standstill 0.2.0__tar.gz

standstill-0.2.0/.dockerignore

@@ -0,0 +1,22 @@
+.git/
+.github/
+.venv/
+venv/
+env/
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+dist/
+build/
+.coverage
+htmlcov/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+tests/
+*.yaml
+*.yml
+!pyproject.toml
+.DS_Store
+Thumbs.db

standstill-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,256 @@
+name: CI / Release
+
+# Single pipeline, split by domain so a red check tells you exactly what broke:
+#
+#   test     ─┐
+#   security ─┼─►  release  ─►  docker   (only on push to main, version is new)
+#   package  ─┘
+#
+# test / security / package run on every PR and push. release waits for all
+# three, then publishes ONLY on a push to main whose pyproject version has no
+# matching tag yet. docker publishes the image for the same new version.
+#
+# NOTE: this file is intentionally named release.yml. The PyPI Trusted Publisher
+# is bound to the workflow *filename* release.yml -- renaming it would break OIDC
+# publishing until the publisher is reconfigured to match.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  # Supersede in-progress PR runs, but never cancel a main run mid-release.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  # ---- domain: tests ----
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install (with dev extra)
+        run: pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check .
+      - name: Type check (mypy)
+        if: matrix.python-version == '3.12'
+        run: mypy standstill
+      - name: Run tests with coverage
+        run: pytest --cov=standstill --cov-report=term-missing --cov-report=xml --cov-fail-under=80 -q
+      - name: Upload coverage report
+        if: matrix.python-version == '3.12'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          retention-days: 1
+
+  # ---- domain: static security ----
+  security:
+    name: Security (bandit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install bandit
+        run: pip install "bandit[toml]>=1.7,<2"
+      # Scan the library only (not tests). Documented skips live in pyproject
+      # [tool.bandit]; any new finding outside those classes fails the job.
+      - name: Run bandit
+        run: bandit -c pyproject.toml -r standstill -q
+
+  # ---- domain: packaging ----
+  package:
+    name: Package (build + validate)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+      - name: Validate distribution metadata (twine check)
+        run: python -m twine check dist/*
+      - name: Clean-install smoke test (wheel imports + console script runs)
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install --upgrade pip
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/python -c "import standstill; from standstill.main import main"
+          /tmp/smoke/bin/standstill --help >/dev/null
+      # Hand the validated artifacts to the release job so it publishes exactly
+      # what was built and tested here (build once, publish the same bytes).
+      - name: Upload dist artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  # ---- coverage badge (main only) ----
+  badge:
+    name: Coverage badge
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Download coverage report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: coverage-xml
+      - name: Generate and commit coverage badge
+        run: |
+          pip install "genbadge[coverage]"
+          genbadge coverage -i coverage.xml -o docs/coverage.svg
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add docs/coverage.svg
+          git diff --cached --quiet || git commit -m "chore: update coverage badge [skip ci]"
+          git push
+
+  # ---- domain: release (publish) ----
+  release:
+    name: Release (PyPI + SBOM + GitHub Release)
+    needs: [test, security, package]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    # Ties the PyPI publish to a GitHub Environment named "pypi" (match this in
+    # the PyPI pending/trusted publisher). Add required reviewers to gate here.
+    environment: pypi
+    permissions:
+      contents: write # create the tag + release
+      id-token: write # PyPI Trusted Publishing (OIDC) -- no stored token
+    outputs:
+      released: ${{ steps.check.outputs.release }}
+      version: ${{ steps.ver.outputs.version }}
+    concurrency:
+      # Never let two releases overlap, and never cancel one mid-publish.
+      group: release
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0 # need tags to know whether this version was released
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Resolve version from pyproject.toml
+        id: ver
+        run: |
+          v=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+          echo "tag=v$v" >> "$GITHUB_OUTPUT"
+
+      - name: Has this version already been released?
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git rev-parse "refs/tags/${{ steps.ver.outputs.tag }}" >/dev/null 2>&1 \
+            || gh release view "${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
+            echo "release=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::${{ steps.ver.outputs.tag }} already exists -- nothing to release."
+          else
+            echo "release=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # ---- everything below only runs when the version is new ----
+
+      - name: Download the validated dist
+        if: steps.check.outputs.release == 'true'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      # Publish to PyPI BEFORE the GitHub Release: the Release step creates the
+      # tag the idempotency guard keys on, so keeping it last makes a transient
+      # failure retryable. skip-existing keeps re-runs from failing on an
+      # already-uploaded (immutable) version.
+      - name: Publish to PyPI (Trusted Publishing)
+        if: steps.check.outputs.release == 'true'
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          skip-existing: true
+
+      - name: Generate CycloneDX SBOM (runtime dependency tree)
+        if: steps.check.outputs.release == 'true'
+        run: |
+          python -m pip install cyclonedx-bom
+          # Resolve standstill + its runtime deps into a clean venv so the SBOM
+          # reflects what an installed user gets, not the CI/test toolchain.
+          python -m venv /tmp/sbomenv
+          /tmp/sbomenv/bin/pip install --upgrade pip
+          /tmp/sbomenv/bin/pip install .
+          python -m cyclonedx_py environment \
+            --of JSON \
+            --pyproject pyproject.toml \
+            -o "standstill-${{ steps.ver.outputs.version }}-sbom.cdx.json" \
+            /tmp/sbomenv/bin/python
+
+      - name: Create GitHub Release
+        if: steps.check.outputs.release == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ steps.ver.outputs.tag }}" \
+            --target "${{ github.sha }}" \
+            --title "standstill ${{ steps.ver.outputs.version }}" \
+            --generate-notes \
+            dist/* "standstill-${{ steps.ver.outputs.version }}-sbom.cdx.json"
+
+  # ---- domain: container image (publish, same new version) ----
+  docker:
+    name: Docker image (GHCR)
+    needs: [release]
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      # docker/* actions are pinned to their current major tags; pin to SHA when
+      # convenient (tracked in ROADMAP).
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ needs.release.outputs.version }}
+            ghcr.io/${{ github.repository }}:latest

