thothctl 0.24.0__tar.gz → 0.24.2__tar.gz

{thothctl-0.24.0 → thothctl-0.24.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.24.0
+Version: 0.24.2
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl

{thothctl-0.24.0 → thothctl-0.24.2}/src/thothctl/commands/workflow/commands/devsecops.py

@@ -5,16 +5,30 @@ import time
 import click
 import rich.box
 from rich.console import Console
+from rich.live import Live
 from rich.panel import Panel
+from rich.spinner import Spinner
 from rich.table import Table
+from rich.text import Text
 
 from ....core.commands import ClickCommand
-from ....services.workflow.models import Phase, StepStatus
-from ....services.workflow.workflow_service import WorkflowService
+from ....services.workflow.models import Phase, PhaseResult, StepStatus
+from ....services.workflow.workflow_service import WorkflowService, COMPOSITE_PHASES, PHASE_ORDER
 
 
 logger = logging.getLogger(__name__)
 
+# Phase icons for display
+PHASE_ICONS = {
+    Phase.PLAN: "📋",
+    Phase.DEVELOP: "💻",
+    Phase.BUILD: "🔨",
+    Phase.TEST: "✅",
+    Phase.SECURE: "🔒",
+    Phase.DEPLOY: "🚀",
+    Phase.MONITOR: "📊",
+}
+
 
 class DevSecOpsWorkflowCommand(ClickCommand):
     """Execute DevSecOps SDLC phases."""
@@ -24,7 +38,7 @@ class DevSecOpsWorkflowCommand(ClickCommand):
         service = WorkflowService()
 
         # Resolve phase
-        selected = [Phase(phase)]
+        selected_phase = Phase(phase)
 
         ctx = click.get_current_context()
         directory = ctx.obj.get("CODE_DIRECTORY", ".")
@@ -46,18 +60,17 @@ class DevSecOpsWorkflowCommand(ClickCommand):
             border_style="blue",
         ))
 
-        # Execute
+        # Resolve which phases will run
+        phases_to_run = self._resolve_phases(selected_phase, service)
+
+        # Execute with live progress
         start = time.perf_counter()
-        result = service.execute(
-            phases=selected,
-            directory=directory,
-            reports_dir=reports_dir,
-            options=options,
-            enforcement=enforcement,
+        result = self._execute_with_progress(
+            console, service, [selected_phase], directory, reports_dir, options, enforcement, phases_to_run
         )
         total_time = time.perf_counter() - start
 
-        # Display results
+        # Display final results
         self._display_results(console, result, total_time)
 
         if result.stopped_at:
@@ -70,6 +83,72 @@ class DevSecOpsWorkflowCommand(ClickCommand):
             ))
             raise SystemExit(1)
 
+    def _resolve_phases(self, phase: Phase, service: WorkflowService) -> list:
+        """Resolve composite phases into ordered list."""
+        if phase in COMPOSITE_PHASES:
+            resolved = COMPOSITE_PHASES[phase]
+        else:
+            resolved = [phase]
+
+        # Filter to only phases that have executors
+        return [p for p in resolved if p in service._executors]
+
+    def _execute_with_progress(
+        self, console, service, phases, directory, reports_dir, options, enforcement, phases_to_run
+    ):
+        """Execute workflow with live spinner showing current phase."""
+        from ....services.workflow.models import WorkflowResult
+
+        options = options or {}
+        options["enforcement"] = enforcement
+        result = WorkflowResult(enforcement=enforcement)
+
+        total_phases = len(phases_to_run)
+
+        for idx, phase in enumerate(phases_to_run, 1):
+            executor = service._executors.get(phase)
+            if not executor:
+                continue
+
+            icon = PHASE_ICONS.get(phase, "⚙️")
+            phase_name = phase.value.capitalize()
+
+            # Show spinner while phase runs
+            with console.status(
+                f"[bold blue]{icon} Running phase {idx}/{total_phases}: {phase_name}[/bold blue]  "
+                f"[dim]({executor.description})[/dim]",
+                spinner="dots",
+                spinner_style="cyan",
+            ):
+                phase_result = executor.execute(directory, reports_dir, options)
+
+            # Show immediate result after phase completes
+            if phase_result.total_findings > 0:
+                console.print(
+                    f"  {icon} [bold]{phase_name}[/bold] — "
+                    f"[red]{phase_result.total_findings} finding(s)[/red]"
+                )
+            elif any(s.status == StepStatus.SKIPPED for s in phase_result.steps):
+                console.print(
+                    f"  {icon} [bold]{phase_name}[/bold] — "
+                    f"[dim]skipped (prerequisites missing)[/dim]"
+                )
+            else:
+                console.print(
+                    f"  {icon} [bold]{phase_name}[/bold] — "
+                    f"[green]passed[/green]"
+                )
+
+            result.phases.append(phase_result)
+
+            # Stop on hard enforcement failure
+            if enforcement == "hard" and phase_result.gate_blocked:
+                result.stopped_at = phase
+                break
+
+        console.print()  # Blank line before results table
+        return result
+
     def _display_results(self, console: Console, result, total_time: float):
         """Render workflow results."""
         table = Table(

