splent-cli 1.28.2__tar.gz → 1.29.0__tar.gz

{splent_cli-1.28.2/src/splent_cli.egg-info → splent_cli-1.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.28.2
+Version: 1.29.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli

{splent_cli-1.28.2 → splent_cli-1.29.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.28.2"
+version = "1.29.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_build.py

@@ -88,6 +88,16 @@ OPTIONAL_DEPLOY_SETTINGS: tuple[tuple[str, str, tuple[str, ...]], ...] = (
             "trusted proxy. true forces it on every cookie, false never sets it.",
         ),
     ),
+    (
+        "SPLENT_IMAGE",
+        "git.splent.io/<org>/<product>:stable",
+        (
+            "Image the web service runs. Unset means the image built on this",
+            "host. Set it to the image a release publishes, tagged stable, to",
+            "run releases without building here. Every deploy pulls it, and the",
+            "autodeploy feature follows it.",
+        ),
+    ),
     (
         "MAX_CONTENT_LENGTH",
         "64M",
@@ -551,9 +561,34 @@ def _apply_restart_policy(svc_def: dict) -> None:
     svc_def["restart"] = RESTART_POLICY
 
 
+def resolve_product_placeholders(value: str, product: str, *, prod: bool) -> str:
+    """Resolve ``__PRODUCT__`` in a feature's value for this product.
+
+    ``__PRODUCT___web`` is the product's web container, which is
+    ``<product>_web`` in development and ``<product>_web_deploy`` in
+    production (the prod compose template names it). Every other
+    ``__PRODUCT__`` is the product name. product:build and
+    product:env --merge --prod both write .env.deploy, so both go through
+    this: the merge used to replace the plain name only and point a feature
+    at the development container's name in production.
+    """
+    if "__PRODUCT__" not in value:
+        return value
+    if prod:
+        value = value.replace("__PRODUCT___web", f"{product}_web_deploy")
+    return value.replace("__PRODUCT__", product)
+
+
+def local_or_registry_image(product: str) -> str:
+    """The web image of a deploy: ``SPLENT_IMAGE`` when set, else the local build."""
+    return "${SPLENT_IMAGE:-" + product + ":latest}"
+
+
 def apply_production_policies(compose_data: dict, product: str) -> dict:
     """Give every deployed service a restart policy, and the web and database
-    services a healthcheck, unless the compose file already set one.
+    services a healthcheck, unless the compose file already set one. The web
+    image becomes ``${SPLENT_IMAGE:-<product>:latest}``, so a host can run the
+    image a release published instead of building its own.
 
     Applied by product:build to the merged deploy compose, so every product
     gets it on its next build, whatever its docker-compose.prod.yml says and
@@ -570,6 +605,11 @@ def apply_production_policies(compose_data: dict, product: str) -> dict:
     )
     if web_name and isinstance(services[web_name], dict):
         services[web_name].setdefault("healthcheck", dict(WEB_HEALTHCHECK))
+        # The local build, unless .env.deploy names a registry image. Only the
+        # plain local name is rewritten: an image the product chose on purpose
+        # is left alone.
+        if services[web_name].get("image") == f"{product}:latest":
+            services[web_name]["image"] = local_or_registry_image(product)
 
     db_name = next(
         (n for n in (f"{product}_db_deploy", f"{product}_db") if n in services),
@@ -1109,10 +1149,7 @@ def product_build(no_image, skip_preflight):
     # share the product network, so the prod service cannot simply take the
     # dev name as an alias. The CLI owns both names, so it owns the mapping.
     for k, v in env_result.items():
-        if "__PRODUCT__" in v:
-            env_result[k] = v.replace(
-                "__PRODUCT___web", f"{product}_web_deploy"
-            ).replace("__PRODUCT__", product)
+        env_result[k] = resolve_product_placeholders(v, product, prod=True)
 
     # Remove __FEATURE_HOST_DIR__ variables — not needed in prod
     # (templates are baked into Docker images, no bind mounts)