standstill-0.2.0/.gitignore

@@ -0,0 +1,51 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.so
+*.egg
+*.egg-info/
+dist/
+build/
+.eggs/
+*.whl
+
+# Virtual environments
+.venv/
+venv/
+env/
+.env
+
+# Distribution / packaging
+MANIFEST
+pip-wheel-metadata/
+
+# Testing
+.coverage
+.coverage.*
+htmlcov/
+.pytest_cache/
+.tox/
+
+# Type checkers
+.mypy_cache/
+.pytype/
+.pyre/
+
+# Ruff
+.ruff_cache/
+
+# Editors
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Standstill runtime state
+.standstill_pending.json

standstill-0.2.0/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.2.0] - 2026-08-31
+
+### Added
+
+- Global CLI error boundary: expected AWS/runtime failures now surface as a single clean `Error:` line with a non-zero exit instead of a raw traceback.
+- Audit log: every invocation is appended as JSON to `~/.standstill/audit.log` (override with `STANDSTILL_AUDIT_LOG`) with command, args, profile, region, and exit code.
+- `security apply --regions` configures regional services (GuardDuty, Security Hub, Macie, Inspector) across multiple regions in one run.
+- CI: unified pipeline (test / bandit / package → version-detected release) with a `mypy` type-check gate, `bandit` static analysis, SHA-pinned actions, packaging smoke test, and a CycloneDX SBOM on release.
+
+### Fixed
+
+- **Account Factory**: `accounts create` / `enroll` / `deregister` called non-existent Control Tower boto3 methods and failed at runtime; reimplemented against the AWS Service Catalog Account Factory product with `describe_record` polling.
+- **Notifications**: `notify setup` now applies the SNS topic policy granting EventBridge `sns:Publish` — previously the rule was created but findings never delivered.
+- **GuardDuty**: org auto-enrollment used the deprecated boolean `AutoEnable` param instead of `AutoEnableOrganizationMembers`.
+- Security status probes now surface access-denied as an error instead of rendering it as "disabled".
+- Exit codes: `sso assign/unassign` and `blueprint apply` return a distinct "not confirmed" code (2) on poll timeout instead of 0 (success) or 1 (failure); SSO polling tolerates transient throttles.
+- `operations list` labels its status column as last-known (it is not refreshed in place).
+- `blueprint apply` now requires `--account` or `--ou` instead of failing deep in the call.
+
+### Removed
+
+- The cost/FinOps command surface (`cost report/services/forecast/budgets/anomalies/trail/scan/optimize`) — out of scope for an org-security tool and well served by dedicated OSS.
+
+## [0.1.0] - 2026-04-08
+
+Initial public release.
+
+### Added
+
+- Declarative control management via YAML with diff-before-apply workflow
+- Bulk enablement of control tiers (preventive, detective, proactive, all) per OU
+- Parallel operation submission and polling bounded by the slowest operation
+- Pending operations journal for resuming after credential expiry
+- Interactive security services wizard (`standstill security init`) covering GuardDuty, Security Hub, Macie, Inspector, and Access Analyzer
+- Config recorder audit and configuration across all org accounts
+- Organization visibility: OU hierarchy, account listing, control status per OU
+- Cross-account role verification (`standstill accounts check-roles`)
+- Bundled control catalog with 1,200+ Control Tower controls
+- Docker image published to GitHub Container Registry

