qontract-reconcile 0.9.1rc162__py3-none-any.whl → 0.9.1rc164__py3-none-any.whl

reconcile/utils/{saasherder/saasherder.py → saasherder.py}

@@ -13,11 +13,12 @@ from collections.abc import (
     Sequence,
 )
 from contextlib import suppress
+from dataclasses import dataclass
 from typing import (
     Any,
-    Generator,
     Optional,
     Union,
+    cast,
 )
 
 import yaml
@@ -25,8 +26,6 @@ from github import (
     Github,
     GithubException,
 )
-from github.ContentFile import ContentFile
-from github.Repository import Repository
 from gitlab.exceptions import GitlabError
 from requests import exceptions as rqexc
 from sretoolbox.container import Image
@@ -37,10 +36,8 @@ from sretoolbox.utils import (
 
 from reconcile.github_org import get_default_config
 from reconcile.status import RunningState
-from reconcile.utils.gitlab_api import GitLabApi
-from reconcile.utils.jenkins_api import JenkinsApi
 from reconcile.utils.jjb_client import JJB
-from reconcile.utils.mr.base import MRClient
+from reconcile.utils.mr.auto_promoter import AutoPromoter
 from reconcile.utils.oc import (
     OCLocal,
     StatusCodeError,
@@ -51,47 +48,118 @@ from reconcile.utils.openshift_resource import (
     ResourceKeyExistsError,
     fully_qualified_kind,
 )
-from reconcile.utils.saasherder.interfaces import (
-    HasParameters,
-    HasSecretParameters,
-    SaasFile,
-    SaasParentSaasPromotion,
-    SaasResourceTemplate,
-    SaasResourceTemplateTarget,
-    SaasResourceTemplateTargetNamespace,
-    SaasResourceTemplateTargetPromotion,
-    SaasSecretParameters,
-)
-from reconcile.utils.saasherder.models import (
-    ImageAuth,
-    Namespace,
-    Promotion,
-    TargetSpec,
-    TriggerSpecConfig,
-    TriggerSpecContainerImage,
-    TriggerSpecMovingCommit,
-    TriggerSpecUnion,
-    TriggerSpecUpstreamJob,
-    TriggerTypes,
-    UpstreamJob,
-)
-from reconcile.utils.secret_reader import SecretReaderBase
-from reconcile.utils.state import State
+from reconcile.utils.secret_reader import SecretReader
+from reconcile.utils.state import init_state
 
 TARGET_CONFIG_HASH = "target_config_hash"
 
 
-UNIQUE_SAAS_FILE_ENV_COMBO_LEN = 50
+class Providers:
+    TEKTON = "tekton"
+
+
+class TriggerTypes:
+    CONFIGS = 0
+    MOVING_COMMITS = 1
+    UPSTREAM_JOBS = 2
+    CONTAINER_IMAGES = 3
+
+
+@dataclass
+class UpstreamJob:
+    instance: str
+    job: str
+
+    def __str__(self):
+        return f"{self.instance}/{self.job}"
 
+    def __repr__(self):
+        return self.__str__()
 
-def is_commit_sha(ref: str) -> bool:
-    """Check if the given ref is a commit sha."""
-    return bool(re.search(r"^[0-9a-f]{40}$", ref))
 
+@dataclass
+class TriggerSpecBase:
+    saas_file_name: str
+    env_name: str
+    timeout: Optional[str]
+    pipelines_provider: Optional[dict[str, Any]]
+    resource_template_name: str
+    cluster_name: str
+    namespace_name: str
+    state_content: Any
+
+    @property
+    def state_key(self):
+        raise NotImplementedError("implement this function in inheriting classes")
+
+
+@dataclass
+class TriggerSpecConfig(TriggerSpecBase):
+    target_name: Optional[str] = None
+    reason: Optional[str] = None
+
+    @property
+    def state_key(self):
+        key = (
+            f"{self.saas_file_name}/{self.resource_template_name}/{self.cluster_name}/"
+            f"{self.namespace_name}/{self.env_name}"
+        )
+        if self.target_name:
+            key += f"/{self.target_name}"
+        return key
+
+
+@dataclass
+class TriggerSpecMovingCommit(TriggerSpecBase):
+    ref: str
+    reason: Optional[str] = None
+
+    @property
+    def state_key(self):
+        key = (
+            f"{self.saas_file_name}/{self.resource_template_name}/{self.cluster_name}/"
+            f"{self.namespace_name}/{self.env_name}/{self.ref}"
+        )
+        return key
 
-RtRef = tuple[str, str, str]
-Resource = dict[str, Any]
-Resources = list[Resource]
+
+@dataclass
+class TriggerSpecUpstreamJob(TriggerSpecBase):
+    instance_name: str
+    job_name: str
+    reason: Optional[str] = None
+
+    @property
+    def state_key(self):
+        key = (
+            f"{self.saas_file_name}/{self.resource_template_name}/{self.cluster_name}/"
+            f"{self.namespace_name}/{self.env_name}/{self.instance_name}/{self.job_name}"
+        )
+        return key
+
+
+@dataclass
+class TriggerSpecContainerImage(TriggerSpecBase):
+    image: str
+    reason: Optional[str] = None
+
+    @property
+    def state_key(self):
+        key = (
+            f"{self.saas_file_name}/{self.resource_template_name}/{self.cluster_name}/"
+            f"{self.namespace_name}/{self.env_name}/{self.image}"
+        )
+        return key
+
+
+TriggerSpecUnion = Union[
+    TriggerSpecConfig,
+    TriggerSpecMovingCommit,
+    TriggerSpecUpstreamJob,
+    TriggerSpecContainerImage,
+]
+
+UNIQUE_SAAS_FILE_ENV_COMBO_LEN = 50
 
 
 class SaasHerder:
@@ -99,18 +167,16 @@ class SaasHerder:
 
     def __init__(
         self,
-        saas_files: Sequence[SaasFile],
-        thread_pool_size: int,
-        integration: str,
-        integration_version: str,
-        secret_reader: SecretReaderBase,
-        hash_length: int,
-        repo_url: str,
-        gitlab: Optional[GitLabApi] = None,
-        jenkins_map: Optional[dict[str, JenkinsApi]] = None,
-        state: Optional[State] = None,
-        validate: bool = False,
-        include_trigger_trace: bool = False,
+        saas_files,
+        thread_pool_size,
+        gitlab,
+        integration,
+        integration_version,
+        settings,
+        jenkins_map=None,
+        initialise_state=False,
+        validate=False,
+        include_trigger_trace=False,
     ):
         self.error_registered = False
         self.saas_files = saas_files
@@ -123,14 +189,11 @@ class SaasHerder:
         self.gitlab = gitlab
         self.integration = integration
         self.integration_version = integration_version
-        self.hash_length = hash_length
-        self.repo_url = repo_url
-        self.secret_reader = secret_reader
+        self.settings = settings
+        self.secret_reader = SecretReader(settings=settings)
         self.namespaces = self._collect_namespaces()
         self.jenkins_map = jenkins_map
         self.include_trigger_trace = include_trigger_trace
-        self.state = state
-
         # each namespace is in fact a target,
         # so we can use it to calculate.
         divisor = len(self.namespaces) or 1
@@ -141,40 +204,31 @@ class SaasHerder:
         # specify that it manages resources exclusively.
         self.take_over = self._get_saas_file_feature_enabled("takeover")
         self.compare = self._get_saas_file_feature_enabled("compare", default=True)
-        self.publish_job_logs = self._get_saas_file_feature_enabled("publish_job_logs")
-        self.cluster_admin = self._get_saas_file_feature_enabled("cluster_admin")
+        self.publish_job_logs = self._get_saas_file_feature_enabled("publishJobLogs")
+        self.cluster_admin = self._get_saas_file_feature_enabled("clusterAdmin")
+        if initialise_state:
+            self.state = init_state(integration=self.integration)
 
-    def _register_error(self) -> None:
+    def _register_error(self):
         self.error_registered = True
 
     @property
-    def has_error_registered(self) -> bool:
+    def has_error_registered(self):
         return self.error_registered
 
-    def __iter__(
-        self,
-    ) -> Generator[
-        tuple[SaasFile, SaasResourceTemplate, SaasResourceTemplateTarget],
-        None,
-        None,
-    ]:
+    def __iter__(self):
         for saas_file in self.saas_files:
-            for resource_template in saas_file.resource_templates:
-                for target in resource_template.targets:
+            for resource_template in saas_file["resourceTemplates"]:
+                for target in resource_template["targets"]:
                     yield (saas_file, resource_template, target)
 
-    def _get_saas_file_feature_enabled(
-        self, name: str, default: Optional[bool] = None
-    ) -> Optional[bool]:
+    def _get_saas_file_feature_enabled(self, name, default=None):
         """Returns a bool indicating if a feature is enabled in a saas file,
         or a supplied default. Returns False if there are multiple
         saas files in the process.
         All features using this method should assume a single saas file.
         """
-        if len(self.saas_files) > 1:
-            return False
-
-        sf_attribute = getattr(self.saas_files[0], name, None)
+        sf_attribute = len(self.saas_files) == 1 and self.saas_files[0].get(name)
         if sf_attribute is None and default is not None:
             return default
         return sf_attribute
@@ -182,7 +236,7 @@ class SaasHerder:
     def _validate_allowed_secret_parameter_paths(
         self,
         saas_file_name: str,
-        secret_parameters: SaasSecretParameters,
+        secret_parameters: Sequence[Mapping[str, Any]],
         allowed_secret_parameter_paths: Sequence[str],
     ) -> None:
         if not secret_parameters:
@@ -194,139 +248,149 @@ class SaasHerder:
             )
             return
         for sp in secret_parameters:
+            path = sp["secret"]["path"]
             match = [
                 a
                 for a in allowed_secret_parameter_paths
-                if (os.path.commonpath([sp.secret.path, a]) == a)
+                if (os.path.commonpath([path, a]) == a)
             ]
             if not match:
                 self.valid = False
                 logging.error(
                     f"[{saas_file_name}] "
-                    f"secret parameter path '{sp.secret.path}' does not match any of allowedSecretParameterPaths"
+                    f"secret parameter path '{path}' does not match any of allowedSecretParameterPaths"
                 )
 
