stackops 8.103__tar.gz → 26.6__tar.gz

{stackops-8.103 → stackops-26.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stackops
-Version: 8.103
+Version: 26.6
 Summary: Developer Stack Manager
 Author-email: Alex Al-Saffar <programmer@usa.com>
 License: Apache 2.0

{stackops-8.103 → stackops-26.6}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "stackops"
-version = "8.103"
+version = "26.6"
 description = "Developer Stack Manager"
 readme = "README.md"
 license = {text = "Apache 2.0"}

stackops-26.6/src/manual/test_agents_skill_impl.py

@@ -0,0 +1,44 @@
+from pathlib import Path
+
+import pytest
+
+from stackops.scripts.python.helpers.helpers_agents.agents_skill_impl import (
+    build_agent_skill_install_commands,
+    is_supported_agent_skill_name,
+    parse_requested_skill_agent_targets,
+    render_agent_skill_install_script,
+    supported_agent_skill_names,
+)
+
+
+def test_stackops_skill_is_supported() -> None:
+    assert is_supported_agent_skill_name(skill_name="stackops")
+    assert "stackops" in supported_agent_skill_names()
+
+
+def test_stackops_skill_install_command_selects_repo_skill() -> None:
+    assert build_agent_skill_install_commands(skill_names=("stackops",), agent_targets=(), scope="local") == (
+        ("bunx", "skills@latest", "add", "https://github.com/thisismygitrepo/stackops", "--skill", "stackops", "--yes"),
+    )
+
+
+def test_existing_skill_install_command_shape_is_preserved() -> None:
+    assert build_agent_skill_install_commands(skill_names=("caveman",), agent_targets=("codex",), scope="global") == (
+        ("bunx", "skills@latest", "add", "JuliusBrussee/caveman", "--yes", "--global", "--agent", "codex"),
+    )
+
+
+def test_agent_targets_are_comma_separated_without_empty_entries() -> None:
+    assert parse_requested_skill_agent_targets(raw_value="codex,github-copilot") == ("codex", "github-copilot")
+    with pytest.raises(ValueError, match="without empty entries"):
+        parse_requested_skill_agent_targets(raw_value="codex,")
+
+
+def test_render_install_script_quotes_install_root() -> None:
+    script = render_agent_skill_install_script(
+        install_root=Path("/tmp/StackOps Skills"),
+        commands=build_agent_skill_install_commands(skill_names=("stackops",), agent_targets=("codex",), scope="local"),
+    )
+
+    assert script.startswith("cd '/tmp/StackOps Skills'\n")
+    assert "bunx skills@latest add https://github.com/thisismygitrepo/stackops --skill stackops --yes --agent codex" in script

stackops-26.6/src/manual/test_cli_config_secrets.py

@@ -0,0 +1,390 @@
+import json
+from inspect import Parameter, signature
+from pathlib import Path
+from typing import get_args
+
+import pytest
+from typer.testing import CliRunner
+
+from stackops.scripts.python.helpers.helpers_devops import cli_config, cli_config_secrets
+from stackops.scripts.python.helpers.helpers_devops.cli_config_secrets_interactive import InteractivePickerOption
+
+
+def test_config_secrets_is_nested_typer_app() -> None:
+    runner = CliRunner()
+
+    result = runner.invoke(cli_config.get_app(), ["secrets", "--help"])
+
+    assert result.exit_code == 0
+    assert "Usage: root secrets [OPTIONS] COMMAND [ARGS]..." in result.output
+    assert "search" in result.output
+    assert "stats" in result.output
+    assert "subset" in result.output
+    assert "add" in result.output
+    assert "edit" in result.output
+    assert "Examples:" not in result.output
+
+
+def test_config_secrets_search_help_has_examples() -> None:
+    runner = CliRunner()
+
+    result = runner.invoke(cli_config.get_app(), ["secrets", "search", "--help"])
+
+    assert result.exit_code == 0
+    assert "Usage: root secrets search [OPTIONS] [TERMS]..." in result.output
+    assert "Examples:" in result.output
+    assert "devops config secrets search aws dev iam-access-key" in result.output
+    assert "devops config secrets add" not in result.output
+    assert "devops config secrets edit" not in result.output
+
+
+def test_secrets_search_keeps_selector_aliases() -> None:
+    parameters = signature(cli_config_secrets.search).parameters
+    expected_aliases = {
+        "secrets_path": "-p",
+        "secrets_source": "-s",
+        "interactive": "-i",
+        "preview_secrets": "-P",
+        "verbose": "-v",
+        "login_name": "-n",
+        "secret_name": "-N",
+        "tags": "-t",
+        "login_tags": "-l",
+        "secret_tags": "-T",
+        "scopes": "-S",
+        "keys": "-k",
+    }
+
+    for parameter_name, alias in expected_aliases.items():