standstill-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,54 @@
+# Contributing to standstill
+
+## Getting started
+
+```bash
+git clone https://github.com/dbnz-io/standstill
+cd standstill
+pip install -e ".[dev]"
+```
+
+## Running tests
+
+Tests mock all AWS calls — no real AWS account or credentials required.
+
+```bash
+pytest
+pytest --cov=standstill --cov-report=term-missing
+```
+
+## Linting
+
+```bash
+ruff check .
+ruff format .
+```
+
+## Pull requests
+
+- Open an issue first for any non-trivial change so we can align on approach before you invest time writing code.
+- Keep PRs focused. One logical change per PR.
+- All tests must pass. Coverage should not decrease.
+- Follow the existing code style — Ruff enforces it.
+
+## Adding or updating controls
+
+The control catalog lives in `standstill/data/controls_catalog.yaml`. If Control Tower ships new controls, run:
+
+```bash
+standstill catalog build
+```
+
+This refreshes the catalog from the live Control Tower API. Commit the updated file.
+
+## Reporting bugs
+
+Use [GitHub Issues](https://github.com/dbnz-io/standstill/issues). Include:
+
+- The command you ran (redact account IDs and ARNs if needed)
+- The full error output
+- Your AWS region and Control Tower version if known
+
+## Security issues
+
+Do not open a GitHub issue for security vulnerabilities. See [SECURITY.md](SECURITY.md).

standstill-0.2.0/Dockerfile

@@ -0,0 +1,47 @@
+# Pin to a specific patch release. Update deliberately when upgrading Python.
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_ROOT_USER_ACTION=ignore
+
+WORKDIR /build
+
+COPY pyproject.toml LICENSE README.md ./
+COPY standstill/ standstill/
+
+RUN pip install build && \
+    python -m build --wheel --outdir /dist
+
+
+# Pin to the same release as the builder.
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_ROOT_USER_ACTION=ignore \
+    HOME=/home/standstill
+
+LABEL org.opencontainers.image.title="standstill" \
+      org.opencontainers.image.description="AWS Control Tower management CLI" \
+      org.opencontainers.image.source="https://github.com/dbnz-io/standstill" \
+      org.opencontainers.image.licenses="MPL-2.0"
+
+# Create a non-root user with a real home directory before installing anything.
+RUN useradd -r -u 1000 -s /sbin/nologin -d /home/standstill standstill && \
+    mkdir -p /home/standstill /workspace && \
+    chown standstill:standstill /home/standstill /workspace
+
+# Install the wheel, then strip pip and setuptools out of the runtime image.
+# The CLI does not need a package manager at runtime.
+COPY --from=builder /dist/*.whl /tmp/wheel/
+RUN pip install /tmp/wheel/*.whl && \
+    pip uninstall -y pip setuptools && \
+    rm -rf /tmp/wheel
+
+WORKDIR /workspace
+
+USER standstill
+
+ENTRYPOINT ["standstill"]