urun-cli 0.1.1__tar.gz

urun_cli-0.1.1/.dagger-pipeline.yaml

@@ -0,0 +1,5 @@
+global:
+  registry_password_env: "REGISTRY_PASSWORD"
+
+precommit:
+  base_image: "ghcr.io/urun-sh/dagger-rust-ci:1@sha256:a3740705141cd26172cf786311e9bc02b1ca7b535931ef188b779512f4f85bf1"

urun_cli-0.1.1/.env.example

@@ -0,0 +1,11 @@
+# urun CLI credentials
+URUN_API_URL=https://api.urun.sh/v1
+URUN_API_KEY=urun_00000000000000000000000000000000
+URUN_ORG_ID=org_example
+
+# Optional local MinIO integration tests
+URUN_TEST_MINIO_ENDPOINT=127.0.0.1:9000
+URUN_TEST_MINIO_ACCESS_KEY=minioadmin
+URUN_TEST_MINIO_SECRET_KEY=minioadmin
+URUN_TEST_MINIO_BUCKET=urun-cli-test
+URUN_TEST_MINIO_SECURE=0

urun_cli-0.1.1/.envrc

@@ -0,0 +1,44 @@
+watch_file flake.nix
+watch_file pyproject.toml
+watch_file uv.lock
+watch_file .pre-commit-config.yaml
+
+use flake
+
+unset PYTHONPATH
+
+if has uv; then
+  export UV_PYTHON="python3.12"
+  _marker=".direnv/uv-synced"
+  _need_sync=false
+  if [[ ! -d .venv ]] || [[ ! -x .venv/bin/python ]] || [[ ! -f "$_marker" ]] \
+      || [[ pyproject.toml -nt "$_marker" ]] \
+      || { [[ -f uv.lock ]] && [[ uv.lock -nt "$_marker" ]]; }; then
+    _need_sync=true
+  elif ! .venv/bin/python --version >/dev/null 2>&1; then
+    log_status "venv Python is broken (interpreter not executable), recreating..."
+    rm -rf .venv
+    _need_sync=true
+  fi
+  if $_need_sync; then
+    uv sync --locked && {
+      mkdir -p .direnv
+      touch "$_marker"
+    }
+  fi
+
+  VIRTUAL_ENV="$PWD/.venv"
+  PATH_add "$VIRTUAL_ENV/bin"
+  export VIRTUAL_ENV
+fi
+
+if has pre-commit && git rev-parse --git-dir > /dev/null 2>&1; then
+  _pc_marker=".direnv/pre-commit-installed"
+  if [[ ! -f "$_pc_marker" ]] \
+      || { [[ -f .pre-commit-config.yaml ]] && [[ .pre-commit-config.yaml -nt "$_pc_marker" ]]; }; then
+    pre-commit install --allow-missing-config \
+      && pre-commit install --hook-type pre-push --allow-missing-config \
+      && mkdir -p .direnv \
+      && touch "$_pc_marker"
+  fi
+fi

urun_cli-0.1.1/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Require Keegan's review for contributed changes. Branch protection lets admins
+# bypass this for maintainer-authored emergency/solo-maintainer merges.
+* @keeganmccallum

urun_cli-0.1.1/.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404-arm

urun_cli-0.1.1/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"

