spaceforge 0.0.3__tar.gz → 0.0.4__tar.gz

{spaceforge-0.0.3 → spaceforge-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spaceforge
-Version: 0.0.3
+Version: 0.0.4
 Summary: A Python framework for building Spacelift plugins
 Home-page: https://github.com/spacelift-io/plugins
 Author: Spacelift
@@ -28,6 +28,7 @@ License-File: LICENSE
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pydantic>=2.11.7
+Requires-Dist: Jinja2>=3.1.0
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
@@ -584,6 +585,15 @@ export SPACEFORGE_PARAM_SEVERITY_THRESHOLD="high"
 spaceforge runner after_plan
 ```
 
+## Speeding up plugin execution
+
+There are a few things you can do to speed up plugin execution.
+
+1. Ensure your runner has `spaceforge` preinstalled. This will avoid the overhead of installing it during the run. (15-30 seconds)
+2. If youre using binaries, we will only install the binary if its not found. You can gain a few seconds by ensuring its already on the runner.
+3. If your plugin has a lot of dependencies, consider using a prebuilt runner image with your plugin and its dependencies installed. This avoids the overhead of installing them during each run.
+4. Ensure your runner has enough core resources (CPU, memory) to handle the plugin execution efficiently. If your plugin is resource-intensive, consider using a more powerful runner.
+
 ## Next Steps
 
 1. **Install spaceforge:** `pip install spaceforge`

{spaceforge-0.0.3 → spaceforge-0.0.4}/README.md

@@ -540,6 +540,15 @@ export SPACEFORGE_PARAM_SEVERITY_THRESHOLD="high"
 spaceforge runner after_plan
 ```
 
+## Speeding up plugin execution
+
+There are a few things you can do to speed up plugin execution.
+
+1. Ensure your runner has `spaceforge` preinstalled. This will avoid the overhead of installing it during the run. (15-30 seconds)
+2. If youre using binaries, we will only install the binary if its not found. You can gain a few seconds by ensuring its already on the runner.
+3. If your plugin has a lot of dependencies, consider using a prebuilt runner image with your plugin and its dependencies installed. This avoids the overhead of installing them during each run.
+4. Ensure your runner has enough core resources (CPU, memory) to handle the plugin execution efficiently. If your plugin is resource-intensive, consider using a more powerful runner.
+
 ## Next Steps
 
 1. **Install spaceforge:** `pip install spaceforge`

{spaceforge-0.0.3 → spaceforge-0.0.4}/plugins/sops/plugin.yaml

@@ -131,10 +131,59 @@ contexts:
                   except Exception as e:
                       self.logger.error(f"An unexpected error occurred: {e}")
     sensitive: false
+  - path: /mnt/workspace/plugins/sops/binary_install_sops.sh
+    content: |-
+      #!/bin/sh
+
+      set -e
+
+      if command -v sops; then
+          echo "sops is already installed."
+          return
+      fi
+
+      mkdir -p /mnt/workspace/plugins/plugin_binaries
+
+      echo "Installing sops..."
+      mkdir -p /mnt/workspace/plugins/plugin_binaries
+      cd /mnt/workspace/plugins/plugin_binaries
+
+      if [ "$(arch)" = "x86_64" ]; then
+          curl https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.amd64 -o /mnt/workspace/plugins/plugin_binaries/sops -L
+      else
+          curl https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.arm64 -o /mnt/workspace/plugins/plugin_binaries/sops -L
+      fi
+
+      chmod +x /mnt/workspace/plugins/plugin_binaries/sops
+      cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+    sensitive: false
+  - path: /mnt/workspace/plugins/sops/before_init.sh
+    content: |-
+      #!/bin/sh
+
+      set -e
+
+      cd /mnt/workspace/plugins/sops
+
+      if [ ! -d "./venv" ]; then
+          python -m venv ./venv
+      fi
+      . venv/bin/activate
+
+      if ! command -v spaceforge; then
+          pip install spaceforge
+      fi
+
+      if [ -f requirements.txt ] && [ ! -f .spaceforge_installed_requirements ]; then
+          pip install -r requirements.txt
+          touch .spaceforge_installed_requirements
+      fi
+
+      cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+      spaceforge runner --plugin-file /mnt/workspace/plugins/sops/plugin.py before_init
+    sensitive: false
   hooks:
     before_init:
     - mkdir -p /mnt/workspace/plugins/sops
-    - cd /mnt/workspace/plugins/sops && python -m venv ./venv && source venv/bin/activate && pip install spaceforge
-    - pip install -r requirements.txt
-    - mkdir -p /mnt/workspace/plugins/plugin_binaries && cd /mnt/workspace/plugins/plugin_binaries && ([[ "$(echo "$(arch)")" == "x86_64" ]] && curl https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.amd64 -o /mnt/workspace/plugins/plugin_binaries/sops -L && chmod +x /mnt/workspace/plugins/plugin_binaries/sops || curl https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.arm64 -o /mnt/workspace/plugins/plugin_binaries/sops -L && chmod +x /mnt/workspace/plugins/plugin_binaries/sops) && cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
-    - cd /mnt/workspace/source/$TF_VAR_spacelift_project_root && python -m spaceforge runner --plugin-file /mnt/workspace/plugins/sops/plugin.py before_init
+    - chmod +x /mnt/workspace/plugins/sops/binary_install_sops.sh && /mnt/workspace/plugins/sops/binary_install_sops.sh
+    - chmod +x /mnt/workspace/plugins/sops/before_init.sh && /mnt/workspace/plugins/sops/before_init.sh