+        assert alias in _option_param_decls(parameters[parameter_name])
+    assert "add" not in parameters
+    assert "edit" not in parameters
+    assert "create" not in parameters
+    assert "editor" not in parameters
+
+
+def test_secrets_add_and_edit_have_short_aliases() -> None:
+    stats_parameters = signature(cli_config_secrets.stats).parameters
+    subset_parameters = signature(cli_config_secrets.subset).parameters
+    add_parameters = signature(cli_config_secrets.add).parameters
+    edit_parameters = signature(cli_config_secrets.edit).parameters
+
+    assert "-p" in _option_param_decls(stats_parameters["secrets_path"])
+    assert "-s" in _option_param_decls(stats_parameters["secrets_source"])
+    assert "-d" in _option_param_decls(stats_parameters["details"])
+    assert "-o" in _option_param_decls(subset_parameters["output_path"])
+    assert "-p" in _option_param_decls(subset_parameters["secrets_path"])
+    assert "-s" in _option_param_decls(subset_parameters["secrets_source"])
+    assert "-f" in _option_param_decls(subset_parameters["overwrite"])
+    assert "-P" in _option_param_decls(subset_parameters["preview_secrets"])
+    assert "-p" in _option_param_decls(add_parameters["secrets_path"])
+    assert "-s" in _option_param_decls(add_parameters["secrets_source"])
+    assert "-p" in _option_param_decls(edit_parameters["secrets_path"])
+    assert "-s" in _option_param_decls(edit_parameters["secrets_source"])
+    assert "-E" in _option_param_decls(edit_parameters["editor"])
+
+
+def test_secrets_search_writes_selected_env_handoff(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    secrets_path = tmp_path / "secrets.json"
+    secrets_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "aws-dev",
+                        "tags": ["aws", "dev"],
+                        "secrets": [
+                            {
+                                "name": "iam-access-key",
+                                "tags": ["iam-access-key"],
+                                "scopes": ["aws"],
+                                "keyValues": {"AWS_ACCESS_KEY_ID": "dummy-key"},
+                            }
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    handoff: list[dict[str, object]] = []
+    monkeypatch.setattr(cli_config_secrets.secret_actions, "write_env_handoff", handoff.append)
+
+    cli_config_secrets.search(terms=["aws", "dev"], secrets_path=secrets_path, secrets_source="local")
+
+    assert handoff == [{"AWS_ACCESS_KEY_ID": "dummy-key"}]
+
+
+def test_secrets_stats_uses_aggregate_tables_without_secret_values(tmp_path: Path) -> None:
+    secrets_path = tmp_path / "secrets.json"
+    secrets_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "service-login",
+                        "tags": ["team-a"],
+                        "description": "Used by service tests",
+                        "secrets": [
+                            {
+                                "name": "service-token",
+                                "tags": ["api"],
+                                "scopes": ["ci"],
+                                "keyValues": {
+                                    "SERVICE_TOKEN": "super-secret-token",
+                                    "SERVICE_PAYLOAD": {"nested": "do-not-print"},
+                                },
+                                "rotation": {"lastRotated": "2026-01-01", "rotateEveryDays": 90},
+                            }
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    runner = CliRunner()
+
+    result = runner.invoke(cli_config_secrets.get_app(), ["stats", "--path", str(secrets_path), "--source", "local"])
+
+    assert result.exit_code == 0
+    assert "StackOps Secrets Sources" in result.output
+    assert "Inventory Totals" in result.output
+    assert "Metadata Coverage" in result.output
+    assert "Env Vars" in result.output
+    assert "2" in result.output
+    assert str(secrets_path) not in result.output
+    assert "super-secret-token" not in result.output
+    assert "do-not-print" not in result.output
+    assert "SERVICE_TOKEN" not in result.output
+    assert "service-login" not in result.output
+    assert "service-token" not in result.output
+
+
+def test_secrets_subset_writes_selected_entries_without_printing_secret_values(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    secrets_path = tmp_path / "source-secrets.json"
+    output_path = tmp_path / "subset" / "secrets.json"
+    secrets_path.write_text(
+        json.dumps(
