roar-cli 0.3.6__tar.gz → 0.3.7__tar.gz

{roar_cli-0.3.6 → roar_cli-0.3.7}/LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright [2026] [TReqs Inc]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -199,4 +199,4 @@
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
-   limitations under the License.
+   limitations under the License.

{roar_cli-0.3.6 → roar_cli-0.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roar-cli
-Version: 0.3.6
+Version: 0.3.7
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{roar_cli-0.3.6 → roar_cli-0.3.7}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "maturin"
 
 [project]
 name = "roar-cli"
-version = "0.3.6"
+version = "0.3.7"
 description = "Reproducibility and provenance tracker for ML training pipelines"
 authors = [
     { name="TReqs Team", email="info@treqs.ai" }

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/git.py

@@ -80,6 +80,18 @@ def resolve_roar_git_context(
     if ctx.repo and not is_shareable_remote(ctx.repo):
         logger.debug("Dropping non-shareable git repo URL from publish context: %s", ctx.repo)
         ctx = replace(ctx, repo=None)
+    # A remote URL can embed credentials (https://user:token@host,
+    # https://TOKEN@host, ssh://user:pass@host). Redact them here, at the
+    # publish-side source, so every publish flow (register, put, package
+    # export) and the canonical session hash see the same credential-free
+    # URL — downstream send paths filter again as defense in depth.
+    if ctx.repo:
+        redacted_repo = _redact_publish_repo_url(ctx.repo, path)
+        if redacted_repo != ctx.repo:
+            logger.warning(
+                "Redacted credentials from git repo URL before publish: %s", redacted_repo
+            )
+            ctx = replace(ctx, repo=redacted_repo)
     logger.debug(
         "Git context resolved: repo=%s, commit=%s, branch=%s",
         ctx.repo,
@@ -89,6 +101,22 @@ def resolve_roar_git_context(
     return ctx
 
 
+def _redact_publish_repo_url(repo_url: str, start_dir: Path) -> str:
+    """Redact embedded credentials from a publish-bound git repo URL.
+
+    Honors the same ``registration.omit`` config (enabled flag, allowlist,
+    custom patterns) as the registration payload filters.
+    """
+    from ..filters.omit import OmitFilter
+    from ..integrations.config.raw import get_raw_registration_omit_config
+
+    omit_config = get_raw_registration_omit_config(start_dir=str(start_dir))
+    if not omit_config.get("enabled", True):
+        return repo_url
+    filtered, _detections = OmitFilter(omit_config).filter_git_url(repo_url)
+    return filtered
+
+
 def build_roar_git_tag_name(commit: str, *, short: bool = False) -> str:
     """Build the canonical roar git tag name."""
     normalized_commit = commit[:8] if short else commit

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/labels.py

@@ -42,6 +42,27 @@ class LabelWriteResult:
     version: int | None = None
 
 
+@dataclass(frozen=True)
+class ReconcileTargetSync:
+    """Correlates one outbound label-reconcile payload item to the local label
+    row(s) it came from and the deletion keys (if any) requested for it.
+
+    A single ``roar label sync`` call can push several targets (dag, jobs,
+    artifacts) in one reconcile request. This lets the caller match each
+    target's entry in the GLaaS response back to the local rows that should
+    (or, if a requested deletion wasn't confirmed, should NOT) get their
+    ``synced_at`` baseline advanced. See
+    ``roar/application/query/label.py::_mark_labels_synced_confirming_deletions``.
+    """
+
+    entity_type: str
+    session_hash: str | None
+    job_uid: str | None
+    artifact_hash: str | None
+    label_ids: list[int]
+    deleted_keys: list[str]
+
+
 class _LabelSyncDatabaseContext(Protocol):
     @property
     def labels(self) -> Any: ...
@@ -512,6 +533,156 @@ def collect_label_sync_payloads(
     return payloads
 