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_create.py

@@ -13,7 +13,12 @@ from jinja2 import Environment, FileSystemLoader, select_autoescape
 
 from splent_cli.utils.path_utils import PathUtils
 from splent_cli.services import context, spl_store
-from splent_cli.utils.template_drift import is_reserved_repo_name, not_a_product_reason
+from splent_cli.utils.template_drift import (
+    DEFAULT_UPGRADE_SCHEDULE,
+    is_reserved_repo_name,
+    not_a_product_reason,
+)
+from splent_cli.utils.template_drift import _forge_host as _template_forge_host
 
 try:
     from importlib.metadata import version as _pkg_version
@@ -218,6 +223,10 @@ def make_product(name, spl_name, spl_doi, features_file, force):
         # Dropping it here made every product created this way fall back to
         # "<name>.uvl" and 404, with nothing local left that knew the real name.
         "spl_file": pin.file or "",
+        # The forge workflows. The same values product:sync-template --ci
+        # renders, so a new product does not start out drifted.
+        "forge_host": _template_forge_host(),
+        "upgrade_schedule": DEFAULT_UPGRADE_SCHEDULE,
         # Production persistence. These switch on the named-volume mounts in
         # the prod compose template so uploads survive redeploys. Products
         # scaffolded before these variables existed render without them and
@@ -304,6 +313,8 @@ def _write_product(env, name, base_path, template_ctx):
         "scripts/05_0_start_app_dev.sh": "product/product_05_0_start_app_dev.sh.j2",
         "scripts/05_1_start_app_prod.sh": "product/product_05_1_start_app_prod.sh.j2",
         ".gitignore": "product/product_.gitignore.j2",
+        ".forgejo/workflows/splent-validate.yml": "product/product_ci_validate.yml.j2",
+        ".forgejo/workflows/splent-upgrade.yml": "product/product_ci_upgrade.yml.j2",
         "LICENSE": "product/product_LICENSE.j2",
         "package.json": "product/product_package.json.j2",
         "pyproject.toml": "product/product_pyproject.toml.j2",

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_deploy.py

@@ -441,9 +441,18 @@ def product_deploy(down, ci):
                 )
                 continue
             if ci:
-                env_value = os.getenv(key)
+                # The environment first. Without it, whatever the interactive
+                # deploy would offer as a default is taken (a random string
+                # for a secret, the conventional database names), so a feature
+                # that ships a <SET> secret does not stop an unattended deploy.
+                # What only the operator knows still has to come from them.
+                env_value = os.getenv(key) or suggest_value(key, product)
                 if env_value:
                     env_vars[key] = env_value
+                    if not os.getenv(key):
+                        click.echo(
+                            click.style("  secret   ", dim=True) + f"{key} generated"
+                        )
                 else:
                     missing_vars.append(key)
             else:
@@ -624,6 +633,41 @@ def product_deploy(down, ci):
     # container starts.
     compose.ensure_network(compose.network_name(product))
 
+    # A registry image (SPLENT_IMAGE) is pulled first: Compose only pulls an
+    # image it does not have, so a host that already ran an older build of
+    # the same tag would otherwise redeploy that one.
+    image = (env_vars.get("SPLENT_IMAGE") or "").strip()
+    if "/" in image:
+        click.echo(click.style("  image    ", dim=True) + f"pulling {image}")
+        pulled = subprocess.run(
+            [
+                "docker",
+                "compose",
+                "-p",
+                compose.deploy_project_name(product),
+                "-f",
+                compose_path,
+                "--env-file",
+                env_path,
+                "pull",
+                f"{product}_web_deploy",
+            ],
+            capture_output=True,
+            text=True,
+            cwd=docker_dir,
+            env={**os.environ, **host_docker_dir_env(workspace, product)},
+        )
+        if pulled.returncode != 0:
+            click.secho(f"  Could not pull {image}.", fg="red")
+            detail = (pulled.stderr or pulled.stdout or "").strip().splitlines()
+            for line in detail[-5:]:
+                click.echo(f"    {line}")
+            click.echo(
+                "  Check SPLENT_IMAGE in docker/.env.deploy, and docker login to "
+                "that registry when the image is private."
+            )
+            raise SystemExit(1)
+
     click.echo(click.style("  deploying ", dim=True) + f"{product} (prod)...")
 
     try:

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_env.py

@@ -368,11 +368,18 @@ def product_env(generate, merge, env_name, process_all):
         # second product of the same line came up.
         merged["SPLENT_NETWORK"] = compose.network_name(product)
 