{spaceforge-0.0.3 → spaceforge-0.0.4}/plugins/wiz/plugin.py

@@ -89,7 +89,7 @@ webhook[{"endpoint_id": "wiz-alert-endpoint"}] {
 }
             """,
             labels={
-                "policy_type": "security"
+                "wiz-plugin"
             }
         )
     ]

{spaceforge-0.0.3 → spaceforge-0.0.4}/plugins/wiz/plugin.yaml

@@ -135,7 +135,7 @@ contexts:
       }
                   """,
                   labels={
-                      "policy_type": "security"
+                      "wiz-plugin"
                   }
               )
           ]
@@ -227,13 +227,63 @@ contexts:
                       markdown += f"<a href=\"{stdout_json['reportUrl']}\" rel=\"noopener noreferrer\">View Report</a>\n"
                   self.send_markdown(markdown)
     sensitive: false
+  - path: /mnt/workspace/plugins/wiz/binary_install_wizcli.sh
+    content: |-
+      #!/bin/sh
+
+      set -e
+
+      if command -v wizcli; then
+          echo "wizcli is already installed."
+          return
+      fi
+
+      mkdir -p /mnt/workspace/plugins/plugin_binaries
+
+      echo "Installing wizcli..."
+      mkdir -p /mnt/workspace/plugins/plugin_binaries
+      cd /mnt/workspace/plugins/plugin_binaries
+
+      if [ "$(arch)" = "x86_64" ]; then
+          curl https://downloads.wiz.io/wizcli/0.94.0/wizcli-linux-amd64 -o /mnt/workspace/plugins/plugin_binaries/wizcli -L
+      else
+          curl https://downloads.wiz.io/wizcli/0.94.0/wizcli-linux-arm64 -o /mnt/workspace/plugins/plugin_binaries/wizcli -L
+      fi
+
+      chmod +x /mnt/workspace/plugins/plugin_binaries/wizcli
+      cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+    sensitive: false
+  - path: /mnt/workspace/plugins/wiz/before_plan.sh
+    content: |-
+      #!/bin/sh
+
+      set -e
+
+      cd /mnt/workspace/plugins/wiz
+
+      if [ ! -d "./venv" ]; then
+          python -m venv ./venv
+      fi
+      . venv/bin/activate
+
+      if command -v spaceforge; then
+          pip install spaceforge
+      fi
+
+      if [ -f requirements.txt ] && [ ! -f .spaceforge_installed_requirements ]; then
+          pip install -r requirements.txt
+          touch .spaceforge_installed_requirements
+      fi
+
+      cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+      spaceforge runner --plugin-file /mnt/workspace/plugins/wiz/plugin.py before_plan
+    sensitive: false
   hooks:
     before_init:
     - mkdir -p /mnt/workspace/plugins/wiz
-    - mkdir -p /mnt/workspace/plugins/plugin_binaries && cd /mnt/workspace/plugins/plugin_binaries && ([[ "$(echo "$(arch)")" == "x86_64" ]] && curl https://downloads.wiz.io/wizcli/0.94.0/wizcli-linux-amd64 -o /mnt/workspace/plugins/plugin_binaries/wizcli -L && chmod +x /mnt/workspace/plugins/plugin_binaries/wizcli || curl https://downloads.wiz.io/wizcli/0.94.0/wizcli-linux-arm64 -o /mnt/workspace/plugins/plugin_binaries/wizcli -L && chmod +x /mnt/workspace/plugins/plugin_binaries/wizcli) && cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+    - chmod +x /mnt/workspace/plugins/wiz/binary_install_wizcli.sh && /mnt/workspace/plugins/wiz/binary_install_wizcli.sh
     before_plan:
-    - cd /mnt/workspace/plugins/wiz && python -m venv ./venv && source venv/bin/activate && pip install spaceforge
-    - cd /mnt/workspace/source/$TF_VAR_spacelift_project_root && python -m spaceforge runner --plugin-file /mnt/workspace/plugins/wiz/plugin.py before_plan
+    - chmod +x /mnt/workspace/plugins/wiz/before_plan.sh && /mnt/workspace/plugins/wiz/before_plan.sh
 policies:
 - name_prefix: wiz_policy
   type: notification
@@ -245,4 +295,4 @@ policies:
       input.run_updated.run.marked_unsafe == true
     }
   labels:
-    policy_type: security
+  - wiz-plugin

{spaceforge-0.0.3 → spaceforge-0.0.4}/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
     "PyYAML>=6.0",
     "click>=8.0.0", 
     "pydantic>=2.11.7",
+    "Jinja2>=3.1.0",
 ]
 
 [project.optional-dependencies]

{spaceforge-0.0.3 → spaceforge-0.0.4}/setup.py

@@ -43,6 +43,7 @@ setup(
         "PyYAML>=6.0",
         "click>=8.0.0",
         "pydantic>=2.11.7",
+        "Jinja2>=3.1.0",
     ],
     extras_require={
         "dev": [

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/_version_scm.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.0.3'
-__version_tuple__ = version_tuple = (0, 0, 3)
+__version__ = version = '0.0.4'
+__version_tuple__ = version_tuple = (0, 0, 4)
 
-__commit_id__ = commit_id = 'ge171bdb88'
+__commit_id__ = commit_id = 'g46df965db'

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/cls.py

@@ -118,7 +118,7 @@ class Context:
     Attributes:
         name_prefix (str): The name of the context, will be appended with a unique ID.
         description (str): A description of the context.
-        labels (dict): Labels associated with the context.
+        labels (Optional[List[str]]): Labels associated with the context.
         env (list): List of variables associated with the context.
         hooks (dict): Hooks associated with the context.
     """
@@ -128,7 +128,7 @@ class Context:
     env: Optional[List[Variable]] = optional_field
     mounted_files: Optional[List[MountedFile]] = optional_field
     hooks: Optional[Dict[HookType, List[str]]] = optional_field
-    labels: Optional[Dict[str, str]] = optional_field
+    labels: Optional[List[str]] = optional_field
 
