gate.startswith("if [ -n \"$CLAUDE_TASK_GATE\" ]") and "= skip" in gate and "exit 0" in gate
-    assert ci["score-mrs"]["variables"]["CLAUDE_TASK_GATE"] == \
-        "python ci/claude-tasks/score-mrs/select_mrs.py --gate"
-    assert "CLAUDE_TASK_GATE" not in ci["rebase-mrs"].get("variables", {})
-
-
-def test_a_webhook_run_scores_only_the_mr_in_the_event(monkeypatch, capsys, tmp_path):
-    webhook_event(tmp_path, monkeypatch, 2)
+def test_a_webhook_run_scores_only_the_mr_in_the_event(monkeypatch, capsys):
+    monkeypatch.setenv("MR_IID", "2")
     mrs = {1: {**mr(1), "_files": [change("docs/a.md")]},
            2: {**mr(2), "_files": [change("docs/b.md")]},
            3: {**mr(3), "_files": [change("docs/c.md")]}}
@@ -452,53 +407,103 @@ def test_a_webhook_run_scores_only_the_mr_in_the_event(monkeypatch, capsys, tmp_
     assert "webhook event for !2: looking at that MR only" in err
     assert "1 open MR(s)" in err
     touched = {p for _, p, _ in calls if "/merge_requests/" in p}
-    assert touched == {"/projects/42/merge_requests/2", "/projects/42/merge_requests/2/diffs?per_page=100&page=1",
-                       "/projects/42/merge_requests/2/notes?sort=desc&order_by=created_at&per_page=100&page=1"}
+    assert touched == {"/projects/42/merge_requests/2",
+                       "/projects/42/merge_requests/2/diffs?per_page=100&page=1",
+                       "/projects/42/merge_requests/2/notes?sort=desc&order_by=created_at"
+                       "&per_page=100&page=1"}
     assert fetches == [["git", "fetch", "--quiet", "origin",
                         "+refs/heads/master:refs/remotes/origin/master",
                         "+refs/heads/branch-2:refs/remotes/origin/branch-2"]]
 
 
-def test_a_webhook_run_for_an_mr_leaving_draft_scores_it(monkeypatch, capsys, tmp_path):
-    webhook_event(tmp_path, monkeypatch, 2, action="update",
-                  changes={"draft": {"previous": True, "current": False},
-                           "title": {"previous": "Draft: x", "current": "x"}})
+def test_a_webhook_run_for_an_mr_that_is_no_longer_open_lists_nothing(monkeypatch, capsys):
+    monkeypatch.setenv("MR_IID", "9")
+    items, err, calls, fetches = run_select(monkeypatch, capsys, {1: {**mr(1), "_files": []}}, {})
+    assert items == [] and fetches == []
+    assert "not an open MR of this project" in err
+    assert [p for _, p, _ in calls] == [
+        "/projects/42/merge_requests?state=opened&target_branch=master&per_page=100&page=1"]
+
+
+def test_a_run_without_an_event_sweeps_every_open_mr(monkeypatch, capsys):
+    monkeypatch.delenv("MR_IID", raising=False)
     mrs = {1: {**mr(1), "_files": [change("docs/a.md")]},
            2: {**mr(2), "_files": [change("docs/b.md")]}}
     items, err, _, _ = run_select(monkeypatch, capsys, mrs, {})
-    assert [item["iid"] for item in items] == [2]
-    assert "looking at that MR only" in err
+    assert [item["iid"] for item in items] == [1, 2]
+    assert "webhook event" not in err
+    monkeypatch.setenv("MR_IID", "  ")
+    items, _, _, _ = run_select(monkeypatch, capsys, mrs, {})
+    assert [item["iid"] for item in items] == [1, 2]
 
 
-def test_a_webhook_run_for_any_other_event_does_nothing(monkeypatch, capsys, tmp_path):
-    for action, changes in (("close", None),
-                            ("update", {"last_commit": {"previous": {}, "current": {}}}),
-                            ("update", {"labels": {"previous": [], "current": [{"title": "tier::review"}]},
-                                        "updated_at": {"previous": "a", "current": "b"}})):
-        webhook_event(tmp_path, monkeypatch, 2, action=action, changes=changes)
-        items, err, calls, fetches = run_select(monkeypatch, capsys,
-                                                {2: {**mr(2), "_files": []}}, {})
-        assert items == [] and calls == [] and fetches == [], action
-        assert f"webhook event for !2 is '{action}'" in err and "nothing to do" in err
+# --- which events run which job -----------------------------------------------
 
+def job_runs(job: str, variables: dict) -> bool:
+    """Evaluate one job's rules the way GitLab would for these variables.
 