thothctl-0.24.2/src/thothctl/services/workflow/phases/build.py

@@ -0,0 +1,84 @@
+"""Build phase: inventory creation, dependency tracking, version management."""
+import logging
+import subprocess
+import time
+from typing import Dict, Optional
+
+from ..models import Phase, PhaseResult, StepResult, StepStatus
+from .base import PhaseExecutor
+
+logger = logging.getLogger(__name__)
+
+
+class BuildPhaseExecutor(PhaseExecutor):
+    """Phase 3: Infrastructure inventory, SBOM, version tracking."""
+
+    @property
+    def phase(self) -> Phase:
+        return Phase.BUILD
+
+    @property
+    def description(self) -> str:
+        return "\U0001f528 Build — Inventory creation, dependency tracking, version management"
+
+    def execute(
+        self,
+        directory: str,
+        reports_dir: str,
+        options: Optional[Dict] = None,
+    ) -> PhaseResult:
+        options = options or {}
+        result = PhaseResult(phase=self.phase)
+
+        # Step 1: Inventory with version checks
+        result.steps.append(self._run_inventory(directory, options))
+
+        # Phase passes if no steps failed
+        result.passed = not any(
+            s.status == StepStatus.FAILED for s in result.steps
+        )
+        return result
+
+    def _run_inventory(self, directory: str, options: Dict) -> StepResult:
+        """Run thothctl inventory iac --check-versions --check-provider-versions."""
+        start = time.perf_counter()
+        try:
+            cmd = [
+                "thothctl", "inventory", "iac",
+                "--check-versions",
+                "--check-provider-versions",
+            ]
+
+            proc = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=180,
+                cwd=directory,
+            )
+            duration = time.perf_counter() - start
+            status = StepStatus.PASSED if proc.returncode == 0 else StepStatus.WARNING
+            return StepResult(
+                name="inventory",
+                status=status,
+                command="thothctl inventory iac --check-versions --check-provider-versions",
+                duration_seconds=duration,
+                summary="Inventory created with version analysis" if status == StepStatus.PASSED else "Inventory completed with warnings",
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                name="inventory",
+                status=StepStatus.SKIPPED,
+                command="thothctl inventory iac --check-versions",
+                duration_seconds=time.perf_counter() - start,
+                summary="Timed out after 180s",
+            )
+        except Exception as e:
+            return StepResult(
+                name="inventory",
+                status=StepStatus.FAILED,
+                command="thothctl inventory iac --check-versions",
+                duration_seconds=time.perf_counter() - start,
+                summary=str(e),
+                findings_count=1,
+            )

thothctl-0.24.2/src/thothctl/services/workflow/phases/deploy.py

@@ -0,0 +1,68 @@
+"""Deploy phase: pre-deployment validation and enforcement gates."""
+import logging
+import time
+from typing import Dict, Optional
+
+from ..models import Phase, PhaseResult, StepResult, StepStatus
+from .base import PhaseExecutor
+
+logger = logging.getLogger(__name__)
+
+
+class DeployPhaseExecutor(PhaseExecutor):
+    """Phase 6: Pre-deployment checks and approval gates."""
+
+    @property
+    def phase(self) -> Phase:
+        return Phase.DEPLOY
+
+    @property
+    def description(self) -> str:
+        return "\U0001f680 Deploy — Pre-deployment validation, enforcement gates"
+
+    def execute(
+        self,
+        directory: str,
+        reports_dir: str,
+        options: Optional[Dict] = None,
+    ) -> PhaseResult:
+        options = options or {}
+        result = PhaseResult(phase=self.phase)
+        enforcement = options.get("enforcement", "soft")
+
+        # Step 1: Run security scan with hard enforcement
+        # This reuses the secure phase but forces hard enforcement
+        from .secure import SecurePhaseExecutor
+
+        secure_executor = SecurePhaseExecutor()
+        deploy_options = dict(options)
+        deploy_options["enforcement"] = "hard"
+
+        start = time.perf_counter()
+        secure_result = secure_executor.execute(directory, reports_dir, deploy_options)
+        duration = time.perf_counter() - start
+
+        # Translate secure results into deploy gate
+        total_failures = secure_result.total_findings
+        if total_failures == 0:
+            result.steps.append(StepResult(
+                name="deploy-gate",
+                status=StepStatus.PASSED,
+                command="thothctl scan iac --enforcement hard",
+                duration_seconds=duration,
+                summary="All security gates passed — safe to deploy",
+            ))
+        else:
+            result.steps.append(StepResult(
+                name="deploy-gate",
+                status=StepStatus.FAILED,
+                command="thothctl scan iac --enforcement hard",
+                duration_seconds=duration,
+                summary=f"Deployment blocked: {total_failures} violation(s) must be resolved",
+                findings_count=total_failures,
+            ))
+            result.passed = False
+            if enforcement == "hard":
+                result.gate_blocked = True
+
+        return result