 
 @pydantic_dataclass
@@ -139,14 +139,14 @@ class Webhook:
     Attributes:
         name_prefix (str): The name of the webhook, will be appended with a unique ID.
         endpoint (str): The URL endpoint for the webhook.
-        labels (Optional[dict]): Labels associated with the webhook.
-        secrets (Optional[list[Variable]]): List of secrets associated with the webhook.
+        labels (Optional[List[str]]): Labels associated with the webhook.
+        secret (str): the ID of the parameter where the webhook secret is retrieved from
     """
 
     name_prefix: str
     endpoint: str
-    labels: Optional[Dict[str, str]] = optional_field
-    secrets: Optional[List[Variable]] = optional_field
+    secretFromParameter: str
+    labels: Optional[List[str]] = optional_field
 
 
 @pydantic_dataclass
@@ -158,13 +158,13 @@ class Policy:
         name_prefix (str): The name of the policy, will be appended with a unique ID.
         type (str): The type of the policy (e.g., "terraform", "kubernetes").
         body (str): The body of the policy, typically a configuration or script.
-        labels (Optional[dict[str, str]]): Labels associated with the policy.
+        labels (Optional[List[str]]): Labels associated with the policy.
     """
 
     name_prefix: str
     type: str
     body: str
-    labels: Optional[Dict[str, str]] = optional_field
+    labels: Optional[List[str]] = optional_field
 
 
 @pydantic_dataclass

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/generator.py

@@ -7,6 +7,7 @@ import os
 from typing import TYPE_CHECKING, Any, Dict, List, Optional, Type, Union
 
 import yaml
+from jinja2 import Environment, PackageLoader, select_autoescape
 
 if TYPE_CHECKING:
     from .plugin import SpaceforgePlugin
@@ -47,6 +48,9 @@ class PluginGenerator:
         self.plugin_instance: Optional[SpaceforgePlugin] = None
         self.plugin_working_directory: Optional[str] = None
         self.config: Optional[Dict[str, Any]] = None
+        self.jinja = Environment(
+            loader=PackageLoader("spaceforge"), autoescape=select_autoescape()
+        )
 
     def load_plugin(self) -> None:
         """Load the plugin class from the specified path."""
@@ -84,7 +88,7 @@ class PluginGenerator:
         self.config = {
             "setup_virtual_env": (
                 f"cd {self.plugin_working_directory} && python -m venv ./venv && "
-                + "source venv/bin/activate && pip install spaceforge"
+                + "source venv/bin/activate && (command -v spaceforge &> /dev/null || pip install spaceforge)"
             ),
             "plugin_mounted_path": f"{self.plugin_working_directory}/{os.path.basename(self.plugin_path)}",
         }
@@ -137,14 +141,27 @@ class PluginGenerator:
 
         return hook_methods
 
-    def _update_with_requirements(
-        self, hooks: Dict[str, List[str]], mounted_files: List[MountedFile]
+    def _add_to_mounted_files(
+        self,
+        hooks: Dict[str, List[str]],
+        mounted_files: List[MountedFile],
+        phase: str,
+        filepath: str,
+        filecontent: str,
     ) -> None:
+        file = f"{self.plugin_working_directory}/{filepath}"
+        hooks[phase].append(f"chmod +x {file} && {file}")
+        mounted_files.append(
+            MountedFile(
+                path=f"{self.plugin_working_directory}/{filepath}",
+                content=filecontent,
+                sensitive=False,
+            )
+        )
+
+    def _update_with_requirements(self, mounted_files: List[MountedFile]) -> None:
         """Update the plugin hooks if there is a requirements.txt"""
         if os.path.exists("requirements.txt") and self.config is not None:
-            if self.config["setup_virtual_env"] not in hooks["before_init"]:
-                hooks["before_init"].append(self.config["setup_virtual_env"])
-            hooks["before_init"].append(f"pip install -r requirements.txt")
             # read the requirements.txt file
             with open("requirements.txt", "r") as f:
                 mounted_files.append(
@@ -167,7 +184,9 @@ class PluginGenerator:
                     )
                 )
 
-    def _add_spaceforge_hooks(self, hooks: Dict[str, List[str]]) -> None:
+    def _add_spaceforge_hooks(
+        self, hooks: Dict[str, List[str]], mounted_files: List[MountedFile]
+    ) -> None:
         # Add the spaceforge hook to actually run the plugin
         if self.config is None:
             raise ValueError("Plugin config not set. Call load_plugin() first.")
@@ -178,12 +197,14 @@ class PluginGenerator:
             if hook not in hooks:
                 hooks[hook] = []
 
-            if self.config["setup_virtual_env"] not in hooks[hook]:
-                hooks[hook].append(self.config["setup_virtual_env"])
-
-            hooks[hook].append(
-                f"cd /mnt/workspace/source/$TF_VAR_spacelift_project_root && python -m spaceforge runner --plugin-file {self.config['plugin_mounted_path']} {hook}"
+            directory = os.path.dirname(self.config["plugin_mounted_path"])
+            template = self.jinja.get_template("ensure_spaceforge_and_run.sh.j2")
+            render = template.render(
+                plugin_path=directory,
+                plugin_file=self.config["plugin_mounted_path"],
+                phase=hook,
             )
+            self._add_to_mounted_files(hooks, mounted_files, hook, f"{hook}.sh", render)
 
     def _map_variables_to_parameters(self, contexts: List[Context]) -> None:
         for context in contexts:
@@ -221,10 +242,10 @@ class PluginGenerator:
         }
         mounted_files: List[MountedFile] = []
 