-    def _validate_saas_files(self) -> None:
+    def _validate_saas_files(self):
         self.valid = True
-        saas_file_name_path_map: dict[str, list[str]] = {}
-        tkn_unique_pipelineruns: dict[str, str] = {}
+        saas_file_name_path_map = {}
+        self.tkn_unique_pipelineruns = {}
 
-        publications: dict[str, RtRef] = {}
-        subscriptions: dict[str, list[RtRef]] = {}
+        publications = {}
+        subscriptions = {}
 
         for saas_file in self.saas_files:
-            saas_file_name_path_map.setdefault(saas_file.name, [])
-            saas_file_name_path_map[saas_file.name].append(saas_file.path)
+            saas_file_name = saas_file["name"]
+            saas_file_path = saas_file["path"]
+            saas_file_name_path_map.setdefault(saas_file_name, [])
+            saas_file_name_path_map[saas_file_name].append(saas_file_path)
 
             saas_file_owners = [
-                u.org_username
-                for r in saas_file.self_service_roles or []
-                for u in list(r.users) + list(r.bots)
+                u["org_username"]
+                for r in saas_file["selfServiceRoles"]
+                for u in r["users"] + r["bots"]
             ]
             if not saas_file_owners:
-                logging.error(
-                    f"saas file {saas_file.name} has no owners: {saas_file.path}"
-                )
+                msg = "saas file {} has no owners: {}"
+                logging.error(msg.format(saas_file_name, saas_file_path))
                 self.valid = False
 
+            allowed_secret_parameter_paths = (
+                saas_file.get("allowedSecretParameterPaths") or []
+            )
             self._validate_allowed_secret_parameter_paths(
-                saas_file.name,
-                saas_file.secret_parameters or [],
-                saas_file.allowed_secret_parameter_paths or [],
+                saas_file_name,
+                saas_file.get("secretParameters"),
+                allowed_secret_parameter_paths,
             )
 
-            for resource_template in saas_file.resource_templates:
+            for resource_template in saas_file["resourceTemplates"]:
+                resource_template_name = resource_template["name"]
+                resource_template_url = resource_template["url"]
                 self._validate_allowed_secret_parameter_paths(
-                    saas_file.name,
-                    resource_template.secret_parameters or [],
-                    saas_file.allowed_secret_parameter_paths or [],
+                    saas_file_name,
+                    resource_template.get("secretParameters"),
+                    allowed_secret_parameter_paths,
                 )
-                for target in resource_template.targets:
+                for target in resource_template["targets"]:
+                    target_namespace = target["namespace"]
+                    namespace_name = target_namespace["name"]
+                    cluster_name = target_namespace["cluster"]["name"]
+                    environment = target_namespace["environment"]
+                    environment_name = environment["name"]
                     # unique saas file and env name combination
-                    tkn_name, tkn_long_name = self._check_saas_file_env_combo_unique(
-                        saas_file.name,
-                        target.namespace.environment.name,
-                        tkn_unique_pipelineruns,
+                    self._check_saas_file_env_combo_unique(
+                        saas_file_name, environment_name
                     )
-                    tkn_unique_pipelineruns[tkn_name] = tkn_long_name
                     self._validate_auto_promotion_used_with_commit_sha(
-                        saas_file.name,
-                        resource_template.name,
+                        saas_file_name,
+                        resource_template_name,
                         target,
                     )
                     self._validate_upstream_not_used_with_commit_sha(
-                        saas_file.name,
-                        resource_template.name,
+                        saas_file_name,
+                        resource_template_name,
                         target,
                     )
                     self._validate_upstream_not_used_with_image(
-                        saas_file.name,
-                        resource_template.name,
+                        saas_file_name,
+                        resource_template_name,
                         target,
                     )
                     self._validate_image_not_used_with_commit_sha(
-                        saas_file.name,
-                        resource_template.name,
+                        saas_file_name,
+                        resource_template_name,
                         target,
                     )
                     self._validate_allowed_secret_parameter_paths(
-                        saas_file.name,
-                        target.secret_parameters or [],
-                        saas_file.allowed_secret_parameter_paths or [],
+                        saas_file_name,
+                        target.get("secretParameters"),
+                        allowed_secret_parameter_paths,
                     )
                     self._validate_allowed_secret_parameter_paths(
-                        saas_file.name,
-                        target.namespace.environment.secret_parameters or [],
-                        saas_file.allowed_secret_parameter_paths or [],
+                        saas_file_name,
+                        environment.get("secretParameters"),
+                        allowed_secret_parameter_paths,
                     )
 
-                    if target.promotion:
+                    promotion = target.get("promotion")
+                    if promotion:
                         rt_ref = (
-                            saas_file.path,
-                            resource_template.name,
-                            resource_template.url,
+                            saas_file_path,
+                            resource_template_name,
+                            resource_template_url,
                         )
 
                         # Get publications and subscriptions for the target
                         self._get_promotion_pubs_and_subs(
-                            rt_ref, target.promotion, publications, subscriptions
+                            rt_ref, promotion, publications, subscriptions
                         )
                     # validate target parameters
-                    if not target.parameters:
+                    target_parameters = target["parameters"]
+                    if not target_parameters:
                         continue
+                    target_parameters = json.loads(target_parameters)
                     self._validate_image_tag_not_equals_ref(
-                        saas_file.name,
-                        resource_template.name,
-                        target.ref,
-                        target.parameters,
+                        saas_file_name,
+                        resource_template_name,
+                        target["ref"],
+                        target_parameters,
                     )
-
-                    if not target.namespace.environment.parameters:
+                    environment_parameters = environment["parameters"]
+                    if not environment_parameters:
                         continue
+                    environment_parameters = json.loads(environment_parameters)
                     msg = (
-                        f"[{saas_file.name}/{resource_template.name}] "
+                        f"[{saas_file_name}/{resource_template_name}] "
                         + "parameter found in target "
-                        + f"{target.namespace.cluster.name}/{target.namespace.name} "
-                        + f"should be reused from env {target.namespace.environment.name}"
+                        + f"{cluster_name}/{namespace_name} "
+                        + f"should be reused from env {environment_name}"
                     )
-                    for t_key, t_value in target.parameters.items():
+                    for t_key, t_value in target_parameters.items():
                         if not isinstance(t_value, str):
                             continue
                         # Check for recursivity. Ex: PARAM: "foo.${PARAM}"
                         replace_pattern = "${" + t_key + "}"
                         if replace_pattern in t_value:
                             logging.error(
-                                f"[{saas_file.name}/{resource_template.name}] "
+                                f"[{saas_file_name}/{resource_template_name}] "
                                 f"recursivity in parameter name and value "
                                 f'found: {t_key}: "{t_value}" - this will '
                                 f"likely not work as expected. Please consider"
                                 f" changing the parameter name"
                             )
                             self.valid = False
-                        for (
-                            e_key,
-                            e_value,
-                        ) in target.namespace.environment.parameters.items():
+                        for e_key, e_value in environment_parameters.items():
                             if not isinstance(e_value, str):
                                 continue
                             if "." not in e_value:
@@ -363,16 +427,17 @@ class SaasHerder:
 
     def _get_promotion_pubs_and_subs(
         self,
-        rt_ref: RtRef,
-        promotion: SaasResourceTemplateTargetPromotion,
-        publications: MutableMapping[str, RtRef],
-        subscriptions: MutableMapping[str, list[RtRef]],
-    ) -> None:
+        rt_ref: tuple,
+        promotion: dict[str, Any],
+        publications: MutableMapping[str, tuple],
+        subscriptions: MutableMapping[str, list[tuple]],
+    ):
         """
         Function to gather promotion publish and subscribe configurations
         It validates a publish channel is unique across all publish targets.
         """
-        for channel in promotion.publish or []:
+        publish = promotion.get("publish") or []
+        for channel in publish:
             if channel in publications:
                 self.valid = False
                 logging.error(
@@ -382,14 +447,15 @@ class SaasHerder:
                 continue
             publications[channel] = rt_ref
 
-        for channel in promotion.subscribe or []:
+        subscribe = promotion.get("subscribe") or []
+        for channel in subscribe:
             subscriptions.setdefault(channel, [])
             subscriptions[channel].append(rt_ref)
 
     def _check_promotions_have_same_source(
         self,
-        subscriptions: Mapping[str, list[RtRef]],
-        publications: Mapping[str, RtRef],
+        subscriptions: Mapping[str, list[tuple]],
+        publications: Mapping[str, tuple],
     ) -> None:
         """
         Function to check that a promotion has the same repository
@@ -432,20 +498,15 @@ class SaasHerder:
                             )
                         )
 
-    def _check_saas_file_env_combo_unique(
-        self,
-        saas_file_name: str,
-        env_name: str,
-        tkn_unique_pipelineruns: Mapping[str, str],
-    ) -> tuple[str, str]:
+    def _check_saas_file_env_combo_unique(self, saas_file_name, env_name):
         # max tekton pipelinerun name length can be 63.
         # leaving 12 for the timestamp leaves us with 51
         # to create a unique pipelinerun name
         tkn_long_name = f"{saas_file_name}-{env_name}"
         tkn_name = tkn_long_name[:UNIQUE_SAAS_FILE_ENV_COMBO_LEN]
         if (
-            tkn_name in tkn_unique_pipelineruns
-            and tkn_unique_pipelineruns[tkn_name] != tkn_long_name
+            tkn_name in self.tkn_unique_pipelineruns
+            and self.tkn_unique_pipelineruns[tkn_name] != tkn_long_name
         ):
             logging.error(
                 f"[{saas_file_name}/{env_name}] "
@@ -455,48 +516,60 @@ class SaasHerder:
                 f"from this long name: {tkn_long_name}"
             )
             self.valid = False
-
-        return tkn_name, tkn_long_name
+        else:
+            self.tkn_unique_pipelineruns[tkn_name] = tkn_long_name
 
     def _validate_auto_promotion_used_with_commit_sha(
         self,
         saas_file_name: str,
         resource_template_name: str,
-        target: SaasResourceTemplateTarget,
-    ) -> None:
-        if not target.promotion:
+        target: dict,
+    ):
+        target_promotion = target.get("promotion") or {}
+        if not target_promotion:
             return
 
