vm-tool 1.0.41__py3-none-any.whl → 1.0.43__py3-none-any.whl

vm_tool/cli.py

@@ -6,7 +6,7 @@ def main():
     parser = argparse.ArgumentParser(
         description="VM Tool: Setup, Provision, and Manage VMs"
     )
-    parser.add_argument("--version", action="version", version="1.0.41")
+    parser.add_argument("--version", action="version", version="1.0.43")
     parser.add_argument(
         "--verbose", "-v", action="store_true", help="Enable verbose output"
     )
@@ -168,6 +168,29 @@ def main():
         "--inventory", type=str, default="inventory.yml", help="Inventory file to use"
     )
 
+    # Hydrate Env command
+    hydrate_parser = subparsers.add_parser(
+        "hydrate-env", help="Hydrate missing env files from secrets"
+    )
+    hydrate_parser.add_argument(
+        "--compose-file",
+        type=str,
+        default="docker-compose.yml",
+        help="Path to docker-compose.yml",
+    )
+    hydrate_parser.add_argument(
+        "--secrets",
+        type=str,
+        required=True,
+        help="JSON string of GitHub secrets",
+    )
+    hydrate_parser.add_argument(
+        "--project-root",
+        type=str,
+        default=".",
+        help="Project root directory",
+    )
+
     # Docker Deploy command
     docker_parser = subparsers.add_parser(
         "deploy-docker", help="Deploy using Docker Compose"
@@ -271,6 +294,23 @@ def main():
         help="CI/CD Platform",
     )
 
+    # Secrets command
+    secrets_parser = subparsers.add_parser("secrets", help="Manage secrets")
+    secrets_subparsers = secrets_parser.add_subparsers(
+        dest="secrets_command", help="Secrets operations"
+    )
+
+    # secrets sync
+    sync_parser = secrets_subparsers.add_parser(
+        "sync", help="Sync local .env to GitHub Secrets"
+    )
+    sync_parser.add_argument(
+        "--env-file", type=str, default=".env", help="Path to .env file"
+    )
+    sync_parser.add_argument(
+        "--repo", type=str, help="Target GitHub repository (owner/repo)"
+    )
+
     args = parser.parse_args()
 
     # Configure logging based on flags
@@ -637,6 +677,25 @@ def main():
             print(f"Error: {e}")
             sys.exit(1)
 
+    elif args.command == "hydrate-env":
+        try:
+            import json
+            from vm_tool.runner import SetupRunner, SetupRunnerConfig
+
+            secrets_map = json.loads(args.secrets)
+            config = SetupRunnerConfig(github_project_url="dummy")
+            runner = SetupRunner(config)
+
+            print("💧 Hydrating environment files from secrets...")
+            runner.hydrate_env_from_secrets(
+                compose_file=args.compose_file,
+                secrets_map=secrets_map,
+                project_root=args.project_root,
+            )
+        except Exception as e:
+            print(f"❌ Failed to hydrate env: {e}")
+            sys.exit(1)
+
     elif args.command == "completion":
         from vm_tool.completion import print_completion, install_completion
 
@@ -760,6 +819,63 @@ def main():
         except Exception as e:
             print(f"Error: {e}")
             sys.exit(1)
+    elif args.command == "secrets":
+        if args.secrets_command == "sync":
+            from vm_tool.secrets import SecretsManager
+            import os
+
+            if not os.path.exists(args.env_file):
+                print(f"❌ Env file not found: {args.env_file}")
+                sys.exit(1)
+
+            try:
+                manager = SecretsManager.from_github(repo=args.repo)
+
+                print(f"📖 Reading secrets from {args.env_file}...")
+                secrets_to_sync = {}
+                with open(args.env_file, "r") as f:
+                    for line in f:
+                        line = line.strip()
+                        if not line or line.startswith("#"):
+                            continue
+                        # Basic env parsing
+                        if "=" in line:
+                            key, value = line.split("=", 1)
+                            key = key.strip()
+                            value = value.strip().strip("'").strip('"')
+                            secrets_to_sync[key] = value
+
+                if not secrets_to_sync:
+                    print("⚠️  No secrets found to sync.")
+                    sys.exit(0)
+
+                print(f"🚀 Syncing {len(secrets_to_sync)} secrets to GitHub...")
+                # Confirm with user
+                confirm = (
+                    input(
+                        f"Proceed to upload {len(secrets_to_sync)} secrets? (yes/no): "
+                    )
+                    .strip()
+                    .lower()
+                )
+                if confirm != "yes":
+                    print("❌ Operation cancelled.")
+                    sys.exit(0)
+
+                success_count = 0
+                for key, value in secrets_to_sync.items():
+                    print(f"   Uploading {key}...")
+                    if manager.set(key, value):
+                        success_count += 1
+
+                print(
+                    f"\n✨ Successfully synced {success_count}/{len(secrets_to_sync)} secrets!"
+                )
+
+            except Exception as e:
+                print(f"❌ Error syncing secrets: {e}")
+                sys.exit(1)
+
     else:
         parser.print_help()
 