-        # Replace __PRODUCT__ placeholder with the actual product name
+        # Replace __PRODUCT__ placeholder with the actual product name.
+        # product_build imports this module, so the helper is imported here.
+        from splent_cli.commands.product.product_build import (
+            resolve_product_placeholders,
+        )
+
         product_replaced = []
         for k, v in merged.items():
             if "__PRODUCT__" in v:
-                merged[k] = v.replace("__PRODUCT__", product)
+                merged[k] = resolve_product_placeholders(
+                    v, product, prod=env_name == "prod"
+                )
                 product_replaced.append(k)
 
         if env_name == "prod":

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_release.py

@@ -1,5 +1,5 @@
 """
-product:release — Release a product with version bump, tag, GitHub/PyPI/Docker Hub.
+product:release, a product release: version bump, tag, forge, PyPI and the image.
 """
 
 import os
@@ -10,7 +10,7 @@ from splent_cli.commands.product.product_build import (
     build_production_image,
     production_dockerfile,
 )
-from splent_cli.services import context, release, release_gate
+from splent_cli.services import context, image_registry, release, release_gate
 from splent_cli.utils.proc import run, require_docker
 
 
@@ -51,19 +51,48 @@ def _guard_all_features_pinned(product_path: str):
     raise SystemExit(1)
 
 
-def release_docker_image(product: str, version: str, docker_dir: str):
-    """Build the production image and push it to Docker Hub.
+def release_targets(product: str, version: str, product_path: str, org: str):
+    """The registries this release pushes the image to, from the product's pyproject."""
+    try:
+        registries, mirrors = image_registry.declared_registries(
+            os.path.join(product_path, "pyproject.toml")
+        )
+    except image_registry.RegistryDeclarationError as e:
+        click.secho(f"  error: {e}", fg="red")
+        raise SystemExit(1)
+    return image_registry.image_targets(product, version, org, registries, mirrors)
+
+
+def _login(target) -> bool:
+    user, secret = target.credentials()
+    if not user or not secret:
+        return False
+    command = ["docker", "login", "-u", user, "--password-stdin"]
+    if target.host:
+        command.insert(2, target.host)
+    try:
+        run(command, input=secret, capture=True)
+    except subprocess.CalledProcessError:
+        return False
+    return True
+
+
+def release_docker_image(product: str, version: str, docker_dir: str, targets):
+    """Build the production image once and push it to every registry.
 
     Public because release:resume has to be able to finish this channel too:
     the image is pushed last, after the forge and PyPI are already
     irreversible.
 
     The image is the one product:build makes, docker/Dockerfile.<product>.prod
-    built with the workspace as context, so what Docker Hub serves is what a
-    deploy runs. Building ``docker_dir`` with no Dockerfile named would look
-    for docker/Dockerfile, which products do not have. build_production_image
-    stages the SPL's UVL model first, so the pushed image ships the model the
-    product pins even from a clean clone where product:build never ran.
+    built with the workspace as context, so what a registry serves is what a
+    deploy runs. build_production_image stages the SPL's UVL model first, so
+    the pushed image ships the model the product pins even from a clean clone
+    where product:build never ran.
+
+    Each registry gets the version tag and the ``stable`` channel tag (Docker
+    Hub also ``latest``). A required registry that refuses the login or the
+    push stops the release here; a mirror that does is reported and skipped.
     """
     require_docker()
 
@@ -76,50 +105,51 @@ def release_docker_image(product: str, version: str, docker_dir: str):
         )
         raise SystemExit(1)
 
-    username = os.getenv("DOCKERHUB_USERNAME")
-    password = os.getenv("DOCKERHUB_PASSWORD")
-    missing = [
-        name
-        for name, value in (
-            ("DOCKERHUB_USERNAME", username),
-            ("DOCKERHUB_PASSWORD", password),
-        )
-        if not value
-    ]
-    if missing:
+    usable = []
+    for target in targets:
+        click.echo(f"  docker   logging into {target.label}...")
+        if _login(target):
+            usable.append(target)
+            continue
+        if target.mirror:
+            click.secho(
+                f"  docker   the {target.label} mirror is left out, its login failed "
+                f"or {' / '.join(target.credential_names())} are not set",
+                fg="yellow",
+            )
+            continue
+        user_env, secret_env = target.credential_names()
         click.secho(
-            "  error: missing Docker Hub credentials: "
-            + ", ".join(missing)
-            + "\n  Set them in your environment (e.g. export DOCKERHUB_USERNAME=... "
-            "DOCKERHUB_PASSWORD=...) before releasing.",
+            f"  error: could not log into {target.label}. Check {user_env} and "
+            f"{secret_env}.",
             fg="red",
         )
         raise SystemExit(1)
 