 
+def _user_label_key_paths(metadata: Any) -> set[str]:
+    if not isinstance(metadata, dict):
+        return set()
+    return {key for key, _value in flatten_label_metadata(strip_reserved_system_labels(metadata))}
+
+
+def deleted_user_label_keys(
+    db_ctx: _LabelSyncDatabaseContext,
+    *,
+    entity_type: str,
+    session_id: int | None = None,
+    job_id: int | None = None,
+    artifact_id: str | None = None,
+) -> list[str]:
+    """User-label key paths removed locally since the last synced version.
+
+    The newest version stamped ``synced_at`` is the remote baseline: keys
+    present there but absent from the current version were deliberately unset
+    locally and should be deleted remotely on the next reconcile.
+    """
+    history = db_ctx.labels.get_history(
+        entity_type,
+        session_id=session_id,
+        job_id=job_id,
+        artifact_id=artifact_id,
+    )
+    synced = [row for row in history if row.get("synced_at") is not None]
+    if not history or not synced:
+        return []
+    baseline = max(synced, key=lambda row: int(row.get("version") or 0))
+    current = max(history, key=lambda row: int(row.get("version") or 0))
+    if int(baseline.get("version") or 0) >= int(current.get("version") or 0):
+        return []
+    baseline_keys = _user_label_key_paths(baseline.get("metadata"))
+    current_keys = _user_label_key_paths(current.get("metadata"))
+    return sorted(baseline_keys - current_keys)
+
+
+def _current_label_row_id(
+    db_ctx: _LabelSyncDatabaseContext,
+    *,
+    entity_type: str,
+    session_id: int | None = None,
+    job_id: int | None = None,
+    artifact_id: str | None = None,
+) -> int | None:
+    """Local row id of the current label version for a target, if any."""
+    current = db_ctx.labels.get_current(
+        entity_type,
+        session_id=session_id,
+        job_id=job_id,
+        artifact_id=artifact_id,
+    )
+    if isinstance(current, dict) and isinstance(current.get("id"), int):
+        return int(current["id"])
+    return None
+
+
+def _attach_deleted_user_keys_for_lineage(
+    db_ctx: _LabelSyncDatabaseContext,
+    payloads: list[dict[str, Any]],
+    *,
+    session_id: int | None,
+    jobs: list[dict[str, Any]],
+    artifacts: list[dict[str, Any]],
+) -> None:
+    """Stamp locally-unset user keys and the source label row id onto reconcile
+    payloads, per target.
+
+    ``_label_row_id`` is transient bookkeeping consumed by ``_split_label_row_ids``
+    below (it is never sent to GLaaS) so the caller can correlate the server's
+    response back to the local row(s) that should have ``synced_at`` advanced.
+    """
+    job_id_by_uid: dict[str, int] = {}
+    for job in jobs:
+        job_id = job.get("id")
+        job_uid = job.get("job_uid")
+        remote_job_uid = job.get("remote_job_uid")
+        resolved = remote_job_uid if isinstance(remote_job_uid, str) and remote_job_uid else job_uid
+        if isinstance(job_id, int) and isinstance(resolved, str) and resolved:
+            job_id_by_uid.setdefault(resolved, job_id)
+
+    artifact_id_by_hash: dict[str, str] = {}
+    for artifact in artifacts:
+        artifact_id = artifact.get("id")
+        artifact_hash = artifact.get("hash")
+        if isinstance(artifact_id, str) and isinstance(artifact_hash, str) and artifact_hash:
+            artifact_id_by_hash.setdefault(artifact_hash, artifact_id)
+
+    for payload in payloads:
+        entity_type = payload.get("entity_type")
+        deleted: list[str] = []
+        label_id: int | None = None
+        if entity_type == "dag" and session_id is not None:
+            deleted = deleted_user_label_keys(db_ctx, entity_type="dag", session_id=session_id)
+            label_id = _current_label_row_id(db_ctx, entity_type="dag", session_id=session_id)
+        elif entity_type == "job":
+            job_id = job_id_by_uid.get(str(payload.get("job_uid") or ""))
+            if job_id is not None:
+                deleted = deleted_user_label_keys(db_ctx, entity_type="job", job_id=job_id)
+                label_id = _current_label_row_id(db_ctx, entity_type="job", job_id=job_id)
+        elif entity_type == "artifact":
+            artifact_id = artifact_id_by_hash.get(str(payload.get("artifact_hash") or ""))
+            if artifact_id is not None:
+                deleted = deleted_user_label_keys(
+                    db_ctx,
+                    entity_type="artifact",
+                    artifact_id=artifact_id,
+                )
+                label_id = _current_label_row_id(
+                    db_ctx, entity_type="artifact", artifact_id=artifact_id
+                )
+        if deleted:
+            payload["deleted_keys"] = deleted
+        if label_id is not None:
+            payload["_label_row_id"] = label_id
+
+
+def _split_label_row_ids(
+    payloads: list[dict[str, Any]],
+) -> tuple[list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Strip the transient ``_label_row_id`` key from outbound wire payloads.
+
+    Returns the cleaned payloads (safe to JSON-serialize to GLaaS) alongside a
+    parallel, same-order list of ``ReconcileTargetSync`` records so the caller
+    can verify server-confirmed deletions before advancing each target's local
+    ``synced_at`` baseline.
+    """
+    wire_payloads: list[dict[str, Any]] = []
+    targets: list[ReconcileTargetSync] = []
+    for payload in payloads:
+        label_row_id = payload.get("_label_row_id")
+        wire_payloads.append({k: v for k, v in payload.items() if k != "_label_row_id"})
+        deleted_keys = payload.get("deleted_keys")
+        session_hash = payload.get("session_hash")
+        job_uid = payload.get("job_uid")
+        artifact_hash = payload.get("artifact_hash")
+        targets.append(
+            ReconcileTargetSync(
+                entity_type=str(payload.get("entity_type") or ""),
+                session_hash=session_hash if isinstance(session_hash, str) else None,
+                job_uid=job_uid if isinstance(job_uid, str) else None,
+                artifact_hash=artifact_hash if isinstance(artifact_hash, str) else None,
+                label_ids=[int(label_row_id)] if isinstance(label_row_id, int) else [],
+                deleted_keys=list(deleted_keys) if isinstance(deleted_keys, list) else [],
+            )
+        )
+    return wire_payloads, targets
+
+
 def collect_current_label_ids(
     db_ctx: _LabelSyncDatabaseContext,
     *,
@@ -576,8 +747,15 @@ def build_reconcile_payload_for_current_lineage(
     db_ctx: _RemoteLabelMutationDatabaseContext,
     *,
     roar_dir: Path,
-) -> tuple[str, list[dict[str, Any]]]:
-    """Build a user-managed reconcile payload for the active local lineage."""
+) -> tuple[str, list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Build a user-managed reconcile payload for the active local lineage.
+
+    Returns the published session hash, the reconcile label payloads (including
+    per-target ``deleted_keys`` for locally-unset user labels), and a per-target
+    ``ReconcileTargetSync`` list (same order as the payloads) the caller uses to
+    decide which local label rows may have ``synced_at`` stamped after a push —
+    see ``roar/application/query/label.py::_mark_labels_synced_confirming_deletions``.
+    """
     session = db_ctx.sessions.get_active()
     if not isinstance(session, dict) or not isinstance(session.get("id"), int):
         raise ValueError("No active session.")
@@ -594,14 +772,23 @@ def build_reconcile_payload_for_current_lineage(
         list(getattr(lineage, "jobs", []) or []),
         session,
     )
+    artifacts = list(getattr(lineage, "artifacts", []) or [])
     payloads = collect_label_sync_payloads(
         db_ctx,
         session_id=session_id,
         session_hash=session_hash,
         jobs=jobs,
-        artifacts=list(getattr(lineage, "artifacts", []) or []),
+        artifacts=artifacts,
+    )
+    _attach_deleted_user_keys_for_lineage(
+        db_ctx,
+        payloads,
+        session_id=session_id,
+        jobs=jobs,
+        artifacts=artifacts,
     )
-    return session_hash, _user_managed_reconcile_payloads(payloads)
+    wire_payloads, sync_targets = _split_label_row_ids(_user_managed_reconcile_payloads(payloads))
+    return session_hash, wire_payloads, sync_targets
 