vm_tool/generator.py

@@ -22,6 +22,8 @@ class PipelineGenerator:
         health_url: Optional[str] = None,
         backup_paths: Optional[list] = None,
         app_port: int = 8000,
+        hydrate_env: bool = True,
+        combine_compose: bool = True,
     ):
         self.platform = platform
         self.strategy = strategy
@@ -37,6 +39,8 @@ class PipelineGenerator:
         )
         self.backup_paths = backup_paths or ["/app", "/etc/nginx"]
         self.app_port = app_port
+        self.hydrate_env = hydrate_env
+        self.combine_compose = combine_compose
 
         # New options
         self.run_linting = False
@@ -50,8 +54,7 @@ class PipelineGenerator:
         run_tests: bool = False,
         python_version: str = "3.11",
         branch: str = "main",
-    ):
-        """Set additional options for the pipeline."""
+    ):        """Set additional options for the pipeline."""
         self.run_linting = run_linting
         self.run_tests = run_tests
         self.python_version = python_version
@@ -120,6 +123,12 @@ class PipelineGenerator:
         if self.enable_dry_run:
             steps.append(self._step_dry_run())
 
+        if self.hydrate_env:
+            steps.append(self._step_hydrate_env())
+            
+        if self.combine_compose:
+            steps.append(self._step_combine_compose())
+            
         # Main deployment
         steps.append(self._step_deploy())
 
@@ -143,7 +152,7 @@ class PipelineGenerator:
         # Combine all steps
         steps_yaml = "\n".join(steps)
 
-        return f"""name: Deploy to EC2 with vm_tool
+        return f"""name: Deploy with vm_tool
 
 on:
   push:
@@ -153,8 +162,8 @@ on:
   workflow_dispatch:
 
 env:
-  EC2_HOST: ${{{{ secrets.EC2_HOST }}}}
-  EC2_USER: ${{{{ secrets.EC2_USER }}}}
+  SSH_HOSTNAME: ${{{{ secrets.SSH_HOSTNAME }}}}
+  SSH_USERNAME: ${{{{ secrets.SSH_USERNAME }}}}
   APP_PORT: {self.app_port}
 
 jobs:
@@ -176,16 +185,16 @@ jobs:
           echo "🔐 Validating GitHub Secrets..."
           MISSING_SECRETS=()
           
-          if [ -z "${{ secrets.EC2_HOST }}" ]; then
-            MISSING_SECRETS+=("EC2_HOST")
+          if [ -z "${{ secrets.SSH_HOSTNAME }}" ]; then
+            MISSING_SECRETS+=("SSH_HOSTNAME")
           fi
           
-          if [ -z "${{ secrets.EC2_USER }}" ]; then
-            MISSING_SECRETS+=("EC2_USER")
+          if [ -z "${{ secrets.SSH_USERNAME }}" ]; then
+            MISSING_SECRETS+=("SSH_USERNAME")
           fi
           
