pyblastradius 0.3.0__tar.gz → 0.4.2__tar.gz

pyblastradius-0.4.2/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,62 @@
+name: Bug Report
+description: Report something in PyBlastRadius that is broken
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing: check README.md's "Known Issues" and
+        `ROADMAP_HONEST.md` — several discovery engines (Kubernetes,
+        Airflow, OpenTelemetry) and integrations are documented as
+        not-yet-implemented, not bugs.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to Reproduce
+      description: Minimal steps/code to reproduce the issue.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant Output / Traceback
+      render: shell
+
+  - type: input
+    id: version
+    attributes:
+      label: PyBlastRadius Version
+      placeholder: "e.g. 0.3.0 (pip show pyblastradius)"
+    validations:
+      required: true
+
+  - type: input
+    id: python-version
+    attributes:
+      label: Python Version
+      placeholder: "e.g. 3.11.6"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true

pyblastradius-0.4.2/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature Request
+description: Suggest something new for PyBlastRadius
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Check `ROADMAP_HONEST.md` first — your idea may already be listed
+        as a known gap (e.g. Kubernetes/Airflow discovery, a served GraphQL
+        endpoint, sending the already-built chat/incident-management
+        webhook payloads).
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Brief description of the feature.
+    validations:
+      required: true
+
+  - type: textarea
+    id: use-case
+    attributes:
+      label: Use Case
+      description: What problem does this solve for you?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: How should this work, if you have a specific idea?
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered

pyblastradius-0.4.2/.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  # Rust crate dependencies (Cargo.toml / Cargo.lock)
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # Python dependencies declared in pyproject.toml
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # GitHub Actions used in .github/workflows/*.yml and action.yml
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

pyblastradius-0.4.2/.github/pull_request_template.md

@@ -0,0 +1,28 @@
+## Description
+
+Brief summary of the change.
+
+## Related Issues
+
+Closes #
+
+## Testing
+
+- [ ] `cargo test --all-features` passes
+- [ ] `cargo clippy --all-targets -- -D warnings` passes
+- [ ] `cargo fmt -- --check` passes
+- [ ] If this touches `python/` or `src/python.rs`: `maturin develop --release`
+      then `pytest tests/ -q` passes
+- [ ] Added/updated tests for the change
+- [ ] Manually verified the change (describe how)
+
+## Honesty Checklist
+
+This repo's README/ROADMAP_HONEST.md distinguish tested-and-working from
+built-but-unverified from not-built. If this PR changes feature status:
+
+- [ ] Updated README.md's Features/Known Issues/Platform Support sections
+- [ ] Updated `ROADMAP_HONEST.md` if a bucketed item moved (built-not-tested
+      -> tested, not-built -> built, etc.)
+- [ ] Did not describe untested code as working, and did not use hedge
+      words ("planned", "may") for something that is simply not built

{pyblastradius-0.3.0 → pyblastradius-0.4.2}/.github/workflows/ci.yml

@@ -56,7 +56,12 @@ jobs:
           components: clippy
 
       - name: Run clippy
-        run: cargo clippy -- -D warnings
+        # --all-targets so this actually lints #[cfg(test)] code too --
+        # plain `cargo clippy` silently skips test targets, which is how 9
+        # real clippy errors (unused imports, len_zero) sat undetected in
+        # this repo's own test code until this pass caught them by running
+        # `cargo clippy --all-targets` locally.
+        run: cargo clippy --all-targets -- -D warnings
 
   fmt:
     name: Format
@@ -92,6 +97,21 @@ jobs:
         with:
           files: ./cobertura.xml
 
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run cargo audit
+        run: cargo audit
+
   build:
     name: Build
     runs-on: ${{ matrix.os }}
@@ -123,3 +143,49 @@ jobs:
         with:
           name: pyblastradius-${{ matrix.os }}
           path: target/release/pyblastradius*
+
+  # Lint gate for the Python package (PYBLASTRADIUS-003). Uses the curated
+  # ruleset in pyproject.toml ([tool.ruff.lint]); previously the repo had
+  # no Python lint at all.
+  python-lint:
+    name: Python Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install ruff
+        run: pip install "ruff>=0.5.0"
+
+      - name: Ruff
+        run: ruff check python/
+
+  # Python-side security scanning (Gemini review: only Rust had a
+  # continuous audit). Bandit for code patterns, pip-audit for dependency
+  # CVEs, both blocking.
+  python-security:
+    name: Python Security (bandit + pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install scanners
+        run: pip install "bandit>=1.7" "pip-audit>=2.7"
+
+      - name: Bandit
+        run: bandit -r python/ -ll
+
+      - name: pip-audit
+        run: pip-audit .