-        if not target.promotion.auto:
+        target_auto = target_promotion.get("auto")
+        if not target_auto:
             return
 
-        if not is_commit_sha(target.ref):
-            self.valid = False
-            logging.error(
-                f"[{saas_file_name}/{resource_template_name}] "
-                f"auto promotion should be used with commit sha instead of: {target.ref}"
-            )
+        pattern = r"^[0-9a-f]{40}$"
+        ref = target["ref"]
+        if re.search(pattern, ref):
+            return
+
+        self.valid = False
+        logging.error(
+            f"[{saas_file_name}/{resource_template_name}] "
+            f"auto promotion should be used with commit sha instead of: {ref}"
+        )
 
     def _validate_upstream_not_used_with_commit_sha(
         self,
         saas_file_name: str,
         resource_template_name: str,
-        target: SaasResourceTemplateTarget,
-    ) -> None:
-        if target.upstream and is_commit_sha(target.ref):
-            logging.error(
-                f"[{saas_file_name}/{resource_template_name}] "
-                f"upstream used with commit sha: {target.ref}"
-            )
-            self.valid = False
+        target: dict,
+    ):
+        upstream = target.get("upstream")
+        if upstream:
+            pattern = r"^[0-9a-f]{40}$"
+            ref = target["ref"]
+            if re.search(pattern, ref):
+                logging.error(
+                    f"[{saas_file_name}/{resource_template_name}] "
+                    f"upstream used with commit sha: {ref}"
+                )
+                self.valid = False
 
     def _validate_upstream_not_used_with_image(
         self,
         saas_file_name: str,
         resource_template_name: str,
-        target: SaasResourceTemplateTarget,
-    ) -> None:
-        if target.image and target.upstream:
+        target: dict,
+    ):
+        upstream = target.get("upstream")
+        image = target.get("image")
+        if image and upstream:
             logging.error(
                 f"[{saas_file_name}/{resource_template_name}] "
                 f"image used with upstream"
@@ -507,14 +580,18 @@ class SaasHerder:
         self,
         saas_file_name: str,
         resource_template_name: str,
-        target: SaasResourceTemplateTarget,
-    ) -> None:
-        if target.image and is_commit_sha(target.ref):
-            logging.error(
-                f"[{saas_file_name}/{resource_template_name}] "
-                f"image used with commit sha: {target.ref}"
-            )
-            self.valid = False
+        target: dict,
+    ):
+        image = target.get("image")
+        if image:
+            pattern = r"^[0-9a-f]{40}$"
+            ref = target["ref"]
+            if re.search(pattern, ref):
+                logging.error(
+                    f"[{saas_file_name}/{resource_template_name}] "
+                    f"image used with commit sha: {ref}"
+                )
+                self.valid = False
 
     def _validate_image_tag_not_equals_ref(
         self,
@@ -522,7 +599,7 @@ class SaasHerder:
         resource_template_name: str,
         ref: str,
         parameters: dict,
-    ) -> None:
+    ):
         image_tag = parameters.get("IMAGE_TAG")
         if image_tag and str(ref).startswith(str(image_tag)):
             logging.error(
@@ -554,16 +631,26 @@ class SaasHerder:
     def validate_upstream_jobs(
         self,
         jjb: JJB,
-    ) -> None:
+    ):
         all_jobs = jjb.get_all_jobs(job_types=["build"])
+        pattern = r"^[0-9a-f]{40}$"
         for sf, rt, t in self:
-            if is_commit_sha(t.ref):
+            sf_name = sf["name"]
+            rt_name = rt["name"]
+            url = rt["url"]
+            ref = t["ref"]
+            if re.search(pattern, ref):
                 continue
-
-            if t.upstream:
-                upstream_job = UpstreamJob(t.upstream.instance.name, t.upstream.name)
+            upstream = t.get("upstream")
+            if upstream:
+                if isinstance(upstream, str):
+                    # skip v1 saas files
+                    continue
+                upstream_job = UpstreamJob(
+                    upstream["instance"]["name"], upstream["name"]
+                )
                 possible_upstream_jobs = self._get_upstream_jobs(
-                    jjb, all_jobs, rt.url, t.ref
+                    jjb, all_jobs, url, ref
                 )
                 found_jobs = [
                     j
@@ -573,56 +660,53 @@ class SaasHerder:
                 if found_jobs:
                     if upstream_job not in possible_upstream_jobs:
                         logging.error(
-                            f"[{sf.name}/{rt.name}] upstream job "
+                            f"[{sf_name}/{rt_name}] upstream job "
                             f"incorrect: {upstream_job}. "
                             f"should be one of: {possible_upstream_jobs}"
                         )
                         self.valid = False
                 else:
                     logging.error(
-                        f"[{sf.name}/{rt.name}] upstream job "
+                        f"[{sf_name}/{rt_name}] upstream job "
                         f"not found: {upstream_job}. "
                         f"should be one of: {possible_upstream_jobs}"
                     )
                     self.valid = False
 
-    def _collect_namespaces(self) -> list[Namespace]:
+    def _collect_namespaces(self):
         # namespaces may appear more then once in the result
         namespaces = []
         for saas_file in self.saas_files:
-            for rt in saas_file.resource_templates:
-                for target in rt.targets:
-                    if target.disable:
+            managed_resource_types = saas_file["managedResourceTypes"]
+            resource_templates = saas_file["resourceTemplates"]
+            for rt in resource_templates:
+                targets = rt["targets"]
+                for target in targets:
+                    namespace = target["namespace"]
+                    if target.get("disable"):
                         logging.debug(
-                            f"[{saas_file.name}/{rt.name}] target "
-                            + f"{target.namespace.cluster.name} /"
-                            + f"{target.namespace.name} is disabled."
+                            f"[{saas_file['name']}/{rt['name']}] target "
+                            + f"{namespace['cluster']['name']}/"
+                            + f"{namespace['name']} is disabled."
                         )
                         continue
-
-                    namespaces.append(
-                        Namespace(
-                            name=target.namespace.name,
-                            environment=target.namespace.environment,
-                            app=target.namespace.app,
-                            cluster=target.namespace.cluster,
-                            # managedResourceTypes is defined per saas_file
-                            # add it to each namespace in the current saas_file
-                            managed_resource_types=saas_file.managed_resource_types,
-                        )
-                    )
+                    # managedResourceTypes is defined per saas_file
+                    # add it to each namespace in the current saas_file
+                    namespace["managedResourceTypes"] = managed_resource_types
+                    namespaces.append(namespace)
         return namespaces
 
-    def _collect_repo_urls(self) -> set[str]:
-        return set(
-            rt.url
-            for saas_file in self.saas_files
-            for rt in saas_file.resource_templates
-        )
+    def _collect_repo_urls(self):
+        repo_urls = set()
+        for saas_file in self.saas_files:
+            resource_templates = saas_file["resourceTemplates"]
+            for rt in resource_templates:
+                repo_urls.add(rt["url"])
+        return repo_urls
 
     @staticmethod
-    def _collect_parameters(container: HasParameters) -> dict[str, str]:
-        parameters = container.parameters or {}
+    def _collect_parameters(container):
+        parameters = container.get("parameters") or {}
         if isinstance(parameters, str):
             parameters = json.loads(parameters)
         # adjust Python's True/False
@@ -635,22 +719,22 @@ class SaasHerder:
                 parameters[k] = json.dumps(v)
         return parameters
 
-    def _collect_secret_parameters(
-        self, container: HasSecretParameters
-    ) -> dict[str, str]:
-        return {
-            sp.name: self.secret_reader.read_secret(sp.secret)
-            for sp in container.secret_parameters or []
-        }
+    def _collect_secret_parameters(self, container):
+        parameters = {}
+        secret_parameters = container.get("secretParameters") or []
+        for sp in secret_parameters:
+            name = sp["name"]
+            secret = sp["secret"]
+            value = self.secret_reader.read(secret)
+            parameters[name] = value
+
+        return parameters
 
     @staticmethod
-    def _get_file_contents_github(repo: Repository, path: str, commit_sha: str) -> str:
+    def _get_file_contents_github(repo, path, commit_sha):
         f = repo.get_contents(path, commit_sha)
-        if isinstance(f, list):
-            raise Exception(f"Path {path} and sha {commit_sha} is a directory!")
-
         if f.size < 1024**2:  # 1 MB
-            return f.decoded_content.decode("utf8")
+            return f.decoded_content
 
         tree = repo.get_git_tree(commit_sha, recursive="/" in path).tree
         for x in tree:
@@ -659,15 +743,15 @@ class SaasHerder:
             blob = repo.get_git_blob(x.sha)
             return base64.b64decode(blob.content).decode("utf8")
 