+            {
+                "$schema": "./secrets.schema.json",
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "first-login",
+                        "tags": ["team-a"],
+                        "secrets": [
+                            {
+                                "name": "first-token",
+                                "tags": ["api"],
+                                "scopes": ["dev"],
+                                "keyValues": {"FIRST_TOKEN": "first-secret-value"},
+                            }
+                        ],
+                    },
+                    {
+                        "name": "second-login",
+                        "tags": ["team-b"],
+                        "secrets": [
+                            {
+                                "name": "second-token",
+                                "tags": ["api"],
+                                "scopes": ["prod"],
+                                "keyValues": {"SECOND_TOKEN": "second-secret-value"},
+                            }
+                        ],
+                    },
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(
+        cli_config_secrets.secret_actions,
+        "_choose_subset_login_indices",
+        lambda *, secrets_file, source_path, preview_secrets: [1],
+    )
+    runner = CliRunner()
+
+    result = runner.invoke(
+        cli_config_secrets.get_app(),
+        ["subset", "--path", str(secrets_path), "--source", "local", "--output", str(output_path)],
+    )
+
+    assert result.exit_code == 0
+    assert "second-secret-value" not in result.output
+    subset_payload = json.loads(output_path.read_text(encoding="utf-8"))
+    assert subset_payload["$schema"] == "./secrets.schema.json"
+    assert subset_payload["version"] == "0.5"
+    assert [entry["name"] for entry in subset_payload["entries"]] == ["second-login"]
+    assert subset_payload["entries"][0]["secrets"][0]["keyValues"] == {"SECOND_TOKEN": "second-secret-value"}
+
+
+def test_secrets_subset_refuses_to_overwrite_by_default(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    secrets_path = tmp_path / "source-secrets.json"
+    output_path = tmp_path / "subset-secrets.json"
+    secrets_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "service-login",
+                        "secrets": [
+                            {
+                                "name": "service-token",
+                                "keyValues": {"SERVICE_TOKEN": "source-secret-value"},
+                            }
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    output_path.write_text("existing\n", encoding="utf-8")
+    monkeypatch.setattr(
+        cli_config_secrets.secret_actions,
+        "_choose_subset_login_indices",
+        lambda *, secrets_file, source_path, preview_secrets: [0],
+    )
+    runner = CliRunner()
+
+    result = runner.invoke(
+        cli_config_secrets.get_app(),
+        ["subset", "--path", str(secrets_path), "--source", "local", "--output", str(output_path)],
+    )
+
+    assert result.exit_code == 1
+    assert output_path.read_text(encoding="utf-8") == "existing\n"
+
+
+def test_secrets_subset_preview_matches_search_style_without_secret_values(tmp_path: Path) -> None:
+    source_path = tmp_path / "source-secrets.json"
+    output_path = tmp_path / "subset-secrets.json"
+    source_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "shared-login",
+                        "tags": ["team-a"],
+                        "secrets": [
+                            {
+                                "name": "first-token",
+                                "tags": ["api"],
+                                "scopes": ["dev"],
+                                "keyValues": {"FIRST_TOKEN": "first-secret-value"},
+                            },
+                            {
+                                "name": "second-token",
+                                "tags": ["ops"],
+                                "scopes": ["prod"],
+                                "keyValues": {"SECOND_TOKEN": "second-secret-value"},
+                            },
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    captured_picker_options: list[InteractivePickerOption[int]] = []
+
+    def capture_picker_options(
+        options: list[InteractivePickerOption[int]],
+        *,
+        missing_tool_message: str,
+        missing_selection_message: str,
+    ) -> list[int]:
+        assert missing_tool_message == "Interactive subset selection requires `tv` on PATH."