{pyblastradius-0.3.0 → pyblastradius-0.4.2}/.github/workflows/example-blast-radius.yml

@@ -17,7 +17,15 @@ jobs:
 
       - name: Run Blast Radius Analysis
         id: blast
-        uses: Mullassery/pyblastradius-action@v1
+        # `Mullassery/pyblastradius-action` does not exist (verified via
+        # authenticated `gh api repos/Mullassery/pyblastradius-action` ->
+        # 404 GraphQL resolution failure). This repo's own root action.yml
+        # *is* the composite action (see CONTRIBUTING.md / action.yml), so
+        # it's referenced directly here. Pinned to @main rather than a tag
+        # because this repo has no `v1` tag/release yet (only v0.1.0,
+        # v0.2.0 -- verified via `gh api .../tags` and `.../releases`);
+        # repin to a proper version tag once one exists.
+        uses: Mullassery/PyBlastRadius@main
         with:
           discovery-sources: |
             kubernetes://

{pyblastradius-0.3.0 → pyblastradius-0.4.2}/.github/workflows/publish.yml

@@ -87,7 +87,7 @@ jobs:
       - name: Flatten dist directory
         run: |
           mkdir -p final_dist
-          find dist -type f -name "*.whl" -o -name "*.tar.gz" | while read file; do
+          find dist -type f \( -name "*.whl" -o -name "*.tar.gz" \) | while read -r file; do
             cp "$file" final_dist/
           done
           ls -la final_dist/
@@ -113,7 +113,7 @@ jobs:
           path: artifacts/
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             artifacts/**/*.whl
@@ -135,9 +135,9 @@ jobs:
 
             ## Documentation
 
-            - [Quick Start](https://github.com/Mullassery/PyBlastRadius/blob/main/docs/QUICK_START.md)
-            - [Architecture](https://github.com/Mullassery/PyBlastRadius/blob/main/docs/ARCHITECTURE.md)
+            - [README](https://github.com/Mullassery/PyBlastRadius#readme) (Quick Start, Architecture, current status)
             - [Contributing](https://github.com/Mullassery/PyBlastRadius/blob/main/CONTRIBUTING.md)
+            - [Honest roadmap / known gaps](https://github.com/Mullassery/PyBlastRadius/blob/main/ROADMAP_HONEST.md)
 
             ## Support
 

{pyblastradius-0.3.0 → pyblastradius-0.4.2}/.gitignore

@@ -1,8 +1,11 @@
 # Rust
 /target
 **/*.rs.bk
-Cargo.lock
 *.pdb
+# Cargo.lock is intentionally committed (not ignored): this crate builds a
+# Python extension module + CLI (an application/product, not a pure
+# library), so pinning exact dependency versions makes builds and
+# `cargo audit` reproducible. See ROADMAP_HONEST.md.
 
 # Python
 __pycache__/
@@ -57,3 +60,5 @@ venv/
 # OS
 .DS_Store
 Thumbs.db
+
+graphify-out/

pyblastradius-0.4.2/.graphifyignore

@@ -0,0 +1,31 @@
+# Graphify ignore file - https://docs.graphify.com/reference/configuration
+# Keep the scan (and therefore the agent's graph) focused on real source.
+.git/
+.github/
+graphify-out/
+
+# Build output / artifacts
+target/
+dist/
+build/
+*.egg-info/
+node_modules/
+.venv/
+venv/
+env/
+
+# Caches
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+.coverage
+htmlcov/
+
+# Vendored / generated
+*.min.js
+*.min.css
+*.lock