-        return ""
-
     @retry(max_attempts=20)
-    def _get_file_contents(
-        self, url: str, path: str, ref: str, github: Github, hash_length: int
-    ) -> tuple[Any, str, str]:
+    def _get_file_contents(self, options):
+        url = options["url"]
+        path = options["path"]
+        ref = options["ref"]
+        github = options["github"]
         html_url = f"{url}/blob/{ref}{path}"
-        commit_sha = self._get_commit_sha(url, ref, github, hash_length)
-
+        commit_sha = self._get_commit_sha(options)
+        content = None
         if "github" in url:
             repo_name = url.rstrip("/").replace("https://github.com/", "")
             repo = github.get_repo(repo_name)
@@ -678,25 +762,22 @@ class SaasHerder:
             project = self.gitlab.get_project(url)
             f = project.files.get(file_path=path.lstrip("/"), ref=commit_sha)
             content = f.decode()
-        else:
-            raise Exception(f"Only GitHub and GitLab are supported: {url}")
 
         return yaml.safe_load(content), html_url, commit_sha
 
     @retry()
-    def _get_directory_contents(
-        self, url: str, path: str, ref: str, github: Github, hash_length: int
-    ) -> tuple[list[Any], str, str]:
+    def _get_directory_contents(self, options):
+        url = options["url"]
+        path = options["path"]
+        ref = options["ref"]
+        github = options["github"]
         html_url = f"{url}/tree/{ref}{path}"
-        commit_sha = self._get_commit_sha(url, ref, github, hash_length)
+        commit_sha = self._get_commit_sha(options)
         resources = []
         if "github" in url:
             repo_name = url.rstrip("/").replace("https://github.com/", "")
             repo = github.get_repo(repo_name)
-            directory = repo.get_contents(path, commit_sha)
-            if isinstance(directory, ContentFile):
-                raise Exception(f"Path {path} and sha {commit_sha} is a file!")
-            for f in directory:
+            for f in repo.get_contents(path, commit_sha):
                 file_path = os.path.join(path, f.name)
                 file_contents_decoded = self._get_file_contents_github(
                     repo, file_path, commit_sha
@@ -707,23 +788,21 @@ class SaasHerder:
             if not self.gitlab:
                 raise Exception("gitlab is not initialized")
             project = self.gitlab.get_project(url)
-            for item in self.gitlab.get_items(
+            for f in self.gitlab.get_items(
                 project.repository_tree, path=path.lstrip("/"), ref=commit_sha
             ):
-                file_contents = project.files.get(
-                    file_path=item["path"], ref=commit_sha
-                )
+                file_contents = project.files.get(file_path=f["path"], ref=commit_sha)
                 resource = yaml.safe_load(file_contents.decode())
                 resources.append(resource)
-        else:
-            raise Exception(f"Only GitHub and GitLab are supported: {url}")
 
         return resources, html_url, commit_sha
 
     @retry()
-    def _get_commit_sha(
-        self, url: str, ref: str, github: Github, hash_length: Optional[int] = None
-    ) -> str:
+    def _get_commit_sha(self, options):
+        url = options["url"]
+        ref = options["ref"]
+        github = options["github"]
+        hash_length = options.get("hash_length")
         commit_sha = ""
         if "github" in url:
             repo_name = url.rstrip("/").replace("https://github.com/", "")
@@ -743,7 +822,13 @@ class SaasHerder:
         return commit_sha
 
     @staticmethod
-    def _additional_resource_process(resources: Resources, html_url: str) -> None:
+    def _get_cluster_and_namespace(target):
+        cluster = target["namespace"]["cluster"]["name"]
+        namespace = target["namespace"]["name"]
+        return cluster, namespace
+
+    @staticmethod
+    def _additional_resource_process(resources, html_url):
         for resource in resources:
             # add a definition annotation to each PrometheusRule rule
             if resource["kind"] == "PrometheusRule":
@@ -762,11 +847,7 @@ class SaasHerder:
                     )
 
     @staticmethod
-    def _parameter_value_needed(
-        parameter_name: str,
-        consolidated_parameters: Mapping[str, str],
-        template: Mapping[str, Any],
-    ) -> bool:
+    def _parameter_value_needed(parameter_name, consolidated_parameters, template):
         """Is a parameter named in the template but unspecified?
 
         NOTE: This is currently "parameter *named* and absent" -- i.e. we
@@ -786,27 +867,28 @@ class SaasHerder:
                 return True
         return False
 
-    def _process_template(
-        self,
-        saas_file_name: str,
-        resource_template_name: str,
-        image_auth: ImageAuth,
-        url: str,
-        path: str,
-        provider: str,
-        hash_length: int,
-        target: SaasResourceTemplateTarget,
-        parameters: dict[str, str],
-        github: Github,
-        target_config_hash: str,
-    ) -> tuple[list[Any], str, Optional[Promotion]]:
+    def _process_template(self, options):
+        saas_file_name = options["saas_file_name"]
+        resource_template_name = options["resource_template_name"]
+        image_auth = options["image_auth"]
+        url = options["url"]
+        path = options["path"]
+        provider = options["provider"]
+        target = options["target"]
+        github = options["github"]
+        target_ref = target["ref"]
+        target_promotion = target.get("promotion") or {}
+
+        resources = None
+        html_url = None
+        commit_sha = None
+
         if provider == "openshift-template":
-            environment_parameters = self._collect_parameters(
-                target.namespace.environment
-            )
-            environment_secret_parameters = self._collect_secret_parameters(
-                target.namespace.environment
-            )
+            hash_length = options["hash_length"]
+            parameters = options["parameters"]
+            environment = target["namespace"]["environment"]
+            environment_parameters = self._collect_parameters(environment)
+            environment_secret_parameters = self._collect_secret_parameters(environment)
             target_parameters = self._collect_parameters(target)
             target_secret_parameters = self._collect_secret_parameters(target)
 
@@ -829,23 +911,27 @@ class SaasHerder:
                             replace_pattern, replace_value
                         )
 
+            get_file_contents_options = {
+                "url": url,
+                "path": path,
+                "ref": target_ref,
+                "github": github,
+            }
+
             try:
                 template, html_url, commit_sha = self._get_file_contents(
-                    url=url,
-                    path=path,
-                    ref=target.ref,
-                    github=github,
-                    hash_length=hash_length,
+                    get_file_contents_options
                 )
             except Exception as e:
                 logging.error(
-                    f"[{url}/blob/{target.ref}{path}] "
+                    f"[{url}/blob/{target_ref}{path}] "
                     + f"error fetching template: {str(e)}"
                 )
-                raise
+                return None, None, None
 
             # add IMAGE_TAG only if it is unspecified
-            if not (image_tag := consolidated_parameters.get("IMAGE_TAG", "")):
+            image_tag = consolidated_parameters.get("IMAGE_TAG")
+            if not image_tag:
                 sha_substring = commit_sha[:hash_length]
                 # IMAGE_TAG takes one of two forms:
                 # - If saas file attribute 'use_channel_in_image_tag' is true,
@@ -860,7 +946,7 @@ class SaasHerder:
                             + f"{html_url}: CHANNEL is required when "
                             + "'use_channel_in_image_tag' is true."
                         )
-                        raise
+                        return None, None, None
                     image_tag = f"{channel}-{sha_substring}"
                 else:
                     image_tag = sha_substring
@@ -884,15 +970,10 @@ class SaasHerder:
                         + "Is REGISTRY_IMG missing? "
                         + f"{str(e)}"
                     )
-                    raise
+                    return None, None, None
                 try:
                     image_uri = f"{registry_image}:{image_tag}"
-                    img = Image(
-                        url=image_uri,
-                        username=image_auth.username,
-                        password=image_auth.password,
-                        auth_server=image_auth.auth_server,
-                    )
+                    img = Image(image_uri, **image_auth)
                     if need_repo_digest:
                         consolidated_parameters["REPO_DIGEST"] = img.url_digest
                     if need_image_digest:
@@ -903,7 +984,7 @@ class SaasHerder:
                         + f"{html_url}: error generating REPO_DIGEST for "
                         + f"{image_uri}: {str(e)}"
                     )
-                    raise
+                    return None, None, None
 
             oc = OCLocal("cluster", None, None, local=True)
             try:
@@ -915,20 +996,22 @@ class SaasHerder:
                 )
 
         elif provider == "directory":
+            get_directory_contents_options = {
+                "url": url,
+                "path": path,
+                "ref": target_ref,
+                "github": github,
+            }
             try:
                 resources, html_url, commit_sha = self._get_directory_contents(
-                    url=url,
-                    path=path,
-                    ref=target.ref,
-                    github=github,
-                    hash_length=hash_length,
+                    get_directory_contents_options
                 )
             except Exception as e:
                 logging.error(
-                    f"[{url}/tree/{target.ref}{path}] "
+                    f"[{url}/tree/{target_ref}{path}] "
                     + f"error fetching directory: {str(e)}"
                 )
-                raise
+                return None, None, None
 
         else:
             logging.error(
@@ -936,21 +1019,16 @@ class SaasHerder:
                 + f"unknown provider: {provider}"
             )
 
-        target_promotion = None
-        if target.promotion:
-            target_promotion = Promotion(
-                auto=target.promotion.auto,
-                publish=target.promotion.publish,
-                subscribe=target.promotion.subscribe,
-                promotion_data=target.promotion.promotion_data,
-                commit_sha=commit_sha,
-                saas_file_name=saas_file_name,
-                target_config_hash=target_config_hash,
-            )
+        target_promotion["commit_sha"] = commit_sha
+        # This target_promotion data is used in publish_promotions
+        if target_promotion.get("publish"):
+            target_promotion["saas_file"] = saas_file_name
+            target_promotion[TARGET_CONFIG_HASH] = options[TARGET_CONFIG_HASH]
+
         return resources, html_url, target_promotion
 
     @staticmethod
-    def _collect_images(resource: Resource) -> set[str]:
+    def _collect_images(resource):
         images = set()
         # resources with pod templates
         with suppress(KeyError):
@@ -984,12 +1062,7 @@ class SaasHerder:
         return images
 