 
 def build_reconcile_payload_for_target(
@@ -610,8 +797,12 @@ def build_reconcile_payload_for_target(
     roar_dir: Path,
     target: LabelTargetRef,
     metadata: dict[str, Any],
-) -> tuple[str, list[dict[str, Any]]]:
-    """Build a single-target user-managed reconcile payload."""
+) -> tuple[str, list[dict[str, Any]], list[ReconcileTargetSync]]:
+    """Build a single-target user-managed reconcile payload.
+
+    See ``build_reconcile_payload_for_current_lineage`` for what the returned
+    ``ReconcileTargetSync`` list is used for.
+    """
     payload = build_remote_label_mutation_payload(
         db_ctx,
         roar_dir=roar_dir,
@@ -619,6 +810,15 @@ def build_reconcile_payload_for_target(
         metadata=metadata,
         require_published_session=True,
     )
+    deleted = deleted_user_label_keys(
+        db_ctx,
+        entity_type=target.entity_type,
+        session_id=target.session_id,
+        job_id=target.job_id,
+        artifact_id=target.artifact_id,
+    )
+    if deleted:
+        payload["deleted_keys"] = deleted
     session_hash = payload.get("session_hash")
     if not isinstance(session_hash, str) or not session_hash:
         session_hash = _canonical_remote_session_hash_for_target(
@@ -627,7 +827,17 @@ def build_reconcile_payload_for_target(
             target=target,
             require_published=True,
         )
-    return session_hash, _user_managed_reconcile_payloads([payload])
+    label_id = _current_label_row_id(
+        db_ctx,
+        entity_type=target.entity_type,
+        session_id=target.session_id,
+        job_id=target.job_id,
+        artifact_id=target.artifact_id,
+    )
+    if label_id is not None:
+        payload["_label_row_id"] = label_id
+    wire_payloads, sync_targets = _split_label_row_ids(_user_managed_reconcile_payloads([payload]))
+    return session_hash, wire_payloads, sync_targets
 