pyblastradius-0.4.2/CHANGELOG.md

@@ -0,0 +1,249 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.2] - 2026-10-17
+
+### Fixed
+- Audit remediation: security hardening, correctness fixes, and lint/CI gates.
+
+## [0.4.1] - 2026-10-11
+
+### Fixed
+
+- `python/pyblastradius/integrations.py` referenced `Graph` in its type
+  annotations without importing it (`ruff` `F821`). A plain top-level import
+  would create a circular import because `pyblastradius/__init__.py`
+  re-exports names from this module, so `Graph` is now imported under
+  `typing.TYPE_CHECKING`. `import pyblastradius.integrations` now succeeds
+  cleanly.
+
+## [0.4.0] - 2026-10-05
+
+### Added
+
+- **Real Kubernetes and OTLP dependency discovery**, wired up the same way
+  Terraform was in v0.3.0. `src/python.rs` gained `PyKubernetesDiscoverer`
+  and `PyOtelDiscoverer`, exposing the real, already-tested Rust parsers
+  (`src/discovery/kubernetes.rs`, `src/discovery/otlp.rs`) — which existed
+  the whole time but were never registered in the `#[pymodule]` block, so
+  `pyblastradius.KubernetesDiscoverer`/`OtelDiscoverer` were separate,
+  disconnected pure-Python stubs that always returned an empty graph.
+  - `KubernetesDiscoverer` now parses real Service/Deployment/StatefulSet/
+    DaemonSet YAML and infers edges from container env var references.
+    `kubeconfig`/`context` are accepted for interface compatibility with
+    the old stub's constructor (and existing `blastradius.yml`/REST API
+    payloads) but have no effect — there's no live-cluster API client,
+    only local manifest parsing. If `manifests_dir` isn't given, the
+    conventional `k8s`/`kubernetes`/`.` directories are probed for the
+    first one that exists.
+  - `OtelDiscoverer` now runs a real OTLP/gRPC trace receiver bound to
+    `endpoint`, collecting whatever spans are actually pushed to it during
+    the collection window and deriving edges from real cross-service
+    parent/child span pairs. This is a semantic correction, not just a
+    wiring fix: the old stub's docstring said it would "connect to OTLP
+    collector," but the real implementation is itself a receiver —
+    `endpoint` must be a literal `ip:port` listen address, not a hostname
+    (the old `"localhost:4317"` default would fail to parse for exactly
+    this reason; the new default is `"0.0.0.0:4317"`). `discover()`
+    releases the GIL for the full blocking collection window, verified
+    with a concurrent-thread test rather than just a lack-of-crash check.
+  - `tests/test_discovery_bindings.py` (new, 7 tests) exercises both
+    against the real compiled `_core` extension: real manifest parsing,
+    real OTLP bind/timeout/empty-window behavior, and the
+    `kubeconfig`/`context`/`namespaces` interface-compat notes above.
+
+## [0.3.0] - 2026-08-26
+
+### Added
+
+- **Real Terraform dependency discovery.** `TerraformDiscoverer` now parses
+  `.tf` files with a real HCL2 parser (`hcl-rs`) instead of the previous
+  regex-based extraction (limited to 3 hardcoded AWS resource types, and
+  fooled by multi-line blocks, nested blocks, or comments containing
+  lookalike declarations). Any `resource "type" "name" { ... }` block is
+  discovered now, not just RDS/ElastiCache/ECS. Dependency *edges* are the
+  bigger fix: they previously came from a hardcoded example dependency
+  list (`api_gateway -> auth_service -> production`, etc.) that had
+  nothing to do with the actual `.tf` content being scanned -- edges are
+  now derived from real resource references found in each resource's own
+  attribute values, both bare traversals
+  (`aws_db_instance.production.endpoint`) and interpolated strings
+  (`"${aws_db_instance.production.endpoint}"`).
+- **`TerraformDiscoverer` is now reachable from Python at all.** The real
+  Rust implementation existed before this release but was never exposed
+  via pyo3 -- `pyblastradius.TerraformDiscoverer` (used by `cli.py`,
+  `config.py`, `server.py`) resolved to a pure-Python placeholder in
+  `pyblastradius/discovery.py` that walked matching files and discarded
+  their contents entirely (`# For now, just create mock nodes` / `pass`),
+  always returning an empty graph regardless of what `scan`'s
+  `terraform://` source pointed at. `pyblastradius/__init__.py` now
+  imports the real `_core` binding instead; the fake class has been
+  removed from `discovery.py`.