     @staticmethod
-    def _check_image(
-        image: str,
-        image_patterns: Iterable[str],
-        image_auth: ImageAuth,
-        error_prefix: str,
-    ) -> bool:
+    def _check_image(image, image_patterns, image_auth, error_prefix):
         error = False
         if not image_patterns:
             error = True
@@ -1000,12 +1073,7 @@ class SaasHerder:
             error = True
             logging.error(f"{error_prefix} Image is not in imagePatterns: {image}")
         try:
-            valid = Image(
-                image,
-                username=image_auth.username,
-                password=image_auth.password,
-                auth_server=image_auth.auth_server,
-            )
+            valid = Image(image, **image_auth)
             if not valid:
                 error = True
                 logging.error(f"{error_prefix} Image does not exist: {image}")
@@ -1017,16 +1085,15 @@ class SaasHerder:
 
         return error
 
-    def _check_images(
-        self,
-        saas_file_name: str,
-        resource_template_name: str,
-        image_auth: ImageAuth,
-        image_patterns: list[str],
-        html_url: str,
-        resources: Resources,
-    ) -> bool:
+    def _check_images(self, options):
+        saas_file_name = options["saas_file_name"]
+        resource_template_name = options["resource_template_name"]
+        html_url = options["html_url"]
+        resources = options["resources"]
+        image_auth = options["image_auth"]
+        image_patterns = options["image_patterns"]
         error_prefix = f"[{saas_file_name}/{resource_template_name}] {html_url}:"
+
         images_list = threaded.run(
             self._collect_images, resources, self.available_thread_pool_size
         )
@@ -1043,12 +1110,13 @@ class SaasHerder:
         )
         return any(errors)
 
-    def _initiate_github(self, saas_file: SaasFile) -> Github:
-        token = (
-            self.secret_reader.read_secret(saas_file.authentication.code)
-            if saas_file.authentication and saas_file.authentication.code
-            else get_default_config()["token"]
-        )
+    def _initiate_github(self, saas_file):
+        auth = saas_file.get("authentication") or {}
+        auth_code = auth.get("code") or {}
+        if auth_code:
+            token = self.secret_reader.read(auth_code)
+        else:
+            token = get_default_config()["token"]
 
         base_url = os.environ.get("GITHUB_API", "https://api.github.com")
         # This is a threaded world. Let's define a big
@@ -1058,42 +1126,47 @@ class SaasHerder:
         pool_size = 100
         return Github(token, base_url=base_url, pool_size=pool_size)
 
-    def _initiate_image_auth(self, saas_file: SaasFile) -> ImageAuth:
+    def _initiate_image_auth(self, saas_file):
         """
-        This function initiates an ImageAuth class required for image authentication.
-        This class will be used as parameters for sretoolbox's Image.
+        This function initiates a dict required for image authentication.
+        This dict will be used as kwargs for sretoolbox's Image.
         The image authentication secret specified in the saas file must
         contain the 'user' and 'token' keys, and may optionally contain
         a 'url' key specifying the image registry url to be passed to check
         if an image should be checked using these credentials.
-
         The function returns the keys extracted from the secret in the
         structure expected by sretoolbox's Image:
         'user' --> 'username'
         'token' --> 'password'
         'url' --> 'auth_server' (optional)
         """
-        if not saas_file.authentication or not saas_file.authentication.image:
-            return ImageAuth()
+        auth = saas_file.get("authentication")
+        if not auth:
+            return {}
+
+        auth_image_secret = auth.get("image")
+        if not auth_image_secret:
+            return {}
 
-        creds = self.secret_reader.read_all_secret(saas_file.authentication.image)
+        creds = self.secret_reader.read_all(auth_image_secret)
         required_keys = ["user", "token"]
         ok = all(k in creds.keys() for k in required_keys)
         if not ok:
             logging.warning(
                 "the specified image authentication secret "
-                + f"found in path {saas_file.authentication.image.path} "
+                + f"found in path {auth_image_secret['path']} "
                 + f"does not contain all required keys: {required_keys}"
             )
-            return ImageAuth()
+            return {}
 
-        return ImageAuth(
-            username=creds["user"],
-            password=creds["token"],
-            auth_server=creds.get("url"),
-        )
+        image_auth = {"username": creds["user"], "password": creds["token"]}
+        url = creds.get("url")
+        if url:
+            image_auth["auth_server"] = url
+
+        return image_auth
 
-    def populate_desired_state(self, ri: ResourceInventory) -> None:
+    def populate_desired_state(self, ri):
         results = threaded.run(
             self._init_populate_desired_state_specs,
             self.saas_files,
@@ -1106,22 +1179,27 @@ class SaasHerder:
             self.thread_pool_size,
             ri=ri,
         )
-        self.promotions: list[Optional[Promotion]] = promotions
+        self.promotions = promotions
 
-    def _init_populate_desired_state_specs(
-        self, saas_file: SaasFile
-    ) -> list[TargetSpec]:
+    def _init_populate_desired_state_specs(self, saas_file):
         specs = []
+        saas_file_name = saas_file["name"]
         github = self._initiate_github(saas_file)
         image_auth = self._initiate_image_auth(saas_file)
+        managed_resource_types = saas_file["managedResourceTypes"]
+        image_patterns = saas_file["imagePatterns"]
+        resource_templates = saas_file["resourceTemplates"]
         saas_file_parameters = self._collect_parameters(saas_file)
         saas_file_secret_parameters = self._collect_secret_parameters(saas_file)
 
         all_trigger_specs = self.get_saas_targets_config_trigger_specs(saas_file)
         # iterate over resource templates (multiple per saas_file)
-        for rt in saas_file.resource_templates:
-            provider = rt.provider or "openshift-template"
-            hash_length = rt.hash_length or self.hash_length
+        for rt in resource_templates:
+            rt_name = rt["name"]
+            url = rt["url"]
+            path = rt["path"]
+            provider = rt.get("provider") or "openshift-template"
+            hash_length = rt.get("hash_length") or self.settings["hashLength"]
             resource_template_parameters = self._collect_parameters(rt)
             resource_template_secret_parameters = self._collect_secret_parameters(rt)
 
@@ -1132,154 +1210,144 @@ class SaasHerder:
             consolidated_parameters.update(resource_template_secret_parameters)
 
             # Iterate over targets (each target is a namespace).
-            for target in rt.targets:
-                if target.disable:
+            for target in rt["targets"]:
+                if target.get("disable"):
                     # Warning is logged during SaasHerder initiation.
                     continue
 
+                cluster = target["namespace"]["cluster"]["name"]
+                namespace = target["namespace"]["name"]
+                env_name = target["namespace"]["environment"]["name"]
+
                 state_key = TriggerSpecConfig(
-                    saas_file_name=saas_file.name,
-                    env_name=target.namespace.environment.name,
+                    saas_file_name=saas_file_name,
+                    env_name=env_name,
                     timeout=None,
-                    pipelines_provider=saas_file.pipelines_provider,
-                    resource_template_name=rt.name,
-                    cluster_name=target.namespace.cluster.name,
-                    namespace_name=target.namespace.name,
-                    target_name=target.name,
+                    pipelines_provider=None,
+                    resource_template_name=rt_name,
+                    cluster_name=cluster,
+                    namespace_name=namespace,
+                    target_name=target.get("name"),
                     state_content=None,
                 ).state_key
                 digest = SaasHerder.get_target_config_hash(
                     all_trigger_specs[state_key].state_content
                 )
 
-                specs.append(
-                    TargetSpec(
-                        saas_file_name=saas_file.name,
-                        cluster=target.namespace.cluster.name,
-                        namespace=target.namespace.name,
-                        managed_resource_types=saas_file.managed_resource_types,
-                        delete=bool(target.delete),
-                        privileged=bool(saas_file.cluster_admin),
-                        # process_template options
-                        resource_template_name=rt.name,
-                        image_auth=image_auth,
-                        url=rt.url,
-                        path=rt.path,
-                        provider=provider,
-                        hash_length=hash_length,
-                        target=target,
-                        parameters=consolidated_parameters,
-                        github=github,
-                        target_config_hash=digest,
-                        # check_image options
-                        image_patterns=saas_file.image_patterns,
-                    )
-                )
+                process_template_options = {
+                    "saas_file_name": saas_file_name,
+                    "resource_template_name": rt_name,
+                    "image_auth": image_auth,
+                    "url": url,
+                    "path": path,
+                    "provider": provider,
+                    "hash_length": hash_length,
+                    "target": target,
+                    "parameters": consolidated_parameters,
+                    "github": github,
+                    TARGET_CONFIG_HASH: digest,
+                }
+                check_images_options_base = {
+                    "saas_file_name": saas_file_name,
+                    "resource_template_name": rt_name,
+                    "image_auth": image_auth,
+                    "image_patterns": image_patterns,
+                }
+                spec = {
+                    "saas_file_name": saas_file_name,
+                    "cluster": cluster,
+                    "namespace": namespace,
+                    "managed_resource_types": managed_resource_types,
+                    "process_template_options": process_template_options,
+                    "check_images_options_base": check_images_options_base,
+                    "delete": target.get("delete"),
+                    "privileged": saas_file.get("clusterAdmin", False) is True,
+                }
+                specs.append(spec)
 
         return specs
 
-    def populate_desired_state_saas_file(
-        self, spec: TargetSpec, ri: ResourceInventory
-    ) -> Optional[Promotion]:
-        if spec.delete:
+    def populate_desired_state_saas_file(self, spec, ri: ResourceInventory):
+        if spec["delete"]:
             # to delete resources, we avoid adding them to the desired state
-            return None
+            return
 
-        try:
-            resources, html_url, promotion = self._process_template(
-                saas_file_name=spec.saas_file_name,
-                resource_template_name=spec.resource_template_name,
-                image_auth=spec.image_auth,
-                url=spec.url,
-                path=spec.path,
-                provider=spec.provider,
-                hash_length=spec.hash_length,
-                target=spec.target,
-                parameters=spec.parameters,
-                github=spec.github,
-                target_config_hash=spec.target_config_hash,
-            )
-        except Exception:
-            # log message send in _process_template
-            ri.register_error()
-            return None
+        saas_file_name = spec["saas_file_name"]
+        cluster = spec["cluster"]
+        namespace = spec["namespace"]
+        managed_resource_types = set(spec["managed_resource_types"])
+        process_template_options = spec["process_template_options"]
+        check_images_options_base = spec["check_images_options_base"]
 