 
 def _canonical_remote_session_hash(
@@ -730,14 +940,18 @@ def _user_managed_reconcile_payloads(payloads: list[dict[str, Any]]) -> list[dic
         if not isinstance(metadata, dict):
             continue
         user_metadata = _prune_empty_containers(strip_reserved_system_labels(metadata))
-        if not user_metadata:
+        deleted_keys = payload.get("deleted_keys")
+        has_deletions = isinstance(deleted_keys, list) and bool(deleted_keys)
+        # A target whose user labels were all unset still needs a reconcile item
+        # so the deletions propagate remotely.
+        if not user_metadata and not has_deletions:
             continue
         filtered.append(
             {
                 key: value
                 for key, value in {
                     **payload,
-                    "metadata": user_metadata,
+                    "metadata": user_metadata if isinstance(user_metadata, dict) else {},
                 }.items()
                 if key != "key_origins"
             }

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/lookup/remote_artifacts.py

@@ -22,12 +22,36 @@ def lookup_remote_artifact(
 ) -> tuple[dict[str, Any] | None, str | None]:
     """Resolve a remote artifact by hash prefix.
 
+    Tries the authenticated lookup first. If that's rejected for lack of
+    credentials (401/403) — the common case for a user with no SSH key
+    registered looking up a public artifact — falls back to the public,
+    optionally-authenticated endpoint so anonymous reads still work.
+
     Returns ``(artifact, error_message)``. A 404 is treated as a clean miss.
     """
     reader = artifact_reader or GlaasClient(base_url=server_url)
 
     try:
         artifact = reader.get_artifact(hash_prefix)
+    except GlaasApiError as exc:
+        if exc.status_code == 404:
+            return None, None
+        if exc.status_code in (401, 403) and hasattr(reader, "get_public_artifact"):
+            return _lookup_public_artifact(reader, hash_prefix)
+        return None, str(exc)
+    except (ValueError, RuntimeError) as exc:
+        return None, str(exc)
+
+    if not isinstance(artifact, dict):
+        return None, None
+    return artifact, None
+
+
+def _lookup_public_artifact(
+    reader: SupportsArtifactLookup, hash_prefix: str
+) -> tuple[dict[str, Any] | None, str | None]:
+    try:
+        artifact = reader.get_public_artifact(hash_prefix)  # type: ignore[attr-defined]
     except GlaasApiError as exc:
         if exc.status_code == 404:
             return None, None

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/publish/register_execution.py

@@ -24,7 +24,11 @@ from .job_preparation import (
     order_jobs_for_registration,
 )
 from .remote_job_uids import prepare_jobs_for_remote_publication
-from .secrets import detect_lineage_secrets, filter_lineage_secrets
+from .secrets import (
+    detect_lineage_secrets,
+    filter_git_context_secrets,
+    filter_lineage_secrets,
+)
 from .session import build_staged_lineage_counts
 
 if TYPE_CHECKING:
@@ -265,6 +269,12 @@ class RegisterService:
                 lineage=lineage,
                 omit_filter=omit_filter,
             )
+            # The git repo URL is published at the session level (register /
+            # finalize), so it must be redacted here too, not just detected.
+            git_context, _ = filter_git_context_secrets(
+                git_context=git_context,
+                omit_filter=omit_filter,
+            )
 
         registration_jobs = order_jobs_for_registration(
             normalize_jobs_for_registration(lineage.jobs)

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/publish/registration_package.py