+- **`benches/large_graph.rs`**: real `criterion` benchmarks (graph
+  construction, `BlastRadiusAnalyzer::analyze`,
+  `CriticalityScorer::score_all`) on layered graphs up to 1,000 nodes with
+  realistic fan-out topology. `criterion`/`[profile.bench]` were declared
+  in `Cargo.toml` with a `// Benchmarks (add later)` comment, but no
+  `benches/` directory or `[[bench]]` target existed before this.
+
+## [0.2.1] - 2026-08-23
+
+### Fixed
+
+- `CriticalityScorer`: `criticality_score` was divided by 100 twice, collapsing the
+  documented 0-100 scale down to ~0-1. Fixed the double-division.
+- `CriticalityScorer::is_single_point_of_failure`: checked a node's *predecessor's*
+  out-degree instead of the node's own in-degree, producing false negatives on branching
+  topologies (a node with exactly one predecessor was missed as a SPOF if that predecessor
+  also happened to reach other nodes). Fixed to check in-degree directly; added a
+  regression test for the branching case.
+- `ColumnLineageTracker::track_column` split `"schema.table.column"` identifiers into only
+  their first and last dot-separated segments, discarding the middle table segment --
+  `find_downstream_impact()` could never match a real 3-part identifier as a result. Fixed
+  with `rsplit_once('.')`.
+- `test_hidden_dependency_detection`'s fixture graph never met
+  `detect_from_trace_gaps`'s own documented threshold (a node needs > 3 downstream
+  neighbors), so it asserted on an always-empty result regardless of whether detection
+  actually worked. Gave the fixture a graph that genuinely exercises the heuristic.
+- `test_blast_radius_analysis` picked its start node via `nodes[0]` after collecting
+  `graph.nodes()` (backed by a `HashMap`, whose iteration order isn't stable across
+  process runs) into a `Vec` -- flaky depending on which node landed at index 0. Now looks
+  up the intended node by name.
+- CI: replaced the archived `actions-rs/toolchain` action (broken/unmaintained) with
+  `dtolnay/rust-toolchain@stable` across all jobs; bumped `actions/checkout`,
+  `actions/cache`, `actions/upload-artifact`, and `codecov-action` to current major
+  versions; pinned Python 3.12 in the Build job (macos-latest's default python3 recently
+  became 3.14, which PyO3 0.23.5 rejects); marked the README's ASCII architecture diagram
+  as a `text` fence instead of an implicit (and invalid) Rust doctest.
+- `cargo fmt`/`cargo clippy -D warnings` had never actually run cleanly before (blocked by
+  the broken CI action above) -- fixed ~50 real warnings surfaced once they could run.
+
+No public API changes.
+
+## [Unreleased]
+
+### Fixed
+
+- **`action.yml` (the repo's own composite GitHub Action) was completely
+  non-functional; rewritten against the real Python API.** It called
+  `BlastRadiusAnalyzer(graph)` as a constructor (no `#[new]` exists on
+  `PyBlastRadiusAnalyzer` -- `analyze` is a staticmethod), `graph.services()`
+  (no such method on `Graph`), and `Graph.merge([graph, sub_graph])` as a
+  static call (the real `merge` is an instance method, `graph.merge(other)`,
+  mutating in place). It also used the deprecated `::set-output` command,
+  which GitHub Actions has disabled, so outputs silently never set even
+  before the API bugs. Separately, the top-level `outputs:` block referenced
+  `steps.analyze.outputs.*`, but the step with `id: analyze` was the
+  discovery step -- the step that actually set outputs was `id: pr_comment`
+  -- so outputs would have stayed unset even if every other bug were fixed.
+  Rewritten to call the real API (`BlastRadiusAnalyzer.analyze(graph,
+  node_id, max_depth=...)`, `graph.nodes()` filtered by `NodeType.Service`,
+  instance-method `graph.merge(other)`), write to `$GITHUB_OUTPUT`, and
+  renamed step ids so the output step is actually `id: analyze`. Verified
+  by extracting and running the exact embedded Python against a synthetic
+  Terraform fixture (multiple `aws_ecs_service`/`aws_lambda_function`/
+  `aws_db_instance` resources with cross-references) end-to-end, including
+  the failure-threshold pass/fail branches and the "no sources discovered"
+  and "invalid source URI" edge cases -- no exceptions, real scores/outputs
+  produced.
+- **`.github/workflows/example-blast-radius.yml`** referenced
+  `Mullassery/pyblastradius-action@v1`, a repo that does not exist (verified
+  via authenticated `gh api` -- GraphQL resolution failure, not just a