+        assert missing_selection_message == "Interactive selection did not map to a secrets entry"
+        captured_picker_options.extend(options)
+        return [0]
+
+    monkeypatch = pytest.MonkeyPatch()
+    monkeypatch.setattr(cli_config_secrets.secret_actions, "choose_interactive_options", capture_picker_options)
+    try:
+        result = CliRunner().invoke(
+            cli_config_secrets.get_app(),
+            ["subset", "--path", str(source_path), "--source", "local", "--output", str(output_path)],
+        )
+    finally:
+        monkeypatch.undo()
+
+    assert result.exit_code == 0
+    assert len(captured_picker_options) == 1
+    assert captured_picker_options[0].label == "shared-login -> FIRST_TOKEN, SECOND_TOKEN"
+    assert "# shared-login -> FIRST_TOKEN, SECOND_TOKEN" in captured_picker_options[0].preview
+    assert f"- File: `{source_path}`" in captured_picker_options[0].preview
+    assert "- Login: `shared-login`" in captured_picker_options[0].preview
+    assert "- Env vars: `FIRST_TOKEN, SECOND_TOKEN`" in captured_picker_options[0].preview
+    assert "### first-token" in captured_picker_options[0].preview
+    assert "### second-token" in captured_picker_options[0].preview
+    assert "first-secret-value" not in captured_picker_options[0].preview
+    assert "second-secret-value" not in captured_picker_options[0].preview
+
+
+def test_secrets_subset_preview_secrets_includes_login_entry_json(tmp_path: Path) -> None:
+    source_path = tmp_path / "source-secrets.json"
+    output_path = tmp_path / "subset-secrets.json"
+    source_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "shared-login",
+                        "tags": ["team-a"],
+                        "secrets": [
+                            {
+                                "name": "first-token",
+                                "tags": ["api"],
+                                "scopes": ["dev"],
+                                "keyValues": {"FIRST_TOKEN": "first-secret-value"},
+                            }
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    captured_picker_options: list[InteractivePickerOption[int]] = []
+
+    def capture_picker_options(
+        options: list[InteractivePickerOption[int]],
+        *,
+        missing_tool_message: str,
+        missing_selection_message: str,
+    ) -> list[int]:
+        assert missing_tool_message == "Interactive subset selection requires `tv` on PATH."