@@ -29,7 +29,11 @@ from .job_preparation import (
 from .lineage import LineageCollector
 from .lineage_composites import build_lineage_composite_payloads
 from .registration import normalize_registration_hashes, normalize_registration_source_type
-from .secrets import detect_lineage_secrets, filter_lineage_secrets
+from .secrets import (
+    detect_lineage_secrets,
+    filter_git_context_secrets,
+    filter_lineage_secrets,
+)
 
 PACKAGE_FORMAT = "roar.registration_package"
 PACKAGE_VERSION = 1
@@ -87,7 +91,19 @@ def export_registration_package(
     git_context = resolve_roar_git_context(
         request.cwd, logger=logger, configured_remote=config_get("git.remote")
     )
+    from ..labels import collect_label_sync_payloads
+
     with create_database_context(request.roar_dir) as db_ctx:
+        # Export the entities' current local labels alongside the lineage so a
+        # package-based publish carries the same labels `roar register` would
+        # sync (e.g. metric labels on the model artifact).
+        labels = collect_label_sync_payloads(
+            db_ctx,
+            session_id=session_id,
+            session_hash=str(session.get("hash") or ""),
+            jobs=lineage.jobs,
+            artifacts=lineage.artifacts,
+        )
         package, encoded = build_registration_package(
             session=session,
             lineage=lineage,
@@ -95,6 +111,7 @@ def export_registration_package(
             cwd=request.cwd,
             db_ctx=db_ctx,
             session_hash=str(session.get("hash") or ""),
+            labels=labels,
             logger=logger,
         )
 
@@ -123,13 +140,14 @@ def build_registration_package(
     db_ctx: Any | None = None,
     session_hash: str | None = None,
     composite_builder: Any | None = None,
+    labels: list[dict[str, Any]] | None = None,
     logger: ILogger | None = None,
     created_at: str | None = None,
     producer_version: str | None = None,
 ) -> tuple[dict[str, Any], bytes]:
     """Build a finalized `RoarRegistrationPackageV1` payload and bytes."""
     resolved_logger = logger or get_logger()
-    redacted_lineage, redacted_git_context, redaction = _apply_redaction(
+    redacted_lineage, redacted_git_context, redaction, omit_filter = _apply_redaction(
         lineage=lineage,
         git_context=git_context,
         cwd=cwd,
@@ -188,6 +206,11 @@ def build_registration_package(
     if composites:
         package["composites"] = composites
 
+    if labels:
+        filtered_labels, label_detections = _filter_label_secrets(labels, omit_filter)
+        package["labels"] = filtered_labels
+        _merge_redaction_detections(redaction, label_detections)
+
     return finalize_registration_package(package)
 
 
@@ -237,7 +260,7 @@ def _apply_redaction(
     lineage: LineageData,
     git_context: GitContext,
     cwd: Path,
-) -> tuple[LineageData, GitContext, dict[str, Any]]:
+) -> tuple[LineageData, GitContext, dict[str, Any], OmitFilter | None]:
     omit_config = get_raw_registration_omit_config(start_dir=str(cwd))
     omit_filter = OmitFilter(omit_config) if omit_config.get("enabled", True) else None
 
@@ -247,7 +270,9 @@ def _apply_redaction(
         omit_filter=omit_filter,
     )
     filtered_lineage = filter_lineage_secrets(lineage=lineage, omit_filter=omit_filter)
-    filtered_git_context, git_detections = _filter_git_context(git_context, omit_filter)
+    filtered_git_context, git_detections = filter_git_context_secrets(
+        git_context=git_context, omit_filter=omit_filter
+    )
     detected.extend(git_detections)
     filtered_lineage, job_git_detections = _filter_job_git_repos(filtered_lineage, omit_filter)
     detected.extend(job_git_detections)
@@ -263,9 +288,57 @@ def _apply_redaction(
             "applied": applied,
             "warnings": [_redaction_warning(pattern_id) for pattern_id in warning_ids],
         },
+        omit_filter,
     )
 