thothctl-0.24.2/src/thothctl/services/workflow/phases/monitor.py

@@ -0,0 +1,85 @@
+"""Monitor phase: drift detection, continuous monitoring."""
+import logging
+import subprocess
+import time
+from typing import Dict, Optional
+
+from ..models import Phase, PhaseResult, StepResult, StepStatus
+from .base import PhaseExecutor
+
+logger = logging.getLogger(__name__)
+
+
+class MonitorPhaseExecutor(PhaseExecutor):
+    """Phase 7: Drift detection and continuous monitoring."""
+
+    @property
+    def phase(self) -> Phase:
+        return Phase.MONITOR
+
+    @property
+    def description(self) -> str:
+        return "\U0001f4ca Monitor — Drift detection, continuous monitoring"
+
+    def execute(
+        self,
+        directory: str,
+        reports_dir: str,
+        options: Optional[Dict] = None,
+    ) -> PhaseResult:
+        options = options or {}
+        result = PhaseResult(phase=self.phase)
+
+        # Step 1: Drift detection
+        result.steps.append(self._run_drift_detection(directory, options))
+
+        # Phase passes if no steps failed
+        result.passed = not any(
+            s.status == StepStatus.FAILED for s in result.steps
+        )
+        return result
+
+    def _run_drift_detection(self, directory: str, options: Dict) -> StepResult:
+        """Run thothctl check iac -type drift."""
+        start = time.perf_counter()
+        tftool = options.get("tftool", "tofu")
+        try:
+            cmd = [
+                "thothctl", "check", "iac",
+                "-type", "drift",
+                "--tftool", tftool,
+                "--recursive",
+            ]
+
+            proc = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=300,
+                cwd=directory,
+            )
+            duration = time.perf_counter() - start
+            status = StepStatus.PASSED if proc.returncode == 0 else StepStatus.WARNING
+            return StepResult(
+                name="drift-detection",
+                status=status,
+                command=f"thothctl check iac -type drift --tftool {tftool} --recursive",
+                duration_seconds=duration,
+                summary="No drift detected" if status == StepStatus.PASSED else "Drift detected — review changes",
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                name="drift-detection",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type drift",
+                duration_seconds=time.perf_counter() - start,
+                summary="Timed out after 300s (requires cloud credentials)",
+            )
+        except Exception as e:
+            return StepResult(
+                name="drift-detection",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type drift",
+                duration_seconds=time.perf_counter() - start,
+                summary=f"Skipped: {e}",
+            )