-    image_name = f"{username}/{product}"
-
-    click.echo("  docker   logging into Docker Hub...")
-    run(
-        ["docker", "login", "-u", username, "--password-stdin"],
-        input=password,
-        capture=True,
-    )
-
+    refs = [ref for target in usable for ref in target.refs]
     click.echo("  docker   building image...")
     try:
-        build_production_image(
-            product,
-            str(context.workspace()),
-            docker_dir,
-            [f"{image_name}:{version}", f"{image_name}:latest"],
-        )
+        build_production_image(product, str(context.workspace()), docker_dir, refs)
     except subprocess.CalledProcessError:
         click.secho("  error: Docker image build failed.", fg="red")
         raise SystemExit(1)
 
-    click.echo("  docker   pushing images...")
-    run(["docker", "push", f"{image_name}:{version}"])
-    run(["docker", "push", f"{image_name}:latest"])
+    for target in usable:
+        click.echo(f"  docker   pushing to {target.label}...")
+        try:
+            for ref in target.refs:
+                run(["docker", "push", ref])
+        except subprocess.CalledProcessError:
+            if target.mirror:
+                click.secho(
+                    f"  docker   the push to the {target.label} mirror failed and is "
+                    "left out",
+                    fg="yellow",
+                )
+                continue
+            click.secho(f"  error: the push to {target.label} failed.", fg="red")
+            raise SystemExit(1)
+        click.echo(f"  docker   {', '.join(target.refs)}")
 
     click.echo("  docker   push complete")
 
@@ -139,7 +169,7 @@ def _left_out_flags(channels) -> list[str]:
 
 @click.command(
     "product:release",
-    short_help="Release a product: version bump, tag, forge/PyPI/Docker Hub.",
+    short_help="Release a product: version bump, tag, forge, PyPI and image registries.",
 )
 @click.argument("version", required=False, default=None)
 @click.option("--product", default=None, help="Override SPLENT_APP.")
@@ -210,7 +240,7 @@ def product_release(
         raise SystemExit(1)
     org, repo_name = parts
 
-    # Docker Hub is a third channel, and it is the one that publishes LAST, so
+    # The image is a third channel, and it is the one that publishes LAST, so
     # it is the one most able to diverge. It goes through the gate with the
     # others instead of being discovered at the end.
     channels = release.resolve_channels(
@@ -250,7 +280,12 @@ def product_release(
 
     def _docker_hook(_path, ver):
         if release_gate.DOCKER in channels:
-            release_docker_image(product, ver, docker_dir)
+            release_docker_image(
+                product,
+                ver,
+                docker_dir,
+                release_targets(product, ver, product_path, org),
+            )
 
     release.run_release_pipeline(
         product,
@@ -262,8 +297,9 @@ def product_release(
         channels=channels,
         resume_target=resume_target,
         allow_unfinished=allow_unfinished,
-        docker_image=f"{os.getenv('DOCKERHUB_USERNAME', '')}/{product}".lstrip("/")
-        or None,
+        image_targets=release_targets(product, version, product_path, org)
+        if release_gate.DOCKER in channels
+        else None,
         post_pypi_hook=_docker_hook,
         wait=wait,
     )

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/product/product_sync_template.py

@@ -37,6 +37,12 @@ from splent_cli.utils.template_drift import (
     is_flag=True,
     help="Update only docker/ files.",
 )
+@click.option(
+    "--ci",
+    "only_ci",
+    is_flag=True,
+    help="Update only the forge workflows in .forgejo/workflows/.",
+)
 @click.option(
     "--dry-run",
     is_flag=True,
@@ -48,6 +54,7 @@ def product_sync_template(
     only_scripts,
     only_entrypoints,
     only_docker,
+    only_ci,
     dry_run,
     yes,
 ):
@@ -60,6 +67,7 @@ def product_sync_template(
         splent product:sync-template myapp
         splent product:sync-template myapp --scripts
         splent product:sync-template myapp --docker
+        splent product:sync-template myapp --ci
         splent product:sync-template myapp --dry-run
         splent product:sync-template myapp --yes
     """
@@ -72,7 +80,7 @@ def product_sync_template(
     product_path = resolve_product_dir(workspace, product_name)
 