 
+def _filter_label_secrets(
+    labels: list[dict[str, Any]],
+    omit_filter: OmitFilter | None,
+) -> tuple[list[dict[str, Any]], list[str]]:
+    """Run each label's ``metadata`` values through the same redaction as the rest
+    of the package before it is attached to ``package["labels"]``.
+
+    Labels are user-authored key/value metadata (e.g. metric labels synced onto a
+    published artifact) and, like commands and job metadata, can contain
+    accidentally-embedded secrets -- so they must not be published raw.
+    """
+    if omit_filter is None or not labels:
+        return labels, []
+
+    detections: list[str] = []
+    filtered_labels: list[dict[str, Any]] = []
+    for label in labels:
+        filtered_label = dict(label)
+        metadata = filtered_label.get("metadata")
+        if isinstance(metadata, dict):
+            filtered_metadata, metadata_detections = omit_filter.filter_metadata(metadata)
+            filtered_label["metadata"] = filtered_metadata
+            detections.extend(metadata_detections)
+        filtered_labels.append(filtered_label)
+
+    return filtered_labels, detections
+
+
+def _merge_redaction_detections(redaction: dict[str, Any], detections: list[str]) -> None:
+    """Fold additional detection pattern IDs into an already-built redaction summary.
+
+    Mutates ``redaction`` in place (it is the same dict object already referenced by
+    ``package["redaction"]``), so callers that build the package payload before all
+    redaction passes have run still end up with an accurate summary.
+    """
+    if not detections:
+        return
+    redaction["applied"] = True
+    warnings = redaction.setdefault("warnings", [])
+    existing_codes = {w["code"] for w in warnings if isinstance(w, dict) and "code" in w}
+    for pattern_id in sorted(set(detections)):
+        warning = _redaction_warning(pattern_id)
+        if warning["code"] not in existing_codes:
+            warnings.append(warning)
+            existing_codes.add(warning["code"])
+
+
 def _drop_local_remotes(
     lineage: LineageData, git_context: GitContext
 ) -> tuple[LineageData, GitContext]:
@@ -287,23 +360,6 @@ def _drop_local_remotes(
     return lineage, git_context
 
 
-def _filter_git_context(
-    git_context: GitContext,
-    omit_filter: OmitFilter | None,
-) -> tuple[GitContext, list[str]]:
-    if omit_filter is None or not git_context.repo:
-        return git_context, []
-    filtered_repo, detections = omit_filter.filter_git_url(git_context.repo)
-    return (
-        GitContext(
-            repo=filtered_repo,
-            commit=git_context.commit,
-            branch=git_context.branch,
-        ),
-        detections,
-    )
-
-
 def _filter_job_git_repos(
     lineage: LineageData,
     omit_filter: OmitFilter | None,

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/publish/secrets.py

@@ -34,6 +34,25 @@ def detect_lineage_secrets(
     return omit_filter.get_detection_summary(all_detections)
 
 
+def filter_git_context_secrets(
+    *,
+    git_context: GitContext,
+    omit_filter: OmitFilter | None,
+) -> tuple[GitContext, list[str]]:
+    """Return a git context copy with credentials redacted from the repo URL."""
+    if omit_filter is None or not git_context.repo:
+        return git_context, []
+    filtered_repo, detections = omit_filter.filter_git_url(git_context.repo)
+    return (
+        GitContext(
+            repo=filtered_repo,
+            commit=git_context.commit,
+            branch=git_context.branch,
+        ),
+        detections,
+    )
+
+
 def filter_lineage_secrets(
     *,
     lineage: LineageData,

{roar_cli-0.3.6 → roar_cli-0.3.7}/roar/application/query/__init__.py

@@ -13,6 +13,10 @@ _EXPORTS = {
     "LabelShowRequest": ".requests",
     "LabelSyncRequest": ".requests",
     "LabelUnsetRequest": ".requests",
+    "RemoteLabelHistoryRequest": ".requests",
+    "RemoteLabelSetRequest": ".requests",
+    "RemoteLabelShowRequest": ".requests",
+    "RemoteLabelUnsetRequest": ".requests",
     "LineageQueryRequest": ".requests",
     "LogQueryRequest": ".requests",
     "ShowQueryRequest": ".requests",
@@ -25,12 +29,20 @@ _EXPORTS = {
     "StatusSummary": ".results",
     "build_copy_labels_summary": ".label",
     "build_label_history_summary": ".label",
+    "build_remote_label_history_summary": ".label",
+    "build_remote_set_labels_summary": ".label",
+    "build_remote_show_labels_summary": ".label",
+    "build_remote_unset_labels_summary": ".label",
     "build_set_labels_summary": ".label",
     "build_show_labels_summary": ".label",
     "build_sync_labels_summary": ".label",
     "build_unset_labels_summary": ".label",
     "copy_labels": ".label",
     "label_history": ".label",
+    "remote_label_history": ".label",
+    "remote_set_labels": ".label",
+    "remote_show_labels": ".label",
+    "remote_unset_labels": ".label",
     "render_dag": ".dag",
     "render_lineage": ".lineage",
     "render_log": ".log",