+        assert missing_selection_message == "Interactive selection did not map to a secrets entry"
+        captured_picker_options.extend(options)
+        return [0]
+
+    monkeypatch = pytest.MonkeyPatch()
+    monkeypatch.setattr(cli_config_secrets.secret_actions, "choose_interactive_options", capture_picker_options)
+    try:
+        result = CliRunner().invoke(
+            cli_config_secrets.get_app(),
+            ["subset", "--path", str(source_path), "--source", "local", "--output", str(output_path), "--preview-secrets"],
+        )
+    finally:
+        monkeypatch.undo()
+
+    assert result.exit_code == 0
+    assert len(captured_picker_options) == 1
+    assert "## Login entry" in captured_picker_options[0].preview
+    assert '"FIRST_TOKEN": "first-secret-value"' in captured_picker_options[0].preview
+
+
+def _option_param_decls(parameter: Parameter) -> tuple[str, ...]:
+    for metadata in get_args(parameter.annotation)[1:]:
+        param_decls = getattr(metadata, "param_decls", ())
+        if param_decls:
+            return tuple(param_decls)
+    raise AssertionError(f"Parameter has no Typer option metadata: {parameter.name}")

stackops-26.6/src/manual/test_cli_self_clone.py

@@ -0,0 +1,58 @@
+from inspect import Parameter, signature
+from pathlib import Path
+from typing import get_args
+
+from typer.testing import CliRunner
+
+from stackops.scripts.python.helpers.helpers_devops import cli_self
+
+
+def test_self_clone_command_is_registered() -> None:
+    runner = CliRunner()
+
+    help_result = runner.invoke(cli_self.get_app(), ["--help"])
+    alias_result = runner.invoke(cli_self.get_app(), ["c", "--help"])
+
+    assert help_result.exit_code == 0
+    assert "clone" in help_result.stdout
+    assert "<c>" in help_result.stdout
+    assert alias_result.exit_code == 0
+    assert "--remote" in alias_result.stdout
+    assert "--dry-run" in alias_result.stdout
+
+
+def test_self_clone_options_have_nice_aliases() -> None:
+    parameters = signature(cli_self.clone).parameters
+    expected_aliases = {
+        "remote": "-r",
+        "branch": "-b",
+        "depth": "-d",
+        "pull": "-p",
+        "install_editable": "-i",
+        "dry_run": "-n",
+    }
+
+    for parameter_name, alias in expected_aliases.items():
+        assert alias in _option_param_decls(parameters[parameter_name])
+
+
+def test_self_clone_defaults_to_current_directory(tmp_path: Path, monkeypatch) -> None:
+    monkeypatch.chdir(tmp_path)
+
+    result = CliRunner().invoke(
+        cli_self.get_app(),
+        ["clone", "--dry-run", "--ssh", "--branch", "main", "--depth", "1"],
+    )
+
+    assert result.exit_code == 0
+    assert f"git clone --branch main --depth 1 git@github.com:thisismygitrepo/stackops.git {tmp_path}" in result.stdout
+    assert "Dry run only" in result.stdout
+    assert not tmp_path.joinpath(".git").exists()
+
+
+def _option_param_decls(parameter: Parameter) -> tuple[str, ...]:
+    for metadata in get_args(parameter.annotation)[1:]:
+        param_decls = getattr(metadata, "param_decls", ())
+        if param_decls:
+            return tuple(param_decls)
+    raise AssertionError(f"Parameter has no Typer option metadata: {parameter.name}")

stackops-26.6/src/manual/test_cli_self_docker.py

@@ -0,0 +1,151 @@
+import json
+from inspect import Parameter, signature
+from pathlib import Path
+from typing import get_args
+
+import pytest
+
+from stackops.scripts.python.helpers.helpers_devops import cli_self, cli_self_docker
+
+
+def test_build_docker_options_have_one_letter_aliases() -> None:
+    parameters = signature(cli_self.build_docker).parameters
+    expected_aliases = {
+        "docker_login_name": "-n",
+        "docker_account_name": "-a",
+        "docker_secret_name": "-N",
+        "docker_secret_tags": "-T",
+        "docker_scopes": "-S",
+        "docker_token_key": "-k",
+        "docker_secrets_path": "-p",
+    }
+
+    for parameter_name, alias in expected_aliases.items():
+        assert alias in _option_param_decls(parameters[parameter_name])
+    assert parameters["docker_login_name"].default == "docker"
+    assert "docker_tags" not in parameters
+    assert "docker_login_tags" not in parameters
+
+