urun_cli-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,87 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install dependencies
+        run: uv sync --locked
+      - name: Run tests with coverage
+        run: |
+          uv run pytest -q -m 'not minio' \
+            --cov=urun \
+            --cov-report=term-missing \
+            --cov-report=xml
+      - name: Add coverage summary
+        run: |
+          {
+            echo '## Coverage'
+            echo '```text'
+            uv run coverage report
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload coverage XML
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-xml
+          path: coverage.xml
+      - name: Build package
+        run: uv build
+
+  minio:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install dependencies
+        run: uv sync --locked
+      - name: Start MinIO
+        run: |
+          docker run -d --name urun-cli-minio \
+            -p 127.0.0.1:9000:9000 \
+            -e MINIO_ROOT_USER=minioadmin \
+            -e MINIO_ROOT_PASSWORD=minioadmin \
+            minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e server /data --address :9000
+          for _ in $(seq 1 60); do
+            if curl -fsS http://127.0.0.1:9000/minio/health/live; then
+              exit 0
+            fi
+            sleep 1
+          done
+          docker logs urun-cli-minio
+          exit 1
+      - name: Run MinIO integration tests
+        env:
+          URUN_TEST_MINIO_ENDPOINT: 127.0.0.1:9000
+          URUN_TEST_MINIO_ACCESS_KEY: minioadmin
+          URUN_TEST_MINIO_SECRET_KEY: minioadmin
+        run: uv run pytest -q -m minio

urun_cli-0.1.1/.github/workflows/precommit.yaml

@@ -0,0 +1,80 @@
+name: Pre-commit
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  precommit:
+    name: Pre-commit Hooks
+    # Central Dagger pipeline uses private org credentials; normal CI still runs on fork PRs.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.PIPELINE_CI_APP_ID }}
+          private-key: ${{ secrets.PIPELINE_CI_APP_PRIVATE_KEY }}
+          owner: urun-sh
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: urun-sh/dagger-pipeline
+          ref: main
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+          path: .dagger-pipeline
+          persist-credentials: false
+
+      - name: Check out pinned dagger-pipeline commit
+        run: |
+          git -C .dagger-pipeline checkout --detach d550f10b2c5a09106f65240ca369bc9b0533e74e
+          test "$(git -C .dagger-pipeline rev-parse HEAD)" = "d550f10b2c5a09106f65240ca369bc9b0533e74e"
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+
+      - uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
+        with:
+          verb: ""
+          args: ""
+          version: "0.19.11"
+
+      - name: Login to GHCR
+        run: |
+          TOKEN="${{ secrets.GITHUB_TOKEN }}"
+          echo "::add-mask::$TOKEN"
+          echo "$TOKEN" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Install dagger-pipeline dependencies
+        run: uv sync --frozen --project .dagger-pipeline
+
+      - name: Run pre-commit hooks
+        run: |
+          dagger run --progress=plain uv run --project .dagger-pipeline --frozen --no-sync python -m recipes.precommit \
+            --all-files \
+            --show-diff-on-failure \
+            --registry-username ${{ github.actor }} \
+            ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && '--skip no-commit-to-branch' || '' }}
+        env:
+          DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }}
+          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

urun_cli-0.1.1/.github/workflows/publish.yaml

@@ -0,0 +1,31 @@
+name: publish
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Build package
+        run: uv build
+      - name: Check package metadata
+        run: uvx twine check dist/*
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/*

urun_cli-0.1.1/.github/workflows/release.yaml

@@ -0,0 +1,46 @@
+name: release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  patch-release:
+    # Branch protection is the quality gate; this workflow releases the exact protected main tip.
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    environment: pypi
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install dependencies
+        run: uv sync --locked
+      - name: Create patch release and GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          uv run semantic-release version \
+            --patch \
+            --no-commit \
+            --push \
+            --vcs-release
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

urun_cli-0.1.1/.gitignore

@@ -0,0 +1,14 @@
+.venv/
+.direnv/
+.env
+.env.*
+!.env.example
+__pycache__/
+.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
+*.py[cod]
+dist/
+build/
+*.egg-info/

urun_cli-0.1.1/.markdownlint-cli2.yaml

@@ -0,0 +1,15 @@
+config:
+  # Specs and security docs intentionally include long protocol examples.
+  MD013: false
+  MD024:
+    siblings_only: true
+  # Initial specs are imported design docs; avoid churn unrelated to CI intent.
+  MD031: false
+  MD032: false
+  MD040: false
+  MD047: false
+
+ignores:
+  - ".venv/**"
+  - "dist/**"
+  - "build/**"

