pywrit 0.1.6__tar.gz → 0.1.7__tar.gz

{pywrit-0.1.6/pywrit.egg-info → pywrit-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.6
+Version: 0.1.7
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.6 → pywrit-0.1.7}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 # Distribution name: pywrit (approved by Chad 2026-09-27).
 # The bare name "writ" is taken on PyPI.
 name = "pywrit"
-version = "0.1.6"
+version = "0.1.7"
 description = "Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log"
 readme = "README.md"
 requires-python = ">=3.9"

{pywrit-0.1.6 → pywrit-0.1.7/pywrit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.1.6
+Version: 0.1.7
 Summary: Writ — the gate before the write. Allow/deny gate with a tamper-evident audit log
 Project-URL: Homepage, https://withwrit.com
 Project-URL: Documentation, https://docs.withwrit.com

{pywrit-0.1.6 → pywrit-0.1.7}/writ_cli/cli.py

@@ -11035,6 +11035,15 @@ def scan_cmd(args):
         mpath = _pathlib.Path(args.manifest_out)
         mpath.write_text(_json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
         print("  manifest written: %s" % mpath)
+        if getattr(args, "push_manifest", False):
+            if not args.key:
+                print("error: --push-manifest needs --key", file=sys.stderr)
+                return 2
+            code, text = request("POST", "/v1/manifests", manifest, key=args.key)
+            if code != 0:
+                print(text, file=sys.stderr)
+                return code
+            print("  manifest submitted: %s" % text)
 
     if getattr(args, "push_policy", False):
         if not args.key:
@@ -11242,6 +11251,13 @@ def _require_sponsor_token(token):
     return True
 
 
+def _load_json_file(path):
+    p = _pathlib.Path(path)
+    if not p.exists():
+        raise FileNotFoundError("file not found: %s" % path)
+    return json.loads(p.read_text(encoding="utf-8"))
+
+
 # ---------------------------------------------------------------------------
 # Agent Action Report
 # ---------------------------------------------------------------------------
@@ -11640,6 +11656,8 @@ def main():
                       help="API key (for --push-policy / --manifest-out)")
     scan.add_argument("--manifest-out", default="",
                       help="Write a signed CI attestation manifest to PATH")
+    scan.add_argument("--push-manifest", action="store_true",
+                      help="After writing --manifest-out, POST the signed manifest to the gate (needs --key)")
     scan.add_argument("--manifest-key", default=os.environ.get("WRIT_MANIFEST_KEY", ""),
                       help="HMAC key for signing the manifest (default: WRIT_MANIFEST_KEY env)")
     scan.add_argument("--commit-sha", default="",
@@ -11662,6 +11680,44 @@ def main():
     manifest_key = sub.add_parser("manifest-key", help="Fetch the tenant's CI manifest HMAC key")
     manifest_key.add_argument("--key", default=config.api_key())
 