thothctl-0.24.2/src/thothctl/services/workflow/phases/plan.py

@@ -0,0 +1,150 @@
+"""Plan phase: cost estimation, blast radius, risk assessment."""
+import logging
+import os
+import subprocess
+import time
+from pathlib import Path
+from typing import Dict, List, Optional
+
+from ..models import Phase, PhaseResult, StepResult, StepStatus
+from .base import PhaseExecutor
+
+logger = logging.getLogger(__name__)
+
+
+class PlanPhaseExecutor(PhaseExecutor):
+    """Phase 1: Cost estimation and risk assessment from tfplan."""
+
+    @property
+    def phase(self) -> Phase:
+        return Phase.PLAN
+
+    @property
+    def description(self) -> str:
+        return "\U0001f4cb Plan — Cost estimation, blast radius, risk assessment"
+
+    def execute(
+        self,
+        directory: str,
+        reports_dir: str,
+        options: Optional[Dict] = None,
+    ) -> PhaseResult:
+        options = options or {}
+        result = PhaseResult(phase=self.phase)
+
+        # Find tfplan files
+        plan_files = self._find_plan_files(directory)
+
+        if not plan_files:
+            result.steps.append(StepResult(
+                name="plan-check",
+                status=StepStatus.SKIPPED,
+                command="(requires tfplan.json)",
+                summary=(
+                    "No tfplan.json found. Generate plans first:\n"
+                    "  Terragrunt: terragrunt run-all plan --out-dir tfplan --json-out-dir tfplan\n"
+                    "  Terraform:  terraform plan -out=tfplan.binary && "
+                    "terraform show -json tfplan.binary > tfplan.json"
+                ),
+            ))
+            return result
+
+        # Step 1: Cost analysis
+        result.steps.append(self._run_cost_analysis(directory))
+
+        # Step 2: Blast radius
+        result.steps.append(self._run_blast_radius(directory))
+
+        # Phase passes if no steps failed
+        result.passed = not any(
+            s.status == StepStatus.FAILED for s in result.steps
+        )
+        return result
+
+    def _find_plan_files(self, directory: str) -> List[str]:
+        """Find tfplan.json files in the project."""
+        plans = []
+        for root, _, files in os.walk(directory):
+            # Skip hidden dirs and Reports
+            if any(part.startswith(".") for part in Path(root).parts):
+                continue
+            if "Reports" in root:
+                continue
+            for f in files:
+                if f == "tfplan.json":
+                    plans.append(os.path.join(root, f))
+        return plans
+
+    def _run_cost_analysis(self, directory: str) -> StepResult:
+        """Run thothctl check iac -type cost-analysis."""
+        start = time.perf_counter()
+        try:
+            proc = subprocess.run(
+                ["thothctl", "check", "iac", "-type", "cost-analysis", "--recursive"],
+                capture_output=True,
+                text=True,
+                timeout=120,
+                cwd=directory,
+            )
+            duration = time.perf_counter() - start
+            status = StepStatus.PASSED if proc.returncode == 0 else StepStatus.WARNING
+            return StepResult(
+                name="cost-analysis",
+                status=status,
+                command="thothctl check iac -type cost-analysis --recursive",
+                duration_seconds=duration,
+                summary="Cost estimation completed" if status == StepStatus.PASSED else "Cost analysis had warnings",
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                name="cost-analysis",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type cost-analysis",
+                duration_seconds=time.perf_counter() - start,
+                summary="Timed out after 120s",
+            )
+        except Exception as e:
+            return StepResult(
+                name="cost-analysis",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type cost-analysis",
+                duration_seconds=time.perf_counter() - start,
+                summary=f"Skipped: {e}",
+            )
+
+    def _run_blast_radius(self, directory: str) -> StepResult:
+        """Run thothctl check iac -type blast-radius."""
+        start = time.perf_counter()
+        try:
+            proc = subprocess.run(
+                ["thothctl", "check", "iac", "-type", "blast-radius", "--recursive"],
+                capture_output=True,
+                text=True,
+                timeout=120,
+                cwd=directory,
+            )
+            duration = time.perf_counter() - start
+            status = StepStatus.PASSED if proc.returncode == 0 else StepStatus.WARNING
+            return StepResult(
+                name="blast-radius",
+                status=status,
+                command="thothctl check iac -type blast-radius --recursive",
+                duration_seconds=duration,
+                summary="Blast radius assessed" if status == StepStatus.PASSED else "Blast radius warnings",
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                name="blast-radius",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type blast-radius",
+                duration_seconds=time.perf_counter() - start,
+                summary="Timed out after 120s",
+            )
+        except Exception as e:
+            return StepResult(
+                name="blast-radius",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type blast-radius",
+                duration_seconds=time.perf_counter() - start,
+                summary=f"Skipped: {e}",
+            )