urun_cli-0.1.1/.pre-commit-config.yaml

@@ -0,0 +1,64 @@
+exclude: '^(\.venv|\.direnv|\.mypy_cache|\.ruff_cache|\.pytest_cache|dist|build|\.dagger-pipeline)/'
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-merge-conflict
+        stages: [pre-commit]
+      - id: no-commit-to-branch
+        args: ["--branch", "main"]
+        stages: [pre-commit]
+      - id: check-toml
+        stages: [pre-commit]
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+        stages: [pre-commit]
+      - id: detect-private-key
+        stages: [pre-commit]
+      - id: end-of-file-fixer
+        stages: [pre-commit]
+      - id: trailing-whitespace
+        stages: [pre-commit]
+      - id: mixed-line-ending
+        args: [--fix=lf]
+        stages: [pre-commit]
+
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: v0.21.0
+    hooks:
+      - id: markdownlint-cli2
+        stages: [pre-commit]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.11
+    hooks:
+      - id: actionlint-system
+        stages: [pre-commit]
+
+  - repo: local
+    hooks:
+      - id: ruff
+        name: ruff
+        entry: uv run ruff check --fix
+        language: system
+        types: [python]
+        stages: [pre-commit]
+      - id: ruff-format
+        name: ruff-format
+        entry: uv run ruff format
+        language: system
+        types: [python]
+        stages: [pre-commit]
+      - id: pytest
+        name: pytest
+        entry: uv run pytest -q -m "not minio"
+        language: system
+        pass_filenames: false
+        stages: [pre-push]
+      - id: build
+        name: build
+        entry: uv build
+        language: system
+        pass_filenames: false
+        stages: [manual]

urun_cli-0.1.1/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 0.1.0 - Unreleased
+
+- Initial end-user `urun deploy` CLI.
+- Manifest generation, file discovery, dependency declaration upload, and API deploy flow.
+- Local fake Edge API and MinIO integration tests.

urun_cli-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contributing
+
+## Setup
+
+```bash
+# Optional but recommended if you use Nix/direnv:
+direnv allow
+
+uv sync
+uv run urun --version
+```
+
+## Checks
+
+```bash
+uv run ruff check .
+uv run ruff format --check .
+uv run pytest -q
+uv run pytest -q -m "not minio" --cov=urun --cov-report=term-missing --cov-report=xml
+uv build
+```
+
+The coverage command prints a missing-line report and writes `coverage.xml` for CI/artifact upload.
+
+## Testing strategy
+
+Follow a practical test pyramid:
+
+- Prefer fast unit tests for parsing, path policy, manifest/dependency logic, and CLI validation.
+- Use fake HTTP integration tests for the urun API contract and retry/error flows.
+- Keep real-service tests small and explicit; MinIO is the local smoke for presigned upload behavior.
+- Maintain more than three meaningful tests in each active layer: unit, fake-API integration, and real-service MinIO integration.
+- Do not raise coverage by adding broad E2E tests or assertions against incidental implementation details.
+
+To run the optional MinIO integration test locally:
+
+```bash
+docker compose -f compose.minio.yml up -d
+URUN_TEST_MINIO_ENDPOINT=127.0.0.1:9000 \
+URUN_TEST_MINIO_ACCESS_KEY=minioadmin \
+URUN_TEST_MINIO_SECRET_KEY=minioadmin \
+uv run pytest -q -m minio
+```
+
+## Pre-commit
+
+This repo follows urun's centralized Dagger pre-commit pipeline in CI. Local hooks live in `.pre-commit-config.yaml`; CI invokes them through `urun-sh/dagger-pipeline`. The Nix/direnv shell provides Dagger and actionlint so maintainers can reproduce the same pre-commit environment locally.
+
+## Scope
+
+This repository owns the Python CLI package. Supabase Edge Functions, S3/SQS wiring, builder pods, ZeroFS materialization, and ArgoCD integration are platform components tracked separately.