-        self._update_with_requirements(hooks, mounted_files)
+        self._update_with_requirements(mounted_files)
         self._update_with_python_file(mounted_files)
-        self._generate_binary_install_command(hooks)
-        self._add_spaceforge_hooks(hooks)
+        self._generate_binary_install_command(hooks, mounted_files)
+        self._add_spaceforge_hooks(hooks, mounted_files)
 
         # Get the contexts and append the hooks and mounted files to it.
         if self.plugin_class is None:
@@ -256,46 +277,38 @@ class PluginGenerator:
 
         return contexts
 
-    def _generate_binary_install_command(self, hooks: Dict[str, List[str]]) -> None:
+    def _generate_binary_install_command(
+        self, hooks: Dict[str, List[str]], mounted_files: List[MountedFile]
+    ) -> None:
         binaries = self.get_plugin_binaries()
         if binaries is None:
             return None
 
-        binary_cmd = ""
-        if len(binaries) > 0:
-            binary_cmd = f"mkdir -p {static_binary_directory} && cd {static_binary_directory} && "
         for i, binary in enumerate(binaries):
             amd64_url = binary.download_urls.get("amd64", None)
             arm64_url = binary.download_urls.get("arm64", None)
+            binary_path = f"{static_binary_directory}/{binary.name}"
             if amd64_url is None and arm64_url is None:
                 raise ValueError(
                     f"Binary {binary.name} must have at least one download URL defined (amd64 or arm64)"
                 )
 
-            binary_path = f"{static_binary_directory}/{binary.name}"
-            amd64_download_command = (
-                f"curl {amd64_url} -o {binary_path} -L && chmod +x {binary_path}"
-                if amd64_url is not None
-                else "echo 'amd64 binary not available' && exit 1"
-            )
-            arm64_download_command = (
-                f"curl {arm64_url} -o {binary_path} -L && chmod +x {binary_path}"
-                if arm64_url is not None
-                else "echo 'arm64 binary not available' && exit 1"
+            template = self.jinja.get_template("binary_install.sh.j2")
+            render = template.render(
+                binary=binary,
+                amd64_url=amd64_url,
+                arm64_url=arm64_url,
+                binary_path=binary_path,
+                static_binary_directory=static_binary_directory,
             )
-
-            binary_cmd += (
-                '([[ "$(echo "$(arch)")" == "x86_64" ]] && {} || {}) && '.format(
-                    amd64_download_command, arm64_download_command
-                )
+            self._add_to_mounted_files(
+                hooks,
+                mounted_files,
+                "before_init",
+                f"binary_install_{binary.name}.sh",
+                render,
             )
 
-        if binary_cmd != "":
-            binary_cmd += "cd /mnt/workspace/source/$TF_VAR_spacelift_project_root"
-
-        hooks["before_init"].append(binary_cmd)
-        return None
-
     def get_plugin_binaries(self) -> Optional[List[Binary]]:
         """Get binary definitions from the plugin class."""
         return getattr(self.plugin_class, "__binaries__", None)

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/plugin.py

@@ -263,12 +263,13 @@ class SpaceforgePlugin(ABC):
             self._spacelift_markdown_endpoint,
             json.dumps(body).encode("utf-8"),
             headers,
+            method="POST",
         )
 
         with urllib.request.urlopen(req) as response:
             if response.status != 200:
                 self.logger.error(
-                    f"Error getting signed URL for markdown upload: {response.status}"
+                    f"Error getting signed URL for markdown upload: {response}"
                 )
                 return
 