-def test_a_webhook_run_for_an_mr_that_is_no_longer_open_lists_nothing(monkeypatch, capsys, tmp_path):
-    webhook_event(tmp_path, monkeypatch, 9)
-    items, err, calls, fetches = run_select(monkeypatch, capsys, {1: {**mr(1), "_files": []}}, {})
-    assert items == [] and fetches == []
-    assert "not an open MR of this project" in err
-    assert [p for _, p, _ in calls] == ["/projects/42/merge_requests?state=opened&target_branch=master&per_page=100&page=1"]
+    Only what those rules use is understood: ``$X == "v"``, ``$X != "v"`` and
+    ``$X == null``, joined with ``&&``, and a rule with no ``if`` that matches
+    everything. The first matching rule decides; no match means the job does
+    not run.
+    """
+    ci = yaml.safe_load((REPO / ".gitlab-ci.yml").read_text())
+    for rule in ci[job]["rules"]:
+        matched = True
+        for clause in rule["if"].split(" && ") if "if" in rule else ():
+            if " != " in clause:
+                name, _, value = clause.partition(" != ")
+                matched &= variables.get(name.strip("$ ")) != value.strip('"')
+            else:
+                name, _, value = clause.partition(" == ")
+                expected = None if value == "null" else value.strip('"')
+                matched &= variables.get(name.strip("$ ")) == expected
+        if matched:
+            return rule.get("when") != "never"
+    return False
+
+
+def trigger(action, before="null", after="null"):
+    """The variables the webhook's template sends; a missing Draft change renders as null."""
+    return {"CI_PIPELINE_SOURCE": "trigger", "mode": "score_mrs", "MR_IID": "5",
+            "MR_ACTION": action, "MR_DRAFT_BEFORE": before, "MR_DRAFT_AFTER": after}
+
+
+SCORED_EVENTS = [trigger("open"), trigger("reopen"), trigger("update", "true", "false")]
+# Pushes, rebases, labels, edits, going to Draft, approvals, closing, merging.
+SKIPPED_EVENTS = [trigger("update"), trigger("update", "false", "true"),
+                  trigger("update", "true", "true"), trigger("approved"),
+                  trigger("close"), trigger("merge"), trigger("")]
+
+
+def test_a_webhook_event_scores_only_when_the_mr_opens_or_leaves_draft():
+    for variables in SCORED_EVENTS:
+        assert job_runs("score-mrs", variables), variables
+        assert not job_runs("score-mrs-skip", variables), variables
+    for variables in SKIPPED_EVENTS:
+        assert not job_runs("score-mrs", variables), variables
+
+
+def test_every_webhook_event_gets_a_pipeline_so_the_hook_never_sees_a_4xx():
+    # The trigger API answers 400 when a pipeline has no job or workflow rules
+    # filter it out, and GitLab disables a webhook after four 4xx in a row.
+    ci = yaml.safe_load((REPO / ".gitlab-ci.yml").read_text())
+    assert "workflow" not in ci, "workflow rules would filter trigger pipelines out"
+    for variables in SCORED_EVENTS + SKIPPED_EVENTS:
+        assert job_runs("score-mrs", variables) != job_runs("score-mrs-skip", variables), variables
 
 
-def test_a_bad_payload_falls_back_to_a_sweep(monkeypatch, capsys, tmp_path):
-    (tmp_path / "payload.json").write_text("not json")
-    monkeypatch.setenv("TRIGGER_PAYLOAD", str(tmp_path / "payload.json"))
-    items, err, _, _ = run_select(monkeypatch, capsys, {1: {**mr(1), "_files": [change("a.md")]}}, {})
-    assert [item["iid"] for item in items] == [1]
-    assert "sweeping every open MR" in err
-    monkeypatch.setenv("TRIGGER_PAYLOAD", str(tmp_path / "missing.json"))
-    items, err, _, _ = run_select(monkeypatch, capsys, {1: {**mr(1), "_files": [change("a.md")]}}, {})
-    assert [item["iid"] for item in items] == [1]
+def test_the_skip_job_never_runs_outside_a_score_mrs_trigger():
+    for variables in [{"CI_PIPELINE_SOURCE": "merge_request_event"},
+                      {"CI_PIPELINE_SOURCE": "push", "CI_COMMIT_BRANCH": "master"},
+                      {"CI_PIPELINE_SOURCE": "schedule", "mode": "score_mrs"},
+                      {"CI_PIPELINE_SOURCE": "schedule", "mode": "close_stale_drafts"},
+                      {"CI_PIPELINE_SOURCE": "web", "mode": "score_mrs"},
+                      {"CI_PIPELINE_SOURCE": "web"},
+                      {"CI_PIPELINE_SOURCE": "trigger", "mode": "other"}]:
+        assert not job_runs("score-mrs-skip", variables), variables
+    assert job_runs("score-mrs", {"CI_PIPELINE_SOURCE": "schedule", "mode": "score_mrs"})
+    assert job_runs("score-mrs", {"CI_PIPELINE_SOURCE": "web", "mode": "score_mrs"})
 