+    manifests = sub.add_parser("manifests", help="List, fetch, or submit CI attestation manifests")
+    manifests_sub = manifests.add_subparsers(dest="manifests_cmd", required=True)
+    ms_list = manifests_sub.add_parser("list", help="List repos with their latest manifest summary")
+    ms_list.add_argument("--key", default=config.api_key())
+    ms_get = manifests_sub.add_parser("get", help="Fetch the full manifest + drift for a repo")
+    ms_get.add_argument("repo_id")
+    ms_get.add_argument("--key", default=config.api_key())
+    ms_push = manifests_sub.add_parser("push", help="Submit a signed manifest produced by `writ scan --manifest-out`")
+    ms_push.add_argument("file")
+    ms_push.add_argument("--key", default=config.api_key())
+
+    github = sub.add_parser("github", help="Manage the Writ GitHub App integration")
+    github_sub = github.add_subparsers(dest="github_cmd", required=True)
+    gh_inst = github_sub.add_parser("installations", help="List connected installations")
+    gh_inst.add_argument("--key", default=config.api_key())
+    gh_repos = github_sub.add_parser("repos", help="List repos and latest scan summaries")
+    gh_repos.add_argument("--key", default=config.api_key())
+    gh_repo = github_sub.add_parser("repo", help="Get a repo's latest findings")
+    gh_repo.add_argument("repo_id")
+    gh_repo.add_argument("--key", default=config.api_key())
+    gh_thresh = github_sub.add_parser("threshold", help="Set/clear the per-installation check-run fail threshold")
+    gh_thresh.add_argument("installation_id")
+    gh_thresh.add_argument("threshold", nargs="?", default=None,
+                           help="Ungated count that flips the check run to failure; omit to clear")
+    gh_thresh.add_argument("--key", default=config.api_key())
+    gh_pc = github_sub.add_parser("pr-comments", help="Enable or disable PR comments for an installation")
+    gh_pc.add_argument("installation_id")
+    gh_pc.add_argument("enabled", choices=["on", "off"])
+    gh_pc.add_argument("--key", default=config.api_key())
+    gh_rescan = github_sub.add_parser("rescan", help="Rescan a repository now")
+    gh_rescan.add_argument("repo_id")
+    gh_rescan.add_argument("--totp-code", default="", help="TOTP step-up code")
+    gh_rescan.add_argument("--key", default=config.api_key())
+    gh_disc = github_sub.add_parser("disconnect", help="Disconnect a GitHub App installation")
+    gh_disc.add_argument("installation_id")
+    gh_disc.add_argument("--totp-code", default="", help="TOTP step-up code")
+    gh_disc.add_argument("--key", default=config.api_key())
+
     args = parser.parse_args()
     if args.cmd == "key":
         payload = {"email": args.email}
@@ -11707,7 +11763,8 @@ def main():
         return 0
 
     _KEY_COMMANDS = {"me", "policy", "check", "receipts", "stream",
-                     "verify-chain", "invite", "token-verify", "manifest-key"}
+                     "verify-chain", "invite", "token-verify", "manifest-key",
+                     "manifests", "github"}
     if args.cmd in _KEY_COMMANDS and not _require_key(args.key):
         return 2
 
@@ -11759,6 +11816,39 @@ def main():
         return report_cmd(args)
     if args.cmd == "manifest-key":
         return _request_and_print("GET", "/v1/manifest-key", key=args.key)
+    if args.cmd == "manifests":
+        if args.manifests_cmd == "list":
+            return _request_and_print("GET", "/v1/manifests", key=args.key)
+        if args.manifests_cmd == "get":
+            return _request_and_print("GET", "/v1/manifests/" + urllib.parse.quote(args.repo_id, safe=""), key=args.key)
+        if args.manifests_cmd == "push":
+            try:
+                payload = _load_json_file(args.file)
+            except (FileNotFoundError, ValueError) as exc:
+                print("error: %s" % exc, file=sys.stderr)
+                return 2
+            return _request_and_print("POST", "/v1/manifests", payload, key=args.key)
+    if args.cmd == "github":
+        if args.github_cmd == "installations":
+            return _request_and_print("GET", "/v1/github/installations", key=args.key)
+        if args.github_cmd == "repos":
+            return _request_and_print("GET", "/v1/github/repos", key=args.key)
+        if args.github_cmd == "repo":
+            return _request_and_print("GET", "/v1/github/repos/" + urllib.parse.quote(args.repo_id, safe=""), key=args.key)
+        if args.github_cmd == "threshold":
+            body = {"installationId": args.installation_id}
+            if args.threshold is not None:
+                body["threshold"] = int(args.threshold)
+            return _request_and_print("POST", "/v1/github/check-fail-threshold", body, key=args.key)
+        if args.github_cmd == "pr-comments":
+            return _request_and_print("POST", "/v1/github/pr-comments",
+                {"installationId": args.installation_id, "enabled": args.enabled == "on"}, key=args.key)
+        if args.github_cmd == "rescan":
+            return _request_and_print("POST", "/v1/github/repos/" + urllib.parse.quote(args.repo_id, safe="") + "/rescan",
+                {"totpCode": args.totp_code}, key=args.key)
+        if args.github_cmd == "disconnect":
+            return _request_and_print("POST", "/v1/github/disconnect",
+                {"installationId": args.installation_id, "totpCode": args.totp_code}, key=args.key)
     if args.cmd in ("revoke", "reinstate", "revoked"):
         if not _require_sponsor_token(args.sponsor_token):
             return 2