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/schema.json

@@ -1,7 +1,7 @@
 {
   "$defs": {
     "Context": {
-      "description": "A class to represent a context for a plugin.\n\nAttributes:\n    name_prefix (str): The name of the context, will be appended with a unique ID.\n    description (str): A description of the context.\n    labels (dict): Labels associated with the context.\n    env (list): List of variables associated with the context.\n    hooks (dict): Hooks associated with the context.",
+      "description": "A class to represent a context for a plugin.\n\nAttributes:\n    name_prefix (str): The name of the context, will be appended with a unique ID.\n    description (str): A description of the context.\n    labels (Optional[List[str]]): Labels associated with the context.\n    env (list): List of variables associated with the context.\n    hooks (dict): Hooks associated with the context.",
       "properties": {
         "name_prefix": {
           "title": "Name Prefix",
@@ -74,10 +74,10 @@
         "labels": {
           "anyOf": [
             {
-              "additionalProperties": {
+              "items": {
                 "type": "string"
               },
-              "type": "object"
+              "type": "array"
             },
             {
               "type": "null"
@@ -163,7 +163,7 @@
       "type": "object"
     },
     "Policy": {
-      "description": "A class to represent a policy configuration.\n\nAttributes:\n    name_prefix (str): The name of the policy, will be appended with a unique ID.\n    type (str): The type of the policy (e.g., \"terraform\", \"kubernetes\").\n    body (str): The body of the policy, typically a configuration or script.\n    labels (Optional[dict[str, str]]): Labels associated with the policy.",
+      "description": "A class to represent a policy configuration.\n\nAttributes:\n    name_prefix (str): The name of the policy, will be appended with a unique ID.\n    type (str): The type of the policy (e.g., \"terraform\", \"kubernetes\").\n    body (str): The body of the policy, typically a configuration or script.\n    labels (Optional[List[str]]): Labels associated with the policy.",
       "properties": {
         "name_prefix": {
           "title": "Name Prefix",
@@ -180,10 +180,10 @@
         "labels": {
           "anyOf": [
             {
-              "additionalProperties": {
+              "items": {
                 "type": "string"
               },
-              "type": "object"
+              "type": "array"
             },
             {
               "type": "null"
@@ -242,7 +242,7 @@
       "type": "object"
     },
     "Webhook": {
-      "description": "A class to represent a webhook configuration.\n\nAttributes:\n    name_prefix (str): The name of the webhook, will be appended with a unique ID.\n    endpoint (str): The URL endpoint for the webhook.\n    labels (Optional[dict]): Labels associated with the webhook.\n    secrets (Optional[list[Variable]]): List of secrets associated with the webhook.",
+      "description": "A class to represent a webhook configuration.\n\nAttributes:\n    name_prefix (str): The name of the webhook, will be appended with a unique ID.\n    endpoint (str): The URL endpoint for the webhook.\n    labels (Optional[List[str]]): Labels associated with the webhook.\n    secret (str): the ID of the parameter where the webhook secret is retrieved from",
       "properties": {
         "name_prefix": {
           "title": "Name Prefix",
@@ -252,25 +252,15 @@
           "title": "Endpoint",
           "type": "string"
         },
-        "labels": {
-          "anyOf": [
-            {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            {
-              "type": "null"
-            }
-          ],
-          "title": "Labels"
+        "secretFromParameter": {
+          "title": "Secretfromparameter",
+          "type": "string"
         },
-        "secrets": {
+        "labels": {
           "anyOf": [
             {
               "items": {
-                "$ref": "#/$defs/Variable"
+                "type": "string"
               },
               "type": "array"
             },
@@ -278,12 +268,13 @@
               "type": "null"
             }
           ],
-          "title": "Secrets"
+          "title": "Labels"
         }
       },
       "required": [
         "name_prefix",
-        "endpoint"
+        "endpoint",
+        "secretFromParameter"
       ],
       "title": "Webhook",
       "type": "object"

spaceforge-0.0.4/spaceforge/templates/binary_install.sh.j2

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+if command -v {{binary.name}}; then
+    echo "{{binary.name}} is already installed."
+    return
+fi
+
+mkdir -p {{static_binary_directory}}
+
+echo "Installing {{binary.name}}..."
+mkdir -p {{static_binary_directory}}
+cd {{static_binary_directory}}
+
+if [ "$(arch)" = "x86_64" ]; then
+    curl {{amd64_url}} -o {{binary_path}} -L
+else
+    curl {{arm64_url}} -o {{binary_path}} -L
+fi
+
+chmod +x {{binary_path}}
+cd /mnt/workspace/source/$TF_VAR_spacelift_project_root

spaceforge-0.0.4/spaceforge/templates/ensure_spaceforge_and_run.sh.j2

@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -e
+
+cd {{plugin_path}}
+
+if [ ! -d "./venv" ]; then
+    python -m venv ./venv
+fi
+. venv/bin/activate
+
+if ! command -v spaceforge; then
+    pip install spaceforge
+fi
+
+if [ -f requirements.txt ] && [ ! -f .spaceforge_installed_requirements ]; then
+    pip install -r requirements.txt
+    touch .spaceforge_installed_requirements
+fi
+
+cd /mnt/workspace/source/$TF_VAR_spacelift_project_root
+spaceforge runner --plugin-file {{plugin_file}} {{phase}}

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/test_generator.py

@@ -1,6 +1,6 @@
 import os
 import tempfile
-from typing import Dict, List
+from typing import Any, Dict, List
 from unittest.mock import Mock, mock_open, patch
 
 import pytest
@@ -55,7 +55,7 @@ class PluginExample(SpaceforgePlugin):
         Context(
             name_prefix="test_context",
             description="Test context",
-            labels={"env": "test"},
+            labels=["env:test"],
             env=[Variable(key="TEST_VAR", value="test_value")],
         )
     ]
@@ -64,7 +64,8 @@ class PluginExample(SpaceforgePlugin):
         Webhook(
             name_prefix="test_webhook",
             endpoint="https://webhook.example.com",
-            secrets=[Variable(key="SECRET_KEY", value_from_parameter="api_key")],
+            secretFromParameter="api_key",
+            labels=["type:notification"],
         )
     ]
 
@@ -73,7 +74,7 @@ class PluginExample(SpaceforgePlugin):
             name_prefix="test_policy",
             type="notification",
             body="package test",
-            labels={"type": "security"},
+            labels=["type:security"],
         )
     ]
 
@@ -325,14 +326,25 @@ class NotAPlugin:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
-        generator._generate_binary_install_command(hooks)
-        command = hooks["before_init"][-1]
+        mounted_files: List = []
+        generator._generate_binary_install_command(hooks, mounted_files)
 