 
 # --- check hook end to end ----------------------------------------------------
@@ -613,7 +618,8 @@ def test_score_mrs_job_runs_on_a_webhook_trigger_and_its_schedule():
     rules = {rule["if"]: rule.get("variables", {}) for rule in job["rules"]}
     assert not [k for k in rules if "CI_DEFAULT_BRANCH" in k], "no run on every merge"
     trigger = [v for k, v in rules.items() if '"trigger"' in k and "score_mrs" in k]
-    assert trigger == [{"DRY_RUN": "false"}]
+    assert len(trigger) == 3, "open, reopen, and leaving Draft"
+    assert all(v == {"DRY_RUN": "false"} for v in trigger)
     schedule = [v for k, v in rules.items() if '"schedule"' in k and "score_mrs" in k]
     assert schedule == [{"DRY_RUN": "false"}]
     web = [(k, v) for k, v in rules.items() if '"web"' in k and "score_mrs" in k]
@@ -627,7 +633,8 @@ def test_a_mode_pipeline_runs_only_its_own_task():
         if not isinstance(job, dict) or "rules" not in job:
             continue
         for rule in job["rules"]:
-            if "$mode ==" in rule["if"] and "$mode == null" not in rule["if"]:
+            condition = rule.get("if", "")
+            if "$mode ==" in condition and "$mode == null" not in condition:
                 continue  # the job a mode pipeline is for
-            if "CI_DEFAULT_BRANCH" in rule["if"]:
-                assert "$mode == null" in rule["if"], name
+            if "CI_DEFAULT_BRANCH" in condition:
+                assert "$mode == null" in condition, name

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pdt-cli"
-version = "0.1.1"
+version = "0.1.2"
 description = "Easily deploy your process to AWS, Azure, Google Cloud, or Windows."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -31,6 +31,7 @@ apps = [
     "google-cloud-storage",
     "azure-storage-blob",
     "azure-identity",
+    "azure-keyvault-secrets",
 ]
 
 [project.scripts]
@@ -47,7 +48,7 @@ packages = ["src/pdt"]
 include = ["src/pdt", "README.md", "tests"]
 
 [dependency-groups]
-dev = ["pytest", "ruff", "fsspec"]
+dev = ["pytest", "ruff", "fsspec", "boto3"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests", "ci/tests"]

{pdt_cli-0.1.1 → pdt_cli-0.1.2}/src/pdt/cli.py

@@ -16,7 +16,7 @@ from pathlib import Path
 
 import rich_argparse
 
-from pdt import __version__, completion, config, console, deploy, scaffold
+from pdt import __version__, completion, config, console, deploy, deploy_common, scaffold
 from pdt.config import ConfigError
 from pdt.utils.send_email import auth_env_file, email_problems, prepare_email_auth
 
@@ -46,6 +46,15 @@ def say_no_apps() -> None:
     console.command("pdt new my-report --from <example>")
 
 
+APP_QUESTIONS = {
+    "run": "Which app do you want to run?",
+    "deploy": "Which app do you want to deploy?",
+    "login": "Which app's cloud provider do you want to sign in to?",
+    "destroy": "Which app do you want to destroy?",
+    "secrets": "Which app's secrets?",
+}
+
+
 def choose_app(name: str | None, command: str) -> str | None:
     """Return the app `pdt <command>` should act on, or None after guiding the user.
 
@@ -60,7 +69,7 @@ def choose_app(name: str | None, command: str) -> str | None:
     if name in apps:
         return name
     if name is None:
-        console.heading(f"Which app do you want to {command}? This project has:")
+        console.heading(f"{APP_QUESTIONS[command]} This project has:")
     else:
         console.error(f"no app named {name!r}. This project has:")
     shown = apps[:5]
@@ -73,20 +82,25 @@ def choose_app(name: str | None, command: str) -> str | None:
     return None
 