+  blocked-network false negative). Repointed to
+  `uses: Mullassery/PyBlastRadius@main`, since this repo's own root
+  `action.yml` *is* the composite action and there is no `v1` tag/release
+  yet (`gh api .../tags` shows only `v0.1.0`/`v0.2.0`) to pin to instead.
+- **`CONTRIBUTING.md`** referenced `src/bin/cli.rs` and `cargo run --
+  --version` in two places (Development Setup, "Adding a New Discovery
+  Engine"); both were removed from the crate when the CLI moved to
+  `python/pyblastradius/cli.py` (confirmed `cargo run` fails with "a bin
+  target must be available" -- no `[[bin]]` in `Cargo.toml`). Updated both
+  sections to describe the actual PyO3-binding + Python-CLI wiring path.
+- **`python/pyblastradius/__init__.py`**'s `__license__` still said
+  "Proprietary License" after the repo was relicensed to Apache-2.0
+  (`pyproject.toml`'s `license = "Apache-2.0"` and the root `LICENSE` file
+  already reflected it). Corrected to `"Apache-2.0"`.
+
+### Planned
+- ML-based failure prediction with anomaly consensus scoring
+- Neo4j backend for 100K+ node graphs
+- GraphQL Federation for multi-service deployments
+- Kubernetes Operator for continuous discovery
+- Helm chart for self-hosted deployment
+- Advanced hidden dependency detection (query logs, configuration mining)
+
+## [0.2.0] - 2026-08-05
+
+Real git tag (`v0.2.0`), dated from `git log`. No entry existed for this
+release before this pass; added from the verified commit history and the
+Project Status table in README.md rather than reconstructed from memory.
+
+### Added
+- First working `pyblastradius._core` PyO3 extension module — end-to-end
+  `import pyblastradius` against real compiled Rust code, not a pure-Python
+  placeholder.
+- Real end-to-end analysis via the extension: `Graph`/`Node`/`Edge`,
+  `BlastRadiusAnalyzer`, `CriticalityScorer`, `Simulator`.
+
+### Known limitations as of this release
+Discovery engines (Kubernetes, Airflow, OTel) were not implemented yet —
+see Platform Support in README.md for current status of each.
+
+## [0.1.0] - 2026-08-05
+
+Real git tag (`v0.1.0`), dated from `git log`.
+
+**This entry was originally written before implementation started and
+described intended v1.0 scope, not what had actually shipped** — it listed
+a GraphQL API, Slack/PagerDuty integrations, and full Kubernetes/Airflow/
+OpenTelemetry discovery as "Added" in this release. None of that was true
+at the time and, per README.md's Known Issues (verified 2026-09-19), most
+of it (Kubernetes/Airflow/OTel discovery, the GraphQL endpoint, and sending
+actual Slack/PagerDuty webhooks) is still not implemented today, several
+releases later. Corrected below to only what the actual `v0.1.0` git tag's
+codebase supports; see README.md for the authoritative current-state
+breakdown of every feature.
+
+### Added
+- Initial project scaffold: Rust workspace, `petgraph`-based graph model
+  (node/edge types, properties), graph traversal (BFS/DFS/topological
+  sort), JSON/GraphML/Dot serialization.
+- Early-stage discovery, analysis, and integration code for Kubernetes,
+  Terraform, Airflow, OTel, GraphQL, Slack/PagerDuty, and dbt/StatGuardian
+  — present in the codebase from this point on, but not wired up to real
+  parsing/live data/Python bindings until later releases (Terraform in
+  v0.3.0, the Python extension module itself in v0.2.0). Treat this as
+  "code exists" not "feature works" — see README.md Known Issues for what
+  is real today.
+- CI/CD scaffold (GitHub Actions), example configs, initial docs.
+
+---
+
+## Release Checklist
+
+When preparing a new release:
+
+- [ ] Update version in `Cargo.toml`, `pyproject.toml`, and `__init__.py`
+- [ ] Update this `CHANGELOG.md` with new section
+- [ ] Ensure all tests pass (`cargo test`)
+- [ ] Run code quality checks (`cargo clippy`, `cargo fmt`)
+- [ ] Create git tag: `git tag -a v0.1.0 -m "Release v0.1.0"`
+- [ ] Push tag: `git push origin v0.1.0`
+- [ ] Verify wheels built and published on PyPI
+- [ ] Verify release created on GitHub with artifacts
+
+---
+
+## Links
+
+- [Documentation](https://github.com/Mullassery/PyBlastRadius/blob/main/docs/)
+- [GitHub Issues](https://github.com/Mullassery/PyBlastRadius/issues)
+- [PyPI Package](https://pypi.org/project/pyblastradius/)
+
+---
+
+**Note**: This project follows Semantic Versioning. For updates and feature requests, see [Contributing](CONTRIBUTING.md).