-        assert "mkdir -p /mnt/workspace/plugins/plugin_binaries" in command
-        assert "curl https://example.com/test-cli-amd64" in command
-        assert "curl https://example.com/test-cli-arm64" in command
-        assert "arch" in command
-        assert "x86_64" in command
+        # Should have added a script execution to hooks
+        assert len(hooks["before_init"]) == 1
+        command = hooks["before_init"][0]
+
+        # Should have added a mounted file with script content
+        assert len(mounted_files) == 1
+        script_content = mounted_files[0].content
+
+        # Check that hook command runs the script
+        assert "chmod +x" in command
+        assert "binary_install_test-cli.sh" in command
+
+        # Check script content contains binary installation logic
+        assert "test-cli" in script_content
+        assert "https://example.com/test-cli-amd64" in script_content
+        assert "https://example.com/test-cli-arm64" in script_content
 
     def test_generate_binary_install_command_no_binaries(self) -> None:
         """Test binary command generation when no binaries."""
@@ -349,9 +361,11 @@ class NotAPlugin:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
-        generator._generate_binary_install_command(hooks)
-        # No binaries should mean no new commands added
+        mounted_files: List = []
+        generator._generate_binary_install_command(hooks, mounted_files)
+        # No binaries should mean no new commands or files added
         assert len(hooks["before_init"]) == 0
+        assert len(mounted_files) == 0
 
     def test_generate_binary_install_command_missing_urls(self) -> None:
         """Test binary command generation with missing URLs."""
@@ -368,8 +382,9 @@ class NotAPlugin:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
+        mounted_files: List = []
         with pytest.raises(ValueError, match="must have at least one download URL"):
-            generator._generate_binary_install_command(hooks)
+            generator._generate_binary_install_command(hooks, mounted_files)
 
     def test_get_plugin_policies(self) -> None:
         """Test policy extraction."""
@@ -397,37 +412,50 @@ class NotAPlugin:
         assert webhooks[0].endpoint == "https://webhook.example.com"
 
     @patch("os.path.exists")
-    @patch("builtins.open", new_callable=mock_open, read_data="requirements content")
-    def test_get_plugin_contexts_with_requirements(
-        self, mock_file: Mock, mock_exists: Mock
-    ) -> None:
+    def test_get_plugin_contexts_with_requirements(self, mock_exists: Mock) -> None:
         """Test context generation with requirements.txt."""
         mock_exists.side_effect = (
             lambda path: path == "requirements.txt" or "plugin.py" in path
         )
 
-        generator = PluginGenerator(self.test_plugin_path)
-        generator.plugin_class = PluginExample
-        generator.plugin_working_directory = "/mnt/workspace/plugins/test_plugin"
-        generator.config = {
-            "setup_virtual_env": "cd /mnt/workspace/plugins/test_plugin && python -m venv ./venv && source venv/bin/activate && pip install spaceforge",
-            "plugin_mounted_path": "/mnt/workspace/plugins/test_plugin/plugin.py",
-        }
+        # Mock specific file contents with a custom open function
+        original_open = open
+
+        def mock_open_func(filename: str, *args: Any, **kwargs: Any) -> Any:
+            if filename == "requirements.txt":
+                from io import StringIO
+
+                return StringIO("requirements content")
+            elif "plugin.py" in filename:
+                from io import StringIO
 
-        contexts = generator.get_plugin_contexts()
+                return StringIO("plugin content")
+            else:
+                return original_open(filename, *args, **kwargs)
+
+        with patch("builtins.open", side_effect=mock_open_func):
+            generator = PluginGenerator(self.test_plugin_path)
+            generator.plugin_class = PluginExample
+            generator.plugin_working_directory = "/mnt/workspace/plugins/test_plugin"
+            generator.config = {
+                "setup_virtual_env": "cd /mnt/workspace/plugins/test_plugin && python -m venv ./venv && source venv/bin/activate && pip install spaceforge",
+                "plugin_mounted_path": "/mnt/workspace/plugins/test_plugin/plugin.py",
+            }
+
+            contexts = generator.get_plugin_contexts()
 
         assert len(contexts) == 1
         context = contexts[0]
 
-        # Should have before_init hooks for venv setup
+        # Should have before_init hooks with mkdir command
         assert context.hooks is not None
         assert "before_init" in context.hooks
-        venv_command = None
+        mkdir_command = None
         for cmd in context.hooks["before_init"]:
-            if "python -m venv" in cmd:
-                venv_command = cmd
+            if "mkdir -p" in cmd:
+                mkdir_command = cmd
                 break
-        assert venv_command is not None
+        assert mkdir_command is not None
 
         # Should have requirements.txt as mounted file
         assert context.mounted_files is not None
@@ -439,26 +467,44 @@ class NotAPlugin:
         assert req_file is not None
         assert req_file.content == "requirements content"
 
+        # Should have plugin.py as mounted file
+        plugin_file = None
+        for mf in context.mounted_files:
+            if "plugin.py" in mf.path:
+                plugin_file = mf
+                break
+        assert plugin_file is not None
+        assert plugin_file.content == "plugin content"
+
     @patch("os.path.exists")
-    @patch("builtins.open", new_callable=mock_open, read_data="plugin content")
-    def test_get_plugin_contexts_basic(
-        self, mock_file: Mock, mock_exists: Mock
-    ) -> None:
+    def test_get_plugin_contexts_basic(self, mock_exists: Mock) -> None:
         """Test basic context generation."""
         mock_exists.side_effect = lambda path: "plugin.py" in path
 
-        generator = PluginGenerator(self.test_plugin_path)
-        generator.plugin_class = PluginExample
-        generator.plugin_working_directory = "/mnt/workspace/plugins/test_plugin"
-        generator.config = {
-            "setup_virtual_env": "cd /mnt/workspace/plugins/test_plugin && python -m venv ./venv && source venv/bin/activate && pip install spaceforge",
-            "plugin_mounted_path": "/mnt/workspace/plugins/test_plugin/plugin.py",
-        }
-
-        with patch.object(
-            generator, "get_available_hooks", return_value=["after_plan"]
-        ):
-            contexts = generator.get_plugin_contexts()
+        # Mock specific file contents with a custom open function
+        original_open = open
+
+        def mock_open_func(filename: str, *args: Any, **kwargs: Any) -> Any:
+            if "plugin.py" in filename:
+                from io import StringIO
+
+                return StringIO("plugin content")
+            else:
+                return original_open(filename, *args, **kwargs)
+
+        with patch("builtins.open", side_effect=mock_open_func):
+            generator = PluginGenerator(self.test_plugin_path)
+            generator.plugin_class = PluginExample
+            generator.plugin_working_directory = "/mnt/workspace/plugins/test_plugin"
+            generator.config = {
+                "setup_virtual_env": "cd /mnt/workspace/plugins/test_plugin && python -m venv ./venv && source venv/bin/activate && pip install spaceforge",
+                "plugin_mounted_path": "/mnt/workspace/plugins/test_plugin/plugin.py",
+            }
+
+            with patch.object(
+                generator, "get_available_hooks", return_value=["after_plan"]
+            ):
+                contexts = generator.get_plugin_contexts()
 