 
-def cmd_list(_args) -> int:
-    apps = config.find_apps()
+def cmd_list(args) -> int:
+    if args.names:
+        for name in config.find_apps():
+            console.say(name)
+        return 0
+    apps = config.app_folders()
     if not apps:
         say_no_apps()
         return 0
     rows = []
     for name in apps:
+        enabled = "true" if config.is_enabled(name) else "false"
         try:
             app = config.merged_app(name)
             rows.append([name, app["schedule"] or "-",
-                         app["platform"].get("provider", "-")])
+                         app["platform"].get("provider", "-"), enabled])
         except ConfigError as e:
-            rows.append([name, "-", f"config error: {e}"])
-    console.table(["App", "Schedule", "Provider"], rows, ["bold cyan"])
+            rows.append([name, "-", f"config error: {e}", enabled])
+    console.table(["name", "schedule", "provider", "enabled"], rows, ["bold cyan"])
     return 0
 
 
@@ -145,21 +159,28 @@ def cmd_deploy(args) -> int:
     name = choose_app(args.app, "deploy")
     if name is None:
         return 1
-    return deploy.deploy(name, assume_yes=args.yes, profile=args.profile)
+    return deploy.deploy(name, assume_yes=args.yes)
 
 
 def cmd_login(args) -> int:
     name = choose_app(args.app, "login")
     if name is None:
         return 1
-    return deploy.login(name, profile=args.profile)
+    return deploy.login(name)
 
 
 def cmd_destroy(args) -> int:
     name = choose_app(args.app, "destroy")
     if name is None:
         return 1
-    return deploy.destroy(name, assume_yes=args.yes, profile=args.profile)
+    return deploy.destroy(name, assume_yes=args.yes)
+
+
+def cmd_secrets(args) -> int:
+    name = choose_app(args.app, "secrets")
+    if name is None:
+        return 1
+    return deploy.secrets(name, args.action, assume_yes=args.yes, name=args.name)
 
 
 def cmd_storage(args) -> int:
@@ -196,7 +217,10 @@ def build_parser() -> argparse.ArgumentParser:
                             help="which example to copy; run `pdt examples` to see them")
     source.completer = completion.examples
     p.set_defaults(func=cmd_new)
-    add_parser("list", help="show every app").set_defaults(func=cmd_list)
+    p = add_parser("list", help="show every app")
+    p.add_argument("--names", action="store_true",
+                   help="print only the name of each enabled app, one per line")
+    p.set_defaults(func=cmd_list)
     add_parser("validate", help="check config and env").set_defaults(func=cmd_validate)
     p = add_parser("run", help="run an app locally")
     app = p.add_argument("app", nargs="?",
@@ -208,24 +232,30 @@ def build_parser() -> argparse.ArgumentParser:
                          help="the app's folder name; omit to see the choices")
     app.completer = completion.apps
     p.add_argument("--yes", action="store_true", help="skip the confirmation prompt")
-    profile = p.add_argument("--profile", help="AWS profile name (AWS only)")
-    profile.completer = completion.profiles
     p.set_defaults(func=cmd_deploy)
     p = add_parser("login", help="sign in again to an app's cloud provider")
     app = p.add_argument("app", nargs="?",
                          help="the app's folder name; omit to see the choices")
     app.completer = completion.apps
-    profile = p.add_argument("--profile", help="AWS profile name (AWS only)")
-    profile.completer = completion.profiles
     p.set_defaults(func=cmd_login)
     p = add_parser("destroy", help="tear down an app's deployed resources")
     app = p.add_argument("app", nargs="?",
                          help="the app's folder name; omit to see the choices")
     app.completer = completion.apps
     p.add_argument("--yes", action="store_true", help="skip the confirmation prompt")
-    profile = p.add_argument("--profile", help="AWS profile name (AWS only)")
-    profile.completer = completion.profiles
     p.set_defaults(func=cmd_destroy)
+    p = add_parser("secrets", help="compare, send, or fetch a deployed app's .env values")
+    app = p.add_argument("app", nargs="?",
+                         help="the app's folder name; omit to see the choices")
+    app.completer = completion.apps
+    p.add_argument("action", nargs="?", choices=deploy_common.SECRET_ACTIONS, default="diff",
+                   help="diff shows what save would change (the default); "
+                        "save sends your .env values to the deployed app; "
+                        "get copies the deployed values into a file; "
+                        "set NAME puts one value, read from stdin, into the deployed app")
+    p.add_argument("name", nargs="?", help="the env var that set changes")
+    p.add_argument("--yes", action="store_true", help="skip the confirmation prompt")
+    p.set_defaults(func=cmd_secrets)
     p = add_parser("storage", help="read or manage an app's data store")
     app = p.add_argument("app", help="the app's folder name")
     app.completer = completion.apps