+        resources, html_url, promotion = self._process_template(
+            process_template_options
+        )
+        if resources is None:
+            ri.register_error()
+            return
         # filter resources
-        rs: Resources = []
+        rs = []
         for r in resources:
             if isinstance(r, dict) and "kind" in r and "apiVersion" in r:
-                kind: str = r["kind"]
-                kind_and_group = fully_qualified_kind(kind, r["apiVersion"])
+                kind = cast(str, r.get("kind"))
+                kind_and_group = fully_qualified_kind(
+                    kind, cast(str, r.get("apiVersion"))
+                )
                 if (
-                    kind in spec.managed_resource_types
-                    or kind_and_group in spec.managed_resource_types
+                    kind in managed_resource_types
+                    or kind_and_group in managed_resource_types
                 ):
                     rs.append(r)
                 else:
                     logging.info(
-                        f"Skipping resource of kind {kind} on "
-                        f"{spec.cluster}/{spec.namespace}"
+                        f"Skipping resource of kind {kind} on " f"{cluster}/{namespace}"
                     )
             else:
                 logging.info(
-                    "Skipping non-dictionary resource on "
-                    f"{spec.cluster}/{spec.namespace}"
+                    "Skipping non-dictionary resource on " f"{cluster}/{namespace}"
                 )
         # additional processing of resources
         resources = rs
         self._additional_resource_process(resources, html_url)
         # check images
-        image_error = self._check_images(
-            saas_file_name=spec.saas_file_name,
-            resource_template_name=spec.resource_template_name,
-            image_auth=spec.image_auth,
-            image_patterns=spec.image_patterns,
-            html_url=html_url,
-            resources=resources,
-        )
+        check_images_options = {"html_url": html_url, "resources": resources}
+        check_images_options.update(check_images_options_base)
+        image_error = self._check_images(check_images_options)
         if image_error:
             ri.register_error()
-            return None
+            return
         # add desired resources
         for resource in resources:
+            resource_kind = resource["kind"]
+            resource_name = resource["metadata"]["name"]
             oc_resource = OR(
                 resource,
                 self.integration,
                 self.integration_version,
-                caller_name=spec.saas_file_name,
+                caller_name=saas_file_name,
                 error_details=html_url,
             )
             try:
                 ri.add_desired_resource(
-                    spec.cluster,
-                    spec.namespace,
+                    cluster,
+                    namespace,
                     oc_resource,
-                    privileged=spec.privileged,
+                    privileged=spec["privileged"],
                 )
             except ResourceKeyExistsError:
                 ri.register_error()
                 msg = (
-                    f"[{spec.cluster}/{spec.namespace}] desired item "
-                    + f"already exists: {resource['kind']}/{resource['metadata']['name']}. "
-                    + f"saas file name: {spec.saas_file_name}, "
+                    f"[{cluster}/{namespace}] desired item "
+                    + f"already exists: {resource_kind}/{resource_name}. "
+                    + f"saas file name: {saas_file_name}, "
                     + "resource template name: "
-                    + f"{spec.resource_template_name}."
+                    + f"{process_template_options['resource_template_name']}."
                 )
                 logging.error(msg)
 
         return promotion
 
-    def get_diff(
-        self, trigger_type: TriggerTypes, dry_run: bool
-    ) -> tuple[
-        Union[
-            list[TriggerSpecConfig],
-            list[TriggerSpecMovingCommit],
-            list[TriggerSpecUpstreamJob],
-            list[TriggerSpecContainerImage],
-        ],
-        bool,
-    ]:
+    def get_diff(self, trigger_type, dry_run):
         if trigger_type == TriggerTypes.MOVING_COMMITS:
             # TODO: replace error with actual error handling when needed
             error = False
@@ -1299,10 +1367,7 @@ class SaasHerder:
             f"saasherder get_diff for trigger type: {trigger_type}"
         )
 
-    def update_state(self, trigger_spec: TriggerSpecUnion) -> None:
-        if not self.state:
-            raise Exception("state is not initialized")
-
+    def update_state(self, trigger_spec: TriggerSpecUnion):
         self.state.add(
             trigger_spec.state_key, value=trigger_spec.state_content, force=True
         )
@@ -1317,40 +1382,44 @@ class SaasHerder:
         return list(itertools.chain.from_iterable(results))
 
     def get_moving_commits_diff_saas_file(
-        self, saas_file: SaasFile, dry_run: bool
+        self, saas_file: dict[str, Any], dry_run: bool
     ) -> list[TriggerSpecMovingCommit]:
+        saas_file_name = saas_file["name"]
+        timeout = saas_file.get("timeout") or None
+        pipelines_provider = self._get_pipelines_provider(saas_file)
         github = self._initiate_github(saas_file)
         trigger_specs: list[TriggerSpecMovingCommit] = []
-        for rt in saas_file.resource_templates:
-            for target in rt.targets:
+        for rt in saas_file["resourceTemplates"]:
+            rt_name = rt["name"]
+            url = rt["url"]
+            for target in rt["targets"]:
                 try:
                     # don't trigger if there is a linked upstream job or container image
-                    if target.upstream or target.image:
+                    if target.get("upstream") or target.get("image"):
                         continue
-
-                    desired_commit_sha = self._get_commit_sha(
-                        url=rt.url, ref=target.ref, github=github
-                    )
+                    ref = target["ref"]
+                    get_commit_sha_options = {"url": url, "ref": ref, "github": github}
+                    desired_commit_sha = self._get_commit_sha(get_commit_sha_options)
                     # don't trigger on refs which are commit shas
-                    if target.ref == desired_commit_sha:
+                    if ref == desired_commit_sha:
                         continue
-
+                    namespace = target["namespace"]
+                    cluster_name = namespace["cluster"]["name"]
+                    namespace_name = namespace["name"]
+                    env_name = namespace["environment"]["name"]
                     trigger_spec = TriggerSpecMovingCommit(
-                        saas_file_name=saas_file.name,
-                        env_name=target.namespace.environment.name,
-                        timeout=saas_file.timeout,
-                        pipelines_provider=saas_file.pipelines_provider,
-                        resource_template_name=rt.name,
-                        cluster_name=target.namespace.cluster.name,
-                        namespace_name=target.namespace.name,
-                        ref=target.ref,
+                        saas_file_name=saas_file_name,
+                        env_name=env_name,
+                        timeout=timeout,
+                        pipelines_provider=pipelines_provider,
+                        resource_template_name=rt_name,
+                        cluster_name=cluster_name,
+                        namespace_name=namespace_name,
+                        ref=ref,
                         state_content=desired_commit_sha,
                     )
                     if self.include_trigger_trace:
-                        trigger_spec.reason = f"{rt.url}/commit/{desired_commit_sha}"
-
-                    if not self.state:
-                        raise Exception("state is not initialized")
+                        trigger_spec.reason = f"{url}/commit/{desired_commit_sha}"
                     current_commit_sha = self.state.get(trigger_spec.state_key, None)
                     # skip if there is no change in commit sha
                     if current_commit_sha == desired_commit_sha:
@@ -1368,8 +1437,8 @@ class SaasHerder:
                     trigger_specs.append(trigger_spec)
                 except (GithubException, GitlabError):
                     logging.exception(
-                        f"Skipping target {saas_file.name}:{rt.name}"
-                        f" - repo: {rt.url} - ref: {target.ref}"
+                        f"Skipping target {saas_file_name}:{rt_name}"
+                        f" - repo: {url} - ref: {ref}"
                     )
                     self._register_error()
         return trigger_specs
@@ -1390,9 +1459,6 @@ class SaasHerder:
     def _get_upstream_jobs_current_state(self) -> tuple[dict[str, Any], bool]:
         current_state: dict[str, Any] = {}
         error = False
-        if not self.jenkins_map:
-            raise Exception("jenkins_map is not initialized")
-
         for instance_name, jenkins in self.jenkins_map.items():
             try:
                 current_state[instance_name] = jenkins.get_jobs_state()
@@ -1404,44 +1470,50 @@ class SaasHerder:
         return current_state, error
 
     def get_upstream_jobs_diff_saas_file(
-        self, saas_file: SaasFile, dry_run: bool, current_state: dict[str, Any]
+        self, saas_file: dict[str, Any], dry_run: bool, current_state: dict[str, Any]
     ) -> list[TriggerSpecUpstreamJob]:
+        saas_file_name = saas_file["name"]
+        timeout = saas_file.get("timeout") or None
+        pipelines_provider = self._get_pipelines_provider(saas_file)
         trigger_specs = []
-        for rt in saas_file.resource_templates:
-            for target in rt.targets:
-                if not target.upstream:
+        for rt in saas_file["resourceTemplates"]:
+            rt_name = rt["name"]
+            url = rt["url"]
+            for target in rt["targets"]:
+                upstream = target.get("upstream")
+                if not upstream:
                     continue
-                job_name = target.upstream.name
-                job_history = current_state[target.upstream.instance.name].get(
-                    job_name, []
-                )
+                instance_name = upstream["instance"]["name"]
+                job_name = upstream["name"]
+                job_history = current_state[instance_name].get(job_name, [])
                 if not job_history:
                     continue
                 last_build_result = job_history[0]
-
+                namespace = target["namespace"]
+                cluster_name = namespace["cluster"]["name"]
+                namespace_name = namespace["name"]
+                env_name = namespace["environment"]["name"]
                 trigger_spec = TriggerSpecUpstreamJob(
-                    saas_file_name=saas_file.name,
-                    env_name=target.namespace.environment.name,
-                    timeout=saas_file.timeout,
-                    pipelines_provider=saas_file.pipelines_provider,
-                    resource_template_name=rt.name,
-                    cluster_name=target.namespace.cluster.name,
-                    namespace_name=target.namespace.name,
-                    instance_name=target.upstream.instance.name,
+                    saas_file_name=saas_file_name,
+                    env_name=env_name,
+                    timeout=timeout,
+                    pipelines_provider=pipelines_provider,
+                    resource_template_name=rt_name,
+                    cluster_name=cluster_name,
+                    namespace_name=namespace_name,
+                    instance_name=instance_name,
                     job_name=job_name,
                     state_content=last_build_result,
                 )
                 last_build_result_number = last_build_result["number"]
                 if self.include_trigger_trace:
-                    trigger_spec.reason = f"{target.upstream.instance.server_url}/job/{job_name}/{last_build_result_number}"
+                    trigger_spec.reason = f"{upstream['instance']['serverUrl']}/job/{job_name}/{last_build_result_number}"
                     last_build_result_commit_sha = last_build_result.get("commit_sha")
                     if last_build_result_commit_sha:
                         trigger_spec.reason = (
-                            f"{rt.url}/commit/{last_build_result_commit_sha} via "
+                            f"{url}/commit/{last_build_result_commit_sha} via "
                             + trigger_spec.reason
                         )
-                if not self.state:
-                    raise Exception("state is not initialized")
                 state_build_result = self.state.get(trigger_spec.state_key, None)
                 # skip if last_build_result is incomplete or
                 # there is no change in job state
@@ -1494,51 +1566,62 @@ class SaasHerder:
         return list(itertools.chain.from_iterable(results))
 