thothctl-0.24.2/src/thothctl/services/workflow/phases/test.py

@@ -0,0 +1,110 @@
+"""Test phase: plan validation, change impact analysis."""
+import logging
+import os
+import subprocess
+import time
+from pathlib import Path
+from typing import Dict, List, Optional
+
+from ..models import Phase, PhaseResult, StepResult, StepStatus
+from .base import PhaseExecutor
+
+logger = logging.getLogger(__name__)
+
+
+class TestPhaseExecutor(PhaseExecutor):
+    """Phase 4: Terraform plan validation and impact analysis."""
+
+    @property
+    def phase(self) -> Phase:
+        return Phase.TEST
+
+    @property
+    def description(self) -> str:
+        return "\u2705 Test — Plan validation, change impact analysis"
+
+    def execute(
+        self,
+        directory: str,
+        reports_dir: str,
+        options: Optional[Dict] = None,
+    ) -> PhaseResult:
+        options = options or {}
+        result = PhaseResult(phase=self.phase)
+
+        # Check if tfplan exists
+        plan_files = self._find_plan_files(directory)
+
+        if not plan_files:
+            result.steps.append(StepResult(
+                name="tfplan-check",
+                status=StepStatus.SKIPPED,
+                command="(requires tfplan.json)",
+                summary=(
+                    "No tfplan.json found. Generate plans first:\n"
+                    "  Terragrunt: terragrunt run-all plan --out-dir tfplan --json-out-dir tfplan\n"
+                    "  Terraform:  terraform plan -out=tfplan.binary && "
+                    "terraform show -json tfplan.binary > tfplan.json"
+                ),
+            ))
+            return result
+
+        # Step 1: Validate tfplan
+        result.steps.append(self._validate_tfplan(directory))
+
+        # Phase passes if no steps failed
+        result.passed = not any(
+            s.status == StepStatus.FAILED for s in result.steps
+        )
+        return result
+
+    def _find_plan_files(self, directory: str) -> List[str]:
+        """Find tfplan.json files in the project."""
+        plans = []
+        for root, _, files in os.walk(directory):
+            if any(part.startswith(".") for part in Path(root).parts):
+                continue
+            if "Reports" in root:
+                continue
+            for f in files:
+                if f == "tfplan.json":
+                    plans.append(os.path.join(root, f))
+        return plans
+
+    def _validate_tfplan(self, directory: str) -> StepResult:
+        """Run thothctl check iac -type tfplan."""
+        start = time.perf_counter()
+        try:
+            proc = subprocess.run(
+                ["thothctl", "check", "iac", "-type", "tfplan", "--recursive"],
+                capture_output=True,
+                text=True,
+                timeout=120,
+                cwd=directory,
+            )
+            duration = time.perf_counter() - start
+            status = StepStatus.PASSED if proc.returncode == 0 else StepStatus.WARNING
+            return StepResult(
+                name="tfplan-validation",
+                status=status,
+                command="thothctl check iac -type tfplan --recursive",
+                duration_seconds=duration,
+                summary="Plan validation passed" if status == StepStatus.PASSED else "Plan has changes to review",
+            )
+        except subprocess.TimeoutExpired:
+            return StepResult(
+                name="tfplan-validation",
+                status=StepStatus.SKIPPED,
+                command="thothctl check iac -type tfplan",
+                duration_seconds=time.perf_counter() - start,
+                summary="Timed out after 120s",
+            )
+        except Exception as e:
+            return StepResult(
+                name="tfplan-validation",
+                status=StepStatus.FAILED,
+                command="thothctl check iac -type tfplan",
+                duration_seconds=time.perf_counter() - start,
+                summary=str(e),
+                findings_count=1,
+            )

{thothctl-0.24.0 → thothctl-0.24.2}/src/thothctl/services/workflow/workflow_service.py

@@ -4,15 +4,20 @@ from typing import Dict, List, Optional
 
 from .models import Phase, WorkflowResult
 from .phases.base import PhaseExecutor
+from .phases.plan import PlanPhaseExecutor
 from .phases.develop import DevelopPhaseExecutor
+from .phases.build import BuildPhaseExecutor
+from .phases.test import TestPhaseExecutor
 from .phases.secure import SecurePhaseExecutor
+from .phases.deploy import DeployPhaseExecutor
+from .phases.monitor import MonitorPhaseExecutor
 
 logger = logging.getLogger(__name__)
 
 
 # Phase execution order
 PHASE_ORDER = [
-    Phase.DEVELOP, Phase.BUILD, Phase.TEST,
+    Phase.PLAN, Phase.DEVELOP, Phase.BUILD, Phase.TEST,
     Phase.SECURE, Phase.DEPLOY, Phase.MONITOR,
 ]
 
@@ -28,8 +33,13 @@ class WorkflowService:
 
     def __init__(self):
         self._executors: Dict[Phase, PhaseExecutor] = {
+            Phase.PLAN: PlanPhaseExecutor(),
             Phase.DEVELOP: DevelopPhaseExecutor(),
+            Phase.BUILD: BuildPhaseExecutor(),
+            Phase.TEST: TestPhaseExecutor(),
             Phase.SECURE: SecurePhaseExecutor(),
+            Phase.DEPLOY: DeployPhaseExecutor(),
+            Phase.MONITOR: MonitorPhaseExecutor(),
         }
 
     def execute(

thothctl-0.24.2/src/thothctl/version.py

@@ -0,0 +1,2 @@
+"""Version module."""
+__version__ = "0.24.2"

thothctl-0.24.0/src/thothctl/version.py

@@ -1,2 +0,0 @@
-"""Version module."""
-__version__ = "0.24.0"