         assert len(contexts) == 1
         context = contexts[0]
@@ -472,12 +518,24 @@ class NotAPlugin:
                 break
         assert plugin_file is not None
 
-        # Should have spacepy runner hooks
+        # Should have hooks for after_plan (the hook we mocked as available)
         assert context.hooks is not None
         assert "after_plan" in context.hooks
-        runner_command = context.hooks["after_plan"][1]
-        assert "python -m spaceforge runner" in runner_command
-        assert "after_plan" in runner_command
+
+        # Should have a script execution command
+        hook_command = context.hooks["after_plan"][0]
+        assert "chmod +x" in hook_command
+        assert "after_plan.sh" in hook_command
+
+        # Should have a mounted script file for after_plan
+        after_plan_script = None
+        for mf in context.mounted_files:
+            if "after_plan.sh" in mf.path:
+                after_plan_script = mf
+                break
+        assert after_plan_script is not None
+        assert "spaceforge runner" in after_plan_script.content
+        assert "after_plan" in after_plan_script.content
 
     def test_generate_manifest(self) -> None:
         """Test complete manifest generation."""
@@ -646,11 +704,23 @@ class TestPluginGeneratorEdgeCases:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
-        generator._generate_binary_install_command(hooks)
-        command = hooks["before_init"][-1]
+        mounted_files: List = []
+        generator._generate_binary_install_command(hooks, mounted_files)
+
+        # Should have added a script execution to hooks
+        assert len(hooks["before_init"]) == 1
+        command = hooks["before_init"][0]
 
-        assert "https://example.com/binary-amd64" in command
-        assert "arm64 binary not available" in command
+        # Should have added a mounted file with script content
+        assert len(mounted_files) == 1
+        script_content = mounted_files[0].content
+
+        # Check that hook command runs the script
+        assert "chmod +x" in command
+        assert "binary_install_single-arch.sh" in command
+
+        # Check script content contains the binary URL
+        assert "https://example.com/binary-amd64" in script_content
 
     def test_context_merging_with_existing(self) -> None:
         """Test that generated hooks are merged with existing context hooks."""
@@ -683,10 +753,21 @@ class TestPluginGeneratorEdgeCases:
             "plugin_mounted_path": "/mnt/workspace/plugins/existing_hooks/plugin.py",
         }
 
+        # Mock specific file contents with a custom open function
+        original_open = open
+
+        def mock_open_func(filename: str, *args: Any, **kwargs: Any) -> Any:
+            if filename == "/fake/path":
+                from io import StringIO
+
+                return StringIO("fake content")
+            else:
+                return original_open(filename, *args, **kwargs)
+
         with patch("os.path.exists") as mock_exists:
             # Only plugin file exists, not requirements.txt
             mock_exists.side_effect = lambda path: path == "/fake/path"
-            with patch("builtins.open", mock_open(read_data="fake content")):
+            with patch("builtins.open", side_effect=mock_open_func):
                 contexts = generator.get_plugin_contexts()
 
         context = contexts[0]
@@ -702,11 +783,20 @@ class TestPluginGeneratorEdgeCases:
         assert len(existing_files) == 1
 
         # Plugin file should be mounted (path contains the working directory)
-        plugin_files = [
+        # The new implementation creates both plugin.py and hook scripts
+        working_dir_files = [
             mf
             for mf in context.mounted_files
             if "/mnt/workspace/plugins/existing_hooks" in mf.path
         ]
+        assert (
+            len(working_dir_files) >= 1
+        )  # At least plugin.py, possibly hook scripts too
+
+        # Specifically check for plugin.py
+        plugin_files = [
+            mf for mf in context.mounted_files if mf.path.endswith("plugin.py")
+        ]
         assert len(plugin_files) == 1
 
         # Should have existing env vars
@@ -767,10 +857,21 @@ class TestPluginGeneratorEdgeCases:
             "plugin_mounted_path": "/mnt/workspace/plugins/parametersandvariables/plugin.py",
         }
 
+        # Mock specific file contents with a custom open function
+        original_open = open
+
+        def mock_open_func(filename: str, *args: Any, **kwargs: Any) -> Any:
+            if filename == "/fake/path":
+                from io import StringIO
+
+                return StringIO("fake content")
+            else:
+                return original_open(filename, *args, **kwargs)
+
         with patch("os.path.exists") as mock_exists:
             # Only plugin file exists, not requirements.txt
             mock_exists.side_effect = lambda path: path == "/fake/path"
-            with patch("builtins.open", mock_open(read_data="fake content")):
+            with patch("builtins.open", side_effect=mock_open_func):
                 contexts = generator.get_plugin_contexts()
                 parameters = generator.get_plugin_parameters()
 

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge/test_generator_binaries.py

@@ -80,17 +80,28 @@ class TestPluginGeneratorBinaries:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
+        mounted_files: List = []
 
         # Act
-        generator._generate_binary_install_command(hooks)
-        command = hooks["before_init"][-1]
+        generator._generate_binary_install_command(hooks, mounted_files)
 
         # Assert
-        assert "mkdir -p /mnt/workspace/plugins/plugin_binaries" in command
-        assert "curl https://example.com/multi-cli-amd64" in command
-        assert "curl https://example.com/multi-cli-arm64" in command
-        assert "arch" in command
-        assert "x86_64" in command
+        # Should have added a script execution to hooks
+        assert len(hooks["before_init"]) == 1
+        command = hooks["before_init"][0]
+
+        # Should have added a mounted file with script content
+        assert len(mounted_files) == 1
+        script_content = mounted_files[0].content
+
+        # Check that hook command runs the script
+        assert "chmod +x" in command
+        assert "binary_install_multi-cli.sh" in command
+
+        # Check script content contains binary installation logic
+        assert "multi-cli" in script_content
+        assert "https://example.com/multi-cli-amd64" in script_content
+        assert "https://example.com/multi-cli-arm64" in script_content
 
     def test_should_not_add_commands_when_no_binaries(self) -> None:
         """Should not add installation commands when plugin has no binaries."""
@@ -108,12 +119,15 @@ class TestPluginGeneratorBinaries:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
+        mounted_files: List = []
 
         # Act
-        generator._generate_binary_install_command(hooks)
+        generator._generate_binary_install_command(hooks, mounted_files)
 
         # Assert
+        # No binaries should mean no new commands or files added
         assert len(hooks["before_init"]) == 0
+        assert len(mounted_files) == 0
 
     def test_should_raise_error_when_binary_has_no_download_urls(self) -> None:
         """Should raise ValueError when binary has empty download URLs."""
@@ -131,10 +145,11 @@ class TestPluginGeneratorBinaries:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
+        mounted_files: List = []
 
         # Act & Assert
         with pytest.raises(ValueError, match="must have at least one download URL"):
-            generator._generate_binary_install_command(hooks)
+            generator._generate_binary_install_command(hooks, mounted_files)
 
     def test_should_handle_single_architecture_binary(self) -> None:
         """Should generate appropriate commands for single architecture binary."""
@@ -157,11 +172,23 @@ class TestPluginGeneratorBinaries:
         }
 
         hooks: Dict[str, List[str]] = {"before_init": []}
+        mounted_files: List = []
 
         # Act
-        generator._generate_binary_install_command(hooks)
-        command = hooks["before_init"][-1]
+        generator._generate_binary_install_command(hooks, mounted_files)
 
         # Assert
-        assert "https://example.com/binary-amd64" in command
-        assert "arm64 binary not available" in command
+        # Should have added a script execution to hooks
+        assert len(hooks["before_init"]) == 1
+        command = hooks["before_init"][0]
+
+        # Should have added a mounted file with script content
+        assert len(mounted_files) == 1
+        script_content = mounted_files[0].content
+
+        # Check that hook command runs the script
+        assert "chmod +x" in command
+        assert "binary_install_single-arch.sh" in command
+
+        # Check script content contains the binary URL
+        assert "https://example.com/binary-amd64" in script_content

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spaceforge
-Version: 0.0.3
+Version: 0.0.4
 Summary: A Python framework for building Spacelift plugins
 Home-page: https://github.com/spacelift-io/plugins
 Author: Spacelift
@@ -28,6 +28,7 @@ License-File: LICENSE
 Requires-Dist: PyYAML>=6.0
 Requires-Dist: click>=8.0.0
 Requires-Dist: pydantic>=2.11.7
+Requires-Dist: Jinja2>=3.1.0
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
@@ -584,6 +585,15 @@ export SPACEFORGE_PARAM_SEVERITY_THRESHOLD="high"
 spaceforge runner after_plan
 ```
 
+## Speeding up plugin execution
+
+There are a few things you can do to speed up plugin execution.
+
+1. Ensure your runner has `spaceforge` preinstalled. This will avoid the overhead of installing it during the run. (15-30 seconds)
+2. If youre using binaries, we will only install the binary if its not found. You can gain a few seconds by ensuring its already on the runner.
+3. If your plugin has a lot of dependencies, consider using a prebuilt runner image with your plugin and its dependencies installed. This avoids the overhead of installing them during each run.
+4. Ensure your runner has enough core resources (CPU, memory) to handle the plugin execution efficiently. If your plugin is resource-intensive, consider using a more powerful runner.
+
 ## Next Steps
 
 1. **Install spaceforge:** `pip install spaceforge`

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge.egg-info/SOURCES.txt

@@ -47,4 +47,6 @@ spaceforge.egg-info/dependency_links.txt
 spaceforge.egg-info/entry_points.txt
 spaceforge.egg-info/not-zip-safe
 spaceforge.egg-info/requires.txt
-spaceforge.egg-info/top_level.txt
+spaceforge.egg-info/top_level.txt
+spaceforge/templates/binary_install.sh.j2
+spaceforge/templates/ensure_spaceforge_and_run.sh.j2

{spaceforge-0.0.3 → spaceforge-0.0.4}/spaceforge.egg-info/requires.txt

@@ -1,6 +1,7 @@
 PyYAML>=6.0
 click>=8.0.0
 pydantic>=2.11.7
+Jinja2>=3.1.0
 
 [dev]
 pytest>=6.0

{spaceforge-0.0.3 → spaceforge-0.0.4}/test.sh

@@ -3,7 +3,7 @@
 set -e
 
 echo "Setting up dev dependencies..."
-pip install ".[dev]"
+pip install -e ".[dev]"
 
 echo "Running pytests..."
 python -m pytest spaceforge/ -v