     def get_container_images_diff_saas_file(
-        self, saas_file: SaasFile, dry_run: bool
+        self, saas_file: dict[str, Any], dry_run: bool
     ) -> list[TriggerSpecContainerImage]:
         """
         Get a list of trigger specs based on the diff between the
         desired state (git commit) and the current state for a single saas file.
         """
+        saas_file_name = saas_file["name"]
+        timeout = saas_file.get("timeout") or None
+        pipelines_provider = self._get_pipelines_provider(saas_file)
         github = self._initiate_github(saas_file)
         trigger_specs: list[TriggerSpecContainerImage] = []
-        for rt in saas_file.resource_templates:
-            for target in rt.targets:
+        for rt in saas_file["resourceTemplates"]:
+            rt_name = rt["name"]
+            url = rt["url"]
+            for target in rt["targets"]:
                 try:
-                    if not target.image:
+                    image = target.get("image")
+                    if not image:
                         continue
-                    desired_image_tag = self._get_commit_sha(
-                        url=rt.url,
-                        ref=target.ref,
-                        github=github,
-                        hash_length=rt.hash_length or self.hash_length,
-                    )
+                    ref = target["ref"]
+                    hash_length = rt.get("hash_length") or self.settings["hashLength"]
+                    get_commit_sha_options = {
+                        "url": url,
+                        "ref": ref,
+                        "github": github,
+                        "hash_length": hash_length,
+                    }
+                    desired_image_tag = self._get_commit_sha(get_commit_sha_options)
                     # don't trigger if image doesn't exist
-                    image_registry = f"{target.image.org.instance.url}/{target.image.org.name}/{target.image.name}"
+                    image_registry = f"{image['org']['instance']['url']}/{image['org']['name']}/{image['name']}"
                     image_uri = f"{image_registry}:{desired_image_tag}"
+                    image_patterns = saas_file["imagePatterns"]
                     image_auth = self._initiate_image_auth(saas_file)
-                    error_prefix = f"[{saas_file.name}/{rt.name}] {target.ref}:"
+                    error_prefix = f"[{saas_file_name}/{rt_name}] {ref}:"
                     error = self._check_image(
-                        image_uri, saas_file.image_patterns, image_auth, error_prefix
+                        image_uri, image_patterns, image_auth, error_prefix
                     )
                     if error:
                         continue
-
+                    namespace = target["namespace"]
+                    cluster_name = namespace["cluster"]["name"]
+                    namespace_name = namespace["name"]
+                    env_name = namespace["environment"]["name"]
                     trigger_spec = TriggerSpecContainerImage(
-                        saas_file_name=saas_file.name,
-                        env_name=target.namespace.environment.name,
-                        timeout=saas_file.timeout,
-                        pipelines_provider=saas_file.pipelines_provider,
-                        resource_template_name=rt.name,
-                        cluster_name=target.namespace.cluster.name,
-                        namespace_name=target.namespace.name,
+                        saas_file_name=saas_file_name,
+                        env_name=env_name,
+                        timeout=timeout,
+                        pipelines_provider=pipelines_provider,
+                        resource_template_name=rt_name,
+                        cluster_name=cluster_name,
+                        namespace_name=namespace_name,
                         image=image_registry,
                         state_content=desired_image_tag,
                     )
                     if self.include_trigger_trace:
                         trigger_spec.reason = image_uri
-                    if not self.state:
-                        raise Exception("state is not initialized")
                     current_image_tag = self.state.get(trigger_spec.state_key, None)
                     # skip if there is no change in image tag
                     if current_image_tag == desired_image_tag:
@@ -1556,8 +1639,8 @@ class SaasHerder:
                     trigger_specs.append(trigger_spec)
                 except (GithubException, GitlabError):
                     logging.exception(
-                        f"Skipping target {saas_file.name}:{rt.name}"
-                        f" - repo: {rt.url} - ref: {target.ref}"
+                        f"Skipping target {saas_file_name}:{rt_name}"
+                        f" - repo: {url} - ref: {ref}"
                     )
 
         return trigger_specs
@@ -1569,7 +1652,7 @@ class SaasHerder:
         return list(itertools.chain.from_iterable(results))
 
     @staticmethod
-    def remove_none_values(d: Optional[dict[Any, Any]]) -> dict[Any, Any]:
+    def remove_none_values(d):
         if d is None:
             return {}
         new = {}
@@ -1581,14 +1664,11 @@ class SaasHerder:
         return new
 
     def get_configs_diff_saas_file(
-        self, saas_file: SaasFile
+        self, saas_file: dict[str, Any]
     ) -> list[TriggerSpecConfig]:
         all_trigger_specs = self.get_saas_targets_config_trigger_specs(saas_file)
         trigger_specs = []
 
-        if not self.state:
-            raise Exception("state is not initialized")
-
         for key, trigger_spec in all_trigger_specs.items():
             current_target_config = self.state.get(key, None)
             # Continue if there are no diffs between configs.
@@ -1602,75 +1682,67 @@ class SaasHerder:
                 continue
 
             if self.include_trigger_trace:
-                trigger_spec.reason = f"{self.repo_url}/commit/{RunningState().commit}"
+                trigger_spec.reason = (
+                    f"{self.settings['repoUrl']}/commit/{RunningState().commit}"
+                )
             trigger_specs.append(trigger_spec)
         return trigger_specs
 
     @staticmethod
-    def get_target_config_hash(target_config: Any) -> str:
+    def get_target_config_hash(target_config):
         m = hashlib.sha256()
         m.update(json.dumps(target_config, sort_keys=True).encode("utf-8"))
         digest = m.hexdigest()[:16]
         return digest
 
     def get_saas_targets_config_trigger_specs(
-        self, saas_file: SaasFile
+        self, saas_file: dict[str, Any]
     ) -> dict[str, TriggerSpecConfig]:
         configs = {}
-        for rt in saas_file.resource_templates:
-            for target in rt.targets:
+        saas_file_name = saas_file["name"]
+        saas_file_parameters = saas_file.get("parameters")
+        saas_file_managed_resource_types = saas_file["managedResourceTypes"]
+        for rt in saas_file["resourceTemplates"]:
+            rt_name = rt["name"]
+            url = rt["url"]
+            path = rt["path"]
+            rt_parameters = rt.get("parameters")
+            for v in rt["targets"]:
                 # ChainMap will store modifications avoiding a deep copy
-                desired_target_config = ChainMap(target.dict(by_alias=True))
+                desired_target_config = ChainMap({}, v)
+                namespace = desired_target_config["namespace"]
+
+                cluster_name = namespace["cluster"]["name"]
+                namespace_name = namespace["name"]
+                env_name = namespace["environment"]["name"]
+
                 # This will add the namespace key/value to the chainMap, but
                 # the target will remain with the original value
                 # When the namespace key is looked up, the chainmap will
-                # return the modified attribute (set in the first mapping)
-                desired_target_config["namespace"] = self.sanitize_namespace(
-                    target.namespace
-                )
+                # return the modified attribute ( set in the first mapping)
+                desired_target_config["namespace"] = self.sanitize_namespace(namespace)
                 # add parent parameters to target config
-                # before the GQL classes are introduced, the parameters attribute
-                # was a json string. Keep it that way to be backwards compatible.
-                desired_target_config["saas_file_parameters"] = (
-                    json.dumps(saas_file.parameters, separators=(",", ":"))
-                    if saas_file.parameters is not None
-                    else None
-                )
-
-                # before the GQL classes are introduced, the parameters attribute
-                # was a json string. Keep it that way to be backwards compatible.
-                desired_target_config["parameters"] = (
-                    json.dumps(target.parameters, separators=(",", ":"))
-                    if target.parameters is not None
-                    else None
-                )
-
+                desired_target_config["saas_file_parameters"] = saas_file_parameters
                 # add managed resource types to target config
                 desired_target_config[
                     "saas_file_managed_resource_types"
-                ] = saas_file.managed_resource_types
-                desired_target_config["url"] = rt.url
-                desired_target_config["path"] = rt.path
-                # before the GQL classes are introduced, the parameters attribute
-                # was a json string. Keep it that way to be backwards compatible.
-                desired_target_config["rt_parameters"] = (
-                    json.dumps(rt.parameters, separators=(",", ":"))
-                    if rt.parameters is not None
-                    else None
-                )
+                ] = saas_file_managed_resource_types
+                desired_target_config["url"] = url
+                desired_target_config["path"] = path
+                desired_target_config["rt_parameters"] = rt_parameters
                 # Convert to dict, ChainMap is not JSON serializable
                 # desired_target_config needs to be serialized to generate
                 # its config hash and to be stored in S3
                 serializable_target_config = dict(desired_target_config)
                 trigger_spec = TriggerSpecConfig(
-                    saas_file_name=saas_file.name,
-                    env_name=target.namespace.environment.name,
-                    timeout=saas_file.timeout,
-                    pipelines_provider=saas_file.pipelines_provider,
-                    resource_template_name=rt.name,
-                    cluster_name=target.namespace.cluster.name,
-                    namespace_name=target.namespace.name,
-                    target_name=target.name,
+                    saas_file_name=saas_file_name,
+                    env_name=env_name,
+                    timeout=saas_file.get("timeout") or None,
+                    pipelines_provider=self._get_pipelines_provider(saas_file),
+                    resource_template_name=rt_name,
+                    cluster_name=cluster_name,
+                    namespace_name=namespace_name,
+                    target_name=desired_target_config.get("name"),
                     state_content=serializable_target_config,
                 )
                 configs[trigger_spec.state_key] = trigger_spec
@@ -1678,48 +1750,57 @@ class SaasHerder:
         return configs
 