-          if [ -z "${{ secrets.EC2_SSH_KEY }}" ]; then
-            MISSING_SECRETS+=("EC2_SSH_KEY")
+          if [ -z "${{ secrets.SSH_ID_RSA }}" ]; then
+            MISSING_SECRETS+=("SSH_ID_RSA")
           fi
           
           if [ ${#MISSING_SECRETS[@]} -ne 0 ]; then
@@ -199,16 +208,16 @@ jobs:
             echo "2. Add each secret:"
             echo ""
             
-            if [[ " ${MISSING_SECRETS[*]} " =~ " EC2_HOST " ]]; then
-              echo "   EC2_HOST: Your EC2 IP (e.g., 54.123.45.67)"
+            if [[ " ${MISSING_SECRETS[*]} " =~ " SSH_HOSTNAME " ]]; then
+              echo "   SSH_HOSTNAME: Your Server IP (e.g., 54.123.45.67)"
             fi
             
-            if [[ " ${MISSING_SECRETS[*]} " =~ " EC2_USER " ]]; then
-              echo "   EC2_USER: SSH username (e.g., ubuntu)"
+            if [[ " ${MISSING_SECRETS[*]} " =~ " SSH_USERNAME " ]]; then
+              echo "   SSH_USERNAME: SSH username (e.g., ubuntu)"
             fi
             
-            if [[ " ${MISSING_SECRETS[*]} " =~ " EC2_SSH_KEY " ]]; then
-              echo "   EC2_SSH_KEY: Run 'cat ~/.ssh/id_rsa' and copy output"
+            if [[ " ${MISSING_SECRETS[*]} " =~ " SSH_ID_RSA " ]]; then
+              echo "   SSH_ID_RSA: Run 'cat ~/.ssh/id_rsa' and copy output"
             fi
             
             echo ""
@@ -293,9 +302,54 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh
-          echo "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/deploy_key
+          echo "${{ secrets.SSH_ID_RSA }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts"""
+          ssh-keyscan -H ${{ secrets.SSH_HOSTNAME }} >> ~/.ssh/known_hosts
+          
+          # Create SSH config to use the key for the specific host
+          cat > ~/.ssh/config <<EOF
+          Host ${{ secrets.SSH_HOSTNAME }}
+            User ${{ secrets.SSH_USERNAME }}
+            IdentityFile ~/.ssh/deploy_key
+            StrictHostKeyChecking no
+          EOF"""
+
+    def _step_hydrate_env(self) -> str:
+        return """
+      - name: Hydrate Environment Files from Secrets
+        env:
+          SECRETS_CONTEXT: ${{ toJSON(secrets) }}
+        run: |
+          # Use vm_tool to create local env files from secrets based on compose file
+          vm_tool hydrate-env \\
+            --compose-file docker-compose.yml \\
+            --secrets "$SECRETS_CONTEXT"
+          echo "✅ Hydrated environment files from secrets"
+"""
+
+    def _step_combine_compose(self) -> str:
+        return """
+      - name: Combine Docker Compose files
+        run: |
+          # Combine base and prod compose files if prod exists
+          if [ -f docker/docker-compose.prod.yml ]; then
+            echo "Merging docker-compose.yml and docker/docker-compose.prod.yml..."
+            docker compose -f docker-compose.yml -f docker/docker-compose.prod.yml config > docker-compose.released.yml
+          elif [ -f docker-compose.prod.yml ]; then
+             echo "Merging docker-compose.yml and docker-compose.prod.yml..."
+             docker compose -f docker-compose.yml -f docker-compose.prod.yml config > docker-compose.released.yml
+          else
+            echo "No prod overriding file found, using base file..."
+            docker compose -f docker-compose.yml config > docker-compose.released.yml
+          fi
+          
+          # Replace absolute paths (from CI runner) with relative paths
+          # This assumes the structure: /home/runner/work/repo/repo/ -> ./
+          sed -i 's|/home/runner/work/[^/]*/[^/]*||g' docker-compose.released.yml
+          
+          echo "✅ Generated combined Docker Compose file"
+          cat docker-compose.released.yml
+"""
 