urun_cli-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 urun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

urun_cli-0.1.1/PKG-INFO

@@ -0,0 +1,130 @@
+Metadata-Version: 2.4
+Name: urun-cli
+Version: 0.1.1
+Summary: End-user CLI for deploying apps to urun
+Project-URL: Homepage, https://urun.sh
+Project-URL: Repository, https://github.com/urun-sh/urun-cli
+Project-URL: Issues, https://github.com/urun-sh/urun-cli/issues
+Author: urun
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,deploy,urun
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# urun CLI
+
+End-user command line client for deploying Python apps to urun.
+
+## Install
+
+```bash
+uv tool install urun-cli
+# or
+pip install urun-cli
+```
+
+The installed executable is still `urun`:
+
+```bash
+urun --version
+```
+
+PyPI does not allow the distribution name `urun`, so ephemeral uv runs need the
+package name explicitly:
+
+```bash
+uvx --from urun-cli urun --version
+# or use the package-matching alias
+uvx urun-cli --version
+```
+
+## Deploy
+
+```bash
+export URUN_API_KEY=urun_<32hex>
+export URUN_ORG_ID=org_...  # bootstrap-era requirement for v1 manifests
+urun deploy app.py
+```
+
+## Development with uv / Nix
+
+This repo includes `flake.nix` and `.envrc` for a reproducible dev shell with uv,
+Python 3.12, Dagger, actionlint, and pre-commit.
+
+```bash
+direnv allow  # optional, if you use direnv/nix
+uv sync
+uv run pytest
+uv run urun --version
+uv build
+```
+
+CI uses the same centralized Dagger pre-commit pipeline pattern as `urun`:
+`precommit.yaml` checks out `urun-sh/dagger-pipeline` and runs `recipes.precommit`.
+Normal `ci` remains self-contained and runs on public/fork PRs.
+
+Optional local MinIO integration test:
+
+```bash
+docker compose -f compose.minio.yml up -d
+URUN_TEST_MINIO_ENDPOINT=127.0.0.1:9000 \
+URUN_TEST_MINIO_ACCESS_KEY=minioadmin \
+URUN_TEST_MINIO_SECRET_KEY=minioadmin \
+uv run pytest -q -m minio
+```
+
+See `SPEC_TRACKING.md` for spec coverage and remaining gaps.
+
+## Configuration
+
+Configuration is read from `urun.toml` when present. CLI flags override config values.
+
+```toml
+[app]
+name = "my-app"
+entrypoint = "src/myapp/main.py"
+python_version = "3.12"
+
+[[mounts]]
+local_path = "./assets"
+remote_path = "/app/assets"
+
+[deps]
+requirements = "requirements.txt"
+```
+
+Common options:
+
+| Option | Description |
+| --- | --- |
+| `-m, --module` | Deploy a Python module entrypoint, e.g. `myapp.main`. |
+| `--name` | Override the derived app name. |
+| `--config` | Use a specific `urun.toml`; relative paths resolve from its directory. |
+| `--api-url` | Override the API URL. |
+| `--api-key` | API key; prefer `URUN_API_KEY` for shell history safety. |
+| `--org-id` | Bootstrap-era org ID required in v1 manifests. |
+| `--no-wait` | Finalize but do not poll for readiness. |
+| `--poll-interval`, `--timeout` | Control readiness polling. |
+
+## Troubleshooting
+
+| Error | Fix |
+| --- | --- |
+| `missing API key` | Set `URUN_API_KEY` or pass `--api-key`. |
+| `invalid API key format` | Use `urun_<32 lowercase hex chars>`. |
+| `missing org id` | Set `URUN_ORG_ID` while v1 bootstrap is manual. |
+| `entrypoint not found` | Run from the project root or pass `--config`. |
+| `path is outside the project root` | Move the file under the project or adjust `urun.toml`. |
+
+## License
+
+MIT. Local MinIO is used only as an optional S3-compatible test service.