     @staticmethod
-    def sanitize_namespace(
-        namespace: SaasResourceTemplateTargetNamespace,
-    ) -> dict[str, dict[str, str]]:
+    def _get_pipelines_provider(saas_file: Mapping[str, Any]) -> dict[str, Any]:
+        return saas_file["pipelinesProvider"]
+
+    @staticmethod
+    def sanitize_namespace(namespace):
         """Only keep fields that should trigger a new job."""
-        return namespace.dict(
-            by_alias=True,
-            include={
-                "name": True,
-                "cluster": {"name": True, "server_url": True},
-                "app": {"name": True},
-            },
-        )
+        new_job_fields = {
+            "namespace": ["name", "cluster", "app"],
+            "cluster": ["name", "serverUrl"],
+            "app": ["name"],
+        }
+        namespace = {
+            k: v for k, v in namespace.items() if k in new_job_fields["namespace"]
+        }
+        cluster = namespace["cluster"]
+        namespace["cluster"] = {
+            k: v for k, v in cluster.items() if k in new_job_fields["cluster"]
+        }
+        app = namespace["app"]
+        namespace["app"] = {k: v for k, v in app.items() if k in new_job_fields["app"]}
+        return namespace
 
-    def validate_promotions(self) -> bool:
+    def validate_promotions(self):
         """
         If there were promotion sections in the participating saas files
         validate that the conditions are met."""
-        if not self.state:
-            raise Exception("state is not initialized")
-
-        for promotion in self.promotions:
-            if promotion is None:
+        for item in self.promotions:
+            if item is None:
                 continue
             # validate that the commit sha being promoted
             # was successfully published to the subscribed channel(s)
-            if promotion.subscribe:
-                for channel in promotion.subscribe:
-                    state_key = f"promotions/{channel}/{promotion.commit_sha}"
+            subscribe = item.get("subscribe")
+            if subscribe:
+                commit_sha = item["commit_sha"]
+                for channel in subscribe:
+                    state_key = f"promotions/{channel}/{commit_sha}"
                     stateobj = self.state.get(state_key, {})
                     success = stateobj.get("success")
                     if not success:
                         logging.error(
-                            f"Commit {promotion.commit_sha} was not "
+                            f"Commit {commit_sha} was not "
                             + f"published with success to channel {channel}"
                         )
                         return False
 
                     state_config_hash = stateobj.get(TARGET_CONFIG_HASH)
+                    promotion_data = item.get("promotion_data", None)
 
                     # This code supports current saas targets that does
                     # not have promotion_data yet
-                    if not state_config_hash or not promotion.promotion_data:
+                    if not state_config_hash or not promotion_data:
                         logging.info(
                             "Promotion data is missing; rely on the success "
                             "state only"
@@ -1730,10 +1811,13 @@ class SaasHerder:
                     # Just validate parent_saas_config hash
                     # promotion_data type by now.
                     parent_saas_config = None
-                    for pd in promotion.promotion_data:
-                        if pd.channel == channel:
-                            for data in pd.data or []:
-                                if isinstance(data, SaasParentSaasPromotion):
+                    for pd in promotion_data:
+                        pd_channel = pd.get("channel")
+                        if pd_channel == channel:
+                            channel_data = pd.get("data")
+                            for data in channel_data:
+                                t = data.get("type")
+                                if t == "parent_saas_config":
                                     parent_saas_config = data
 
                     # This section might not exist due to a manual MR.
@@ -1749,7 +1833,11 @@ class SaasHerder:
 
                     # Validate that the state config_hash set by the parent
                     # matches with the hash set in promotion_data
-                    if parent_saas_config.target_config_hash == state_config_hash:
+                    promotion_target_config_hash = parent_saas_config.get(
+                        TARGET_CONFIG_HASH
+                    )
+
+                    if promotion_target_config_hash == state_config_hash:
                         return True
 
                     logging.error(
@@ -1760,13 +1848,7 @@ class SaasHerder:
                     return False
         return True
 
-    def publish_promotions(
-        self,
-        success: bool,
-        all_saas_files: Iterable[SaasFile],
-        mr_cli: MRClient,
-        auto_promote: bool = False,
-    ) -> None:
+    def publish_promotions(self, success, all_saas_files, mr_cli, auto_promote=False):
         """
         If there were promotion sections in the participating saas file
         publish the results for future promotion validations."""
@@ -1782,27 +1864,25 @@ class SaasHerder:
                 "happen if the current stage does not make any change"
             )
 
-        if not self.state:
-            raise Exception("state is not initialized")
-
-        for promotion in self.promotions:
-            if promotion is None:
+        for item in self.promotions:
+            if item is None:
                 continue
-
-            if promotion.publish:
+            commit_sha = item["commit_sha"]
+            publish = item.get("publish")
+            if publish:
                 value = {
                     "success": success,
-                    "saas_file": promotion.saas_file_name,
-                    "target_config_hash": promotion.target_config_hash,
+                    "saas_file": item["saas_file"],
+                    TARGET_CONFIG_HASH: item.get(TARGET_CONFIG_HASH),
                 }
                 all_subscribed_saas_file_paths = set()
                 all_subscribed_target_paths = set()
-                for channel in promotion.publish:
+                for channel in publish:
                     # publish to state to pass promotion gate
-                    state_key = f"promotions/{channel}/{promotion.commit_sha}"
+                    state_key = f"promotions/{channel}/{commit_sha}"
                     self.state.add(state_key, value, force=True)
                     logging.info(
-                        f"Commit {promotion.commit_sha} was published "
+                        f"Commit {commit_sha} was published "
                         + f"with success {success} to channel {channel}"
                     )
                     # collect data to trigger promotion
@@ -1819,8 +1899,8 @@ class SaasHerder:
                     if subscribed_target_paths:
                         all_subscribed_target_paths.update(subscribed_target_paths)
 
-                promotion.saas_file_paths = list(all_subscribed_saas_file_paths)
-                promotion.target_paths = list(all_subscribed_target_paths)
+                item["saas_file_paths"] = list(all_subscribed_saas_file_paths)
+                item["target_paths"] = list(all_subscribed_target_paths)
 
                 if auto_promote and (
                     all_subscribed_saas_file_paths or all_subscribed_target_paths
@@ -1828,16 +1908,12 @@ class SaasHerder:
                     trigger_promotion = True
 
         if success and trigger_promotion:
-            from reconcile.utils.mr.auto_promoter import (
-                AutoPromoter,  # avoid circular import
-            )
-
-            mr = AutoPromoter([p for p in self.promotions if p is not None])
+            mr = AutoPromoter(self.promotions)
             mr.submit(cli=mr_cli)
 
     @staticmethod
     def _get_subscribe_path_map(
-        saas_files: Iterable[SaasFile], auto_only: bool = False
+        saas_files: Iterable[Mapping[str, Any]], auto_only: bool = False
     ) -> tuple[dict[str, set[str]], dict[str, set[str]]]:
         """
         Returns dicts with subscribe channels as keys and a
@@ -1846,23 +1922,27 @@ class SaasHerder:
         subscribe_saas_file_path_map: dict[str, set[str]] = {}
         subscribe_target_path_map: dict[str, set[str]] = {}
         for saas_file in saas_files:
-            saas_file_path = "data" + saas_file.path
-            for rt in saas_file.resource_templates:
-                for target in rt.targets:
-                    if not target.promotion:
+            saas_file_path = "data" + saas_file["path"]
+            for rt in saas_file["resourceTemplates"]:
+                for target in rt["targets"]:
+                    target_promotion = target.get("promotion")
+                    if not target_promotion:
                         continue
-                    if auto_only and not target.promotion.auto:
+                    target_auto = target_promotion.get("auto")
+                    if auto_only and not target_auto:
                         continue
-                    if not target.promotion.subscribe:
+                    subscribe = target_promotion.get("subscribe")
+                    if not subscribe:
                         continue
                     # targets with a path are referenced and not inlined
-                    if target.path:
-                        target.path = "data" + target.path
-                    for channel in target.promotion.subscribe:
+                    target_path = target.get("path")
+                    if target_path:
+                        target_path = "data" + target_path
+                    for channel in subscribe:
                         subscribe_saas_file_path_map.setdefault(channel, set())
                         subscribe_saas_file_path_map[channel].add(saas_file_path)
-                        if target.path:
+                        if target_path:
                             subscribe_target_path_map.setdefault(channel, set())
-                            subscribe_target_path_map[channel].add(target.path)
+                            subscribe_target_path_map[channel].add(target_path)
 
         return subscribe_saas_file_path_map, subscribe_target_path_map