     # Select which groups to process
-    filter_active = only_scripts or only_entrypoints or only_docker
+    filter_active = only_scripts or only_entrypoints or only_docker or only_ci
     groups_to_run: dict[str, dict] = {}
     if not filter_active or only_scripts:
         groups_to_run["scripts"] = PRODUCT_GROUPS["scripts"]
@@ -80,6 +88,8 @@ def product_sync_template(
         groups_to_run["entrypoints"] = PRODUCT_GROUPS["entrypoints"]
     if not filter_active or only_docker:
         groups_to_run["docker"] = PRODUCT_GROUPS["docker"]
+    if not filter_active or only_ci:
+        groups_to_run["ci"] = PRODUCT_GROUPS["ci"]
 
     ctx = product_ctx(product_name)
 

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/release/release_resume.py

@@ -350,7 +350,11 @@ def release_resume(target, assume_yes, no_pypi, no_forge, no_github, no_docker,
         )
         raise SystemExit(1)
 
-    docker_image = _docker_image(label) if release_gate.DOCKER in channels else None
+    image_targets = (
+        _image_targets(label, normalized, path, repo)
+        if release_gate.DOCKER in channels
+        else None
+    )
 
     click.echo()
     click.secho(f"  Resuming {label} {tag}", bold=True)
@@ -377,7 +381,7 @@ def release_resume(target, assume_yes, no_pypi, no_forge, no_github, no_docker,
         version=normalized,
         channels=channels,
         resume=True,
-        docker_image=docker_image,
+        image_targets=image_targets,
     )
     release_gate.render(report)
 
@@ -526,7 +530,8 @@ def release_resume(target, assume_yes, no_pypi, no_forge, no_github, no_docker,
     if make_release:
         steps.append(f"create the release for {tag} on the forge")
     if push_image:
-        steps.append(f"build and push the Docker image {docker_image}:{normalized}")
+        refs = ", ".join(f"{t.repository}:{normalized}" for t in image_targets or [])
+        steps.append(f"build and push the Docker image {refs}")
     if make_snapshot:
         steps.append(f"create the local snapshot for {tag}")
 
@@ -670,7 +675,9 @@ def release_resume(target, assume_yes, no_pypi, no_forge, no_github, no_docker,
         from splent_cli.commands.product.product_release import release_docker_image
 
         product = label.split("/")[-1]
-        release_docker_image(product, normalized, os.path.join(path, "docker"))
+        release_docker_image(
+            product, normalized, os.path.join(path, "docker"), image_targets
+        )
 
     if make_snapshot:
         from splent_cli.commands.feature.feature_release import (
@@ -750,11 +757,11 @@ def _declares_pypi(pyproject: str) -> bool:
     return release_gate.PYPI in {release_gate.canonical_channel(c) for c in channels}
 
 
-def _docker_image(label: str) -> str | None:
-    username = os.getenv("DOCKERHUB_USERNAME")
-    if not username:
-        return None
-    return f"{username}/{label.split('/')[-1]}"
+def _image_targets(label: str, version: str, path: str, repo: str):
+    """The registries the product's image goes to, as product:release names them."""
+    from splent_cli.commands.product.product_release import release_targets
+
+    return release_targets(label.split("/")[-1], version, path, repo.split("/")[0])
 
 
 cli_command = release_resume

{splent_cli-1.28.2 → splent_cli-1.29.0}/src/splent_cli/commands/tokens_setup.py

@@ -43,7 +43,10 @@ def tokens():
         click.echo(f"    1. Go to {forge.host()} → Settings → Applications")
         click.echo("       → Access Tokens")
         click.echo("    2. Generate new token")
-        click.echo("    3. Enable scopes: write:repository and write:organization")
+        click.echo(
+            "    3. Enable scopes: write:repository, write:organization and "
+            "write:package (product images go to the forge registry)"
+        )
         click.echo("    4. Copy the token (shown only once)")
         click.echo()
         click.secho("  Add to your .env:", fg="bright_black")