+def test_docker_credentials_use_login_username(monkeypatch: pytest.MonkeyPatch) -> None:
+    calls: list[dict[str, object]] = []
+
+    def fake_search_logins(**kwargs: object) -> list[dict[str, object]]:
+        calls.append(kwargs)
+        if kwargs["keys"] != ("DOCKER_TOKEN",):
+            return []
+        return [
+            {
+                "name": "docker",
+                "tags": ["docker"],
+                "username": "alice",
+                "secrets": [
+                    {
+                        "name": "publish",
+                        "tags": ["docker"],
+                        "scopes": ["docker"],
+                        "keyValues": {"DOCKER_TOKEN": "dummy-token"},
+                    }
+                ],
+            }
+        ]
+
+    monkeypatch.setattr(cli_self_docker, "search_logins", fake_search_logins)
+
+    credentials = cli_self_docker.resolve_docker_credentials(
+        secrets_path=None,
+        login_name=None,
+        account_name=None,
+        secret_name=None,
+        secret_tags=None,
+        scopes=None,
+        token_key=None,
+    )
+
+    assert credentials.username == "alice"
+    assert credentials.token_env_key == "DOCKER_TOKEN"
+    assert credentials.key_values == {"DOCKER_TOKEN": "dummy-token"}
+    assert calls[0]["login_name"] == "docker"
+
+
+def test_docker_credentials_resolve_through_search_logins_with_temp_file(tmp_path: Path) -> None:
+    secrets_path = tmp_path / "secrets.json"
+    secrets_path.write_text(
+        json.dumps(
+            {
+                "version": "0.5",
+                "entries": [
+                    {
+                        "name": "docker",
+                        "tags": ["docker"],
+                        "username": "alice",
+                        "secrets": [
+                            {
+                                "name": "publish",
+                                "tags": ["docker"],
+                                "scopes": ["docker"],
+                                "keyValues": {"DOCKER_TOKEN": "dummy-token"},
+                            }
+                        ],
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    credentials = cli_self_docker.resolve_docker_credentials(
+        secrets_path=secrets_path,
+        login_name=None,
+        account_name=None,
+        secret_name=None,
+        secret_tags=None,
+        scopes=None,
+        token_key=None,
+    )
+
+    assert credentials.login_name == "docker"
+    assert credentials.secret_name == "publish"
+    assert credentials.username == "alice"
+    assert credentials.token_env_key == "DOCKER_TOKEN"
+
+
+def test_rendered_docker_handoff_script_does_not_include_secret_values(tmp_path: Path) -> None:
+    script = cli_self_docker.render_build_docker_shell_script(
+        variant="slim",
+        repo_root=tmp_path / "repo",
+        script_path=tmp_path / "repo/jobs/shell/docker_build_and_publish.sh",
+        secret_env_path=tmp_path / "handoff.docker.secrets.env.sh",
+        docker_username="alice",
+        token_env_key="DOCKER_TOKEN",
+        credential_env_keys=("DOCKER_TOKEN",),
+    )
+
+    assert "dummy-token" not in script
+    assert "statistician" not in script
+    assert "export DOCKER_IMAGE_NAMESPACE=alice" in script
+    assert "export DOCKER_LOGIN_TOKEN_ENV_VAR=DOCKER_TOKEN" in script
+    assert "unset DOCKER_TOKEN" in script
+
+
+def test_docker_publish_script_no_longer_hardcodes_namespace() -> None:
+    script = Path("jobs/shell/docker_build_and_publish.sh").read_text(encoding="utf-8")
+
+    assert "statistician" not in script
+    assert "DOCKER_IMAGE_NAMESPACE" in script
+    assert "docker login" in script
+
+
+def test_docker_helper_module_does_not_import_typer() -> None:
+    script = Path("src/stackops/scripts/python/helpers/helpers_devops/cli_self_docker.py").read_text(encoding="utf-8")
+
+    assert "import typer" not in script
+    assert "typer." not in script
+
+
+def _option_param_decls(parameter: Parameter) -> tuple[str, ...]:
+    for metadata in get_args(parameter.annotation)[1:]:
+        param_decls = getattr(metadata, "param_decls", ())
+        if param_decls:
+            return tuple(param_decls)
+    raise AssertionError(f"Parameter has no Typer option metadata: {parameter.name}")