     def _step_validate_ssh(self) -> str:
         return """
@@ -356,25 +410,52 @@ jobs:
     def _step_deploy(self) -> str:
         return """
       - name: Deploy with vm_tool (Ansible-based)
+        env:
+          # Define deployment command for the released file
+          DEPLOY_COMMAND: "docker compose -f docker-compose.released.yml up -d --remove-orphans"
         run: |
           # Create inventory file for Ansible
           cat > inventory.yml << EOF
           all:
             hosts:
               production:
-                ansible_host: ${{ secrets.EC2_HOST }}
-                ansible_user: ${{ secrets.EC2_USER }}
+                ansible_host: ${{ secrets.SSH_HOSTNAME }}
+                ansible_user: ${{ secrets.SSH_USERNAME }}
                 ansible_ssh_private_key_file: ~/.ssh/deploy_key
           EOF
           
           # Deploy using vm_tool (uses Ansible under the hood)
           export GITHUB_REPOSITORY_OWNER=${{ github.repository_owner }}
-          vm_tool deploy-docker \\
-            --host ${{ secrets.EC2_HOST }} \\
-            --user ${{ secrets.EC2_USER }} \\
-            --compose-file ~/app/docker-compose.yml \\
-            --inventory inventory.yml \\
-            --force"""
+          
+          # Determine Project Directory based on user (handle root case)
+          if [ "${{ secrets.SSH_USERNAME }}" = "root" ]; then
+            HOME_DIR="/root"
+          else
+            HOME_DIR="/home/${{ secrets.SSH_USERNAME }}"
+          fi
+          PROJECT_DIR="${HOME_DIR}/apps/${{ github.event.repository.name }}"
+          
+          # Prepare arguments
+          ARGS=(
+            "--inventory" "inventory.yml"
+            "--compose-file" "docker-compose.released.yml"
+            "--project-dir" "$PROJECT_DIR"
+            "--deploy-command" "${{ env.DEPLOY_COMMAND }}"
+            "--force"
+            "--health-url" "http://${{ secrets.SSH_HOSTNAME }}:${{ env.APP_PORT }}/health"
+            "--host" "${{ secrets.SSH_HOSTNAME }}"
+            "--user" "${{ secrets.SSH_USERNAME }}"
+          )
+
+          # Move .env if it exists and add to args
+          if [ -f .env ]; then
+            mkdir -p env
+            mv .env env/.env
+            ARGS+=("--env-file" "env/.env")
+          fi
+          
+          vm_tool deploy-docker "${ARGS[@]}"
+"""
 
     def _step_health_check(self) -> str:
         return f"""
@@ -394,10 +475,13 @@ jobs:
         return """
       - name: Verify
         run: |
-          ssh -i ~/.ssh/deploy_key ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'EOF'
-            cd ~/app
-            docker-compose ps
-            docker-compose logs --tail=20
+          # Use absolute path for verify step too
+          PROJECT_DIR="/home/${{ secrets.SSH_USERNAME }}/apps/${{ github.event.repository.name }}"
+          
+          ssh -i ~/.ssh/deploy_key ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOSTNAME }} << EOF
+            cd $PROJECT_DIR
+            docker compose ps
+            docker compose logs --tail=20
           EOF"""
 
     def _step_rollback(self) -> str:
@@ -406,12 +490,12 @@ jobs:
         if: failure()
         run: |
           echo "⚠️  Rolling back..."
-          ssh -i ~/.ssh/deploy_key ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'EOF'
+          # Note: Rollback logic might need adjustment for absolute paths, keeping simple for now
+          ssh -i ~/.ssh/deploy_key ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOSTNAME }} << 'EOF'
             BACKUP=$(ls -t ~/backups/*.tar.gz 2>/dev/null | head -1)
             if [ -n "$BACKUP" ]; then
-              cd ~/app && tar -xzf $BACKUP
-              docker-compose up -d
-              echo "✅ Rolled back"
+              # TODO: Improve rollback to handle dynamic dirs
+              echo "Rollback not fully implemented for dynamic paths yet"
             fi
           EOF"""
 
@@ -420,7 +504,7 @@ jobs:
       - name: Cleanup
         if: success()
         run: |
-          ssh -i ~/.ssh/deploy_key ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'EOF'
+          ssh -i ~/.ssh/deploy_key ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOSTNAME }} << 'EOF'
             cd ~/backups 2>/dev/null || exit 0
             ls -t *.tar.gz 2>/dev/null | tail -n +6 | xargs rm -f || true
           EOF"""
@@ -431,7 +515,7 @@ jobs:
         if: always()
         run: |
           if [ "${{ job.status }}" == "success" ]; then
-            echo "✅ Deployed to ${{ secrets.EC2_HOST }}:${{ env.APP_PORT }}"
+            echo "✅ Deployed to ${{ secrets.SSH_HOSTNAME }}:${{ env.APP_PORT }}"
           else
             echo "❌ Deployment failed"
           fi"""

vm_tool/runner.py

@@ -171,6 +171,75 @@ class SetupRunner:
         self.env_path = config.env_path
         self.env_data = config.env_data
 
+    def _get_compose_dependencies(self, compose_file: str) -> List[dict]:
+        """
+        Parses docker-compose file to find local file dependencies (env_files, volumes).
+        Returns a list of dicts: {'src': 'local/path', 'dest': 'remote/path'}
+        """
+        dependencies = []
+        if not os.path.exists(compose_file):
+            return dependencies
+
+        try:
+            with open(compose_file, "r") as f:
+                data = yaml.safe_load(f)
+
+            if not data or "services" not in data:
+                return dependencies
+
+            found_paths = set()
+
+            for service in data.get("services", {}).values():
+                # Check env_file
+                env_files = service.get("env_file", [])
+                if isinstance(env_files, str):
+                    env_files = [env_files]
+
+                for env_path in env_files:
+                    # Normalize local path
+                    if env_path.startswith("./"):
+                        clean_path = env_path[2:]
+                    else:
+                        clean_path = env_path
+
+                    # Only include relative paths that are files
+                    if not clean_path.startswith("/") and os.path.exists(clean_path):
+                        if clean_path not in found_paths:
+                            found_paths.add(clean_path)
+                            dependencies.append({"src": clean_path, "dest": clean_path})
+                    elif not os.path.exists(clean_path):
+                        logger.warning(
+                            f"⚠️  Referenced env_file not found locally: {clean_path}"
+                        )
+
+                # Check volumes (bind mounts)
+                volumes = service.get("volumes", [])
+                for vol in volumes:
+                    if isinstance(vol, str):
+                        parts = vol.split(":")
+                        if len(parts) >= 2:
+                            host_path = parts[0]
+                            # Check if it's a relative path bind mount
+                            if (
+                                host_path.startswith("./")
+                                or host_path.startswith("../")
+                            ) and os.path.exists(host_path):
+                                if host_path.startswith("./"):
+                                    clean_path = host_path[2:]
+                                else:
+                                    clean_path = host_path
+
+                                if clean_path not in found_paths:
+                                    found_paths.add(clean_path)
+                                    dependencies.append(
+                                        {"src": clean_path, "dest": clean_path}
+                                    )
+
+        except Exception as e:
+            logger.warning(f"Failed to parse compose file for dependencies: {e}")
+
+        return dependencies
+
     def _get_git_commit(self) -> Optional[str]:
         """Get current git commit hash if in a git repository."""
         import subprocess
@@ -225,6 +294,65 @@ class SetupRunner:
                 f"An error occurred while running the Ansible playbook: {str(e)}"
             )
 
+    def hydrate_env_from_secrets(
+        self, compose_file: str, secrets_map: dict, project_root: str = "."
+    ):
+        """
+        Scans compose file for env_files. If a file is missing locally,
+        checks secrets_map for a matching key (FILENAME_EXT -> FILENAME_EXT output as SNAKE_CASE)
+        and creates the file.
+        Example: env/backend.env -> checks secrets_map['BACKEND_ENV']
+        """
+        dependencies = self._get_compose_dependencies(compose_file)
+
+        # We need to find *potential* dependencies that might not exist yet.
+        # _get_compose_dependencies only returns existing ones.
+        # So we need to parse again broadly or just rely on what we find.
+        # Actually, _get_compose_dependencies skips missing files.
+        # So we should parse manually here to find *missing* ones.
+
+        try:
+            with open(compose_file, "r") as f:
+                data = yaml.safe_load(f)
+
+            if not data or "services" not in data:
+                return
+
+            for service in data.get("services", {}).values():
+                env_files = service.get("env_file", [])
+                if isinstance(env_files, str):
+                    env_files = [env_files]
+
+                for env_path in env_files:
+                    # Resolve path relative to project root
+                    full_path = os.path.join(project_root, env_path)
+
+                    if not os.path.exists(full_path):
+                        # Attempt to hydrate
+                        filename = os.path.basename(env_path)
+                        # Normalize keys: backend.env -> BACKEND_ENV
+                        secret_key = filename.replace(".", "_").upper()
+
+                        secret_value = secrets_map.get(secret_key)
+                        if secret_value:
+                            logger.info(
+                                f"💧 Hydrating {env_path} from secret {secret_key}"
+                            )
+                            # Ensure directory exists
+                            os.makedirs(os.path.dirname(full_path), exist_ok=True)
+                            with open(full_path, "w") as out:
+                                out.write(secret_value)
+                        else:
+                            logger.warning(
+                                f"⚠️  Missing env file {env_path} and no secret found for {secret_key}"
+                            )
+                    else:
+                        logger.debug(f"✅ Env file exists: {env_path}")
+
+        except Exception as e:
+            logger.error(f"Failed to hydrate env files: {e}")
+            raise
+
     def run_setup(self):
         """Runs the setup process using Ansible."""
         extravars = {
@@ -402,6 +530,24 @@ class SetupRunner:
         if deploy_command:
             extravars["DEPLOY_COMMAND"] = deploy_command
 
+        # Dynamic Dependency Detection
+        dependencies = self._get_compose_dependencies(compose_file)
+
+        # Ensure CLI-provided env_file is included in detection logic
+        if env_file:
+            # Normalize and check existence
+            clean_env_path = env_file[2:] if env_file.startswith("./") else env_file
+            if os.path.exists(clean_env_path):
+                # Check if already in dependencies
+                if not any(d["src"] == clean_env_path for d in dependencies):
+                    dependencies.append({"src": clean_env_path, "dest": clean_env_path})
+
+        if dependencies:
+            logger.info(
+                f"📦 Detected dependencies to copy: {[d['src'] for d in dependencies]}"
+            )
+            extravars["FILES_TO_COPY"] = dependencies
+
         playbook_path = os.path.join(
             os.path.dirname(__file__), "vm_setup", "push_code.yml"
         )

vm_tool/secrets.py

@@ -246,6 +246,76 @@ class EncryptedFileBackend(SecretsBackend):
             return False
 
 
+class GitHubSecretsBackend(SecretsBackend):
+    """GitHub Actions Secrets backend using 'gh' CLI."""
+
+    def __init__(self, repo: Optional[str] = None):
+        import shutil
+
+        self.gh_cli = shutil.which("gh")
+        if not self.gh_cli:
+            raise RuntimeError("GitHub CLI ('gh') is not installed.")
+        self.repo = repo
+
+    def get_secret(self, key: str) -> Optional[str]:
+        """
+        Get secret from GitHub.
+        Note: GitHub Secrets are write-only. We can't retrieve the value.
+        """
+        logger.warning("Cannot retrieve secret value from GitHub (write-only).")
+        return None
+
+    def set_secret(self, key: str, value: str) -> bool:
+        """Set secret in GitHub Actions."""
+        import subprocess
+
+        cmd = ["gh", "secret", "set", key]
+        if self.repo:
+            cmd.extend(["--repo", self.repo])
+
+        try:
+            # Pass value via stdin
+            subprocess.run(cmd, input=value, check=True, text=True, capture_output=True)
+            logger.info(f"Secret '{key}' stored in GitHub Secrets")
+            return True
+        except subprocess.CalledProcessError as e:
+            logger.error(f"Failed to set secret in GitHub: {e.stderr.strip()}")
+            return False
+
+    def delete_secret(self, key: str) -> bool:
+        """Delete secret from GitHub Actions."""
+        import subprocess
+
+        cmd = ["gh", "secret", "delete", key]
+        if self.repo:
+            cmd.extend(["--repo", self.repo])
+
+        try:
+            subprocess.run(cmd, check=True, text=True, capture_output=True)
+            logger.info(f"Secret '{key}' deleted from GitHub Secrets")
+            return True
+        except subprocess.CalledProcessError as e:
+            logger.error(f"Failed to delete secret from GitHub: {e.stderr.strip()}")
+            return False
+
+    def list_secrets(self) -> list:
+        """List all secret keys in GitHub Actions."""
+        import subprocess
+        import json
+
+        cmd = ["gh", "secret", "list", "--json", "name"]
+        if self.repo:
+            cmd.extend(["--repo", self.repo])
+
+        try:
+            result = subprocess.run(cmd, check=True, text=True, capture_output=True)
+            secrets = json.loads(result.stdout)
+            return [s["name"] for s in secrets]
+        except Exception as e:
+            logger.error(f"Failed to list secrets from GitHub: {e}")
+            return []
+
+
 class SecretsManager:
     """Unified secrets manager supporting multiple backends."""
 
@@ -283,3 +353,8 @@ class SecretsManager:
     def from_file(cls, secrets_file: str = ".secrets.enc", **kwargs):
         """Create secrets manager with encrypted file backend."""
         return cls(EncryptedFileBackend(secrets_file, **kwargs))
+
+    @classmethod
+    def from_github(cls, repo: Optional[str] = None):
+        """Create secrets manager with GitHub backend."""
+        return cls(GitHubSecretsBackend(repo))

vm_tool/vm_setup/push_code_tasks.yml

@@ -31,10 +31,35 @@
     src: "{{ SOURCE_PATH }}/{{ DOCKER_COMPOSE_FILE_PATH }}"
     dest: "{{ project_dest_dir }}/{{ DOCKER_COMPOSE_FILE_PATH }}"
 
+# Handle dynamic dependencies (new method)
+- name: Ensure parent directories for dependencies exist
+  file:
+    path: "{{ project_dest_dir }}/{{ item.dest | dirname }}"
+    state: directory
+    mode: '0755'
+  loop: "{{ FILES_TO_COPY | default([]) }}"
+  when: FILES_TO_COPY is defined and (item.dest | dirname) != ''
+
+- name: Copy dependency files
+  copy:
+    src: "{{ SOURCE_PATH }}/{{ item.src }}"
+    dest: "{{ project_dest_dir }}/{{ item.dest }}"
+  loop: "{{ FILES_TO_COPY | default([]) }}"
+  when: FILES_TO_COPY is defined
+
+# Backward compatibility for single env file
+- name: Ensure Env file parent directory exists
+  file:
+    path: "{{ project_dest_dir }}/{{ ENV_FILE_PATH | default('.env') | dirname }}"
+    state: directory
+    mode: '0755'
+  when: FILES_TO_COPY is not defined and ENV_FILE_PATH is defined and (ENV_FILE_PATH | dirname) != ''
+
 - name: Copy Env file
   copy:
     src: "{{ SOURCE_PATH }}/{{ ENV_FILE_PATH | default('.env') }}"
     dest: "{{ project_dest_dir }}/{{ ENV_FILE_PATH | default('.env') }}"
+  when: FILES_TO_COPY is not defined
   failed_when: false
 
 - name: Deploy application

{vm_tool-1.0.41.dist-info → vm_tool-1.0.43.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vm_tool
-Version: 1.0.41
+Version: 1.0.43
 Summary: A Comprehensive Tool for Setting Up Virtual Machines.
 Home-page: https://github.com/thesunnysinha/vm_tool
 Author: Sunny Sinha

{vm_tool-1.0.41.dist-info → vm_tool-1.0.43.dist-info}/RECORD

@@ -24,13 +24,13 @@ vm_tool/alerting.py,sha256=6bNfQNSAQ_SJW9dQfB8s8gDZ-7ocYw4Q211VM6FWiXU,8269
 vm_tool/audit.py,sha256=spVtMcwadTkD9lELH1tur7Dr3OHjajk44ZatKYEbeVI,3388
 vm_tool/backup.py,sha256=WhwCXXJDYCQgoexroksNhWgB5ki6HUly0JhQ9ybCdMg,4130
 vm_tool/benchmarking.py,sha256=9AZ4JwKd5aEjwtKnhsuFa77y6WSO_fSEIqgMh3w_Btw,6212
-vm_tool/cli.py,sha256=hGejO4g8lYRaqInDbYeBkvwTJaKRRjXdGxx4UaJVVB8,28828
+vm_tool/cli.py,sha256=tnyBOQIJ-ahT52UAgaisXHnkUewTZifju4q9gqfO4XU,32844
 vm_tool/cloud.py,sha256=1fQV1o3wCth55B1hSenME_j2n5gCJDo9gtUcqDxCs7s,4047
 vm_tool/completion.py,sha256=U8W8mmNdR0Ci0WjlEIa8CLOUtaVLZ5tWYpqViBBIBF8,7431
 vm_tool/compliance.py,sha256=7yXrvRoPxJMW0DTVhJ-ZxbaJo7quDSVgae2_mYbVAmE,3173
 vm_tool/config.py,sha256=F589SFyxTWmXyvZLWgvvMypJjTO9PeH9sR_g655tgJo,3270
 vm_tool/drift.py,sha256=Rzw5TItsfqVMqgV8JFbqJzJe-qAb1x1G_2ue8wzNCAs,3301
-vm_tool/generator.py,sha256=m_8XgAVVMbCK9g0XXYmSvlnVafAbl3KnvfkDnKxMFxc,14610
+vm_tool/generator.py,sha256=2JDOQ84mEWsnTum1JEtb8NLrE7rcrR_XUe36Pp2tLDU,18317
 vm_tool/health.py,sha256=CupB1JAJprlarcCmP2WJwtAekNxPCPcUGipZQcRiZg4,6468
 vm_tool/history.py,sha256=6Nh0-L4rrKTKfunJXvovOzO1uHyuDCQvZIb7PgZaBh8,4207
 vm_tool/kubernetes.py,sha256=0CABF2Wyc9y56ueFGFduShe7T6GlIOqmg8MGG-Ro2BY,3137
@@ -41,8 +41,8 @@ vm_tool/policy.py,sha256=Z05TLSqMu-tSM0_SnCdsIZqebHGRtXNSRLwkOBDthtY,6072
 vm_tool/rbac.py,sha256=hdFzh4QhUuQmGmMXBuG-o21FdEp1fb8WSJrCWAz-drI,3999
 vm_tool/recovery.py,sha256=fesho6Pi_ItRkdtiNK2bh-8Q_T98kSn2LZwKovMFsWI,5473
 vm_tool/reporting.py,sha256=yiLdArTfu7A8-PWL3dmFSRNpcMvBSq1iHNw6YJRO1hI,7419
-vm_tool/runner.py,sha256=JoksxK31e2zVd4t-vHA8_GFrVvgeUngoMU9AFNxoxw4,17666
-vm_tool/secrets.py,sha256=bvbunxt4dLupFZQs3VUHkxDOASoBgtpggO0oavTuzOk,9397
+vm_tool/runner.py,sha256=V5ssrj6z1RwCC3GJhlnwxn-CqoFm7NfkzJpUr5U9CS8,24049
+vm_tool/secrets.py,sha256=9P0ENQE7zak1b6BV_3KLFWlPxFnokLew6-Eo04xk1zY,11991
 vm_tool/ssh.py,sha256=c9Nxs20VEq--qWCLZyc6uRqgny2-OCSwnTlcx9bZJtg,4905
 vm_tool/state.py,sha256=DxJoRLITwT8mWcs_eAgFNTDfcrGh4PMdQuFjdGb1n6Y,4079
 vm_tool/validation.py,sha256=DdfCzTsMU9-Br0MnhV8ZjIjYKBjSYLko30U0nXGzF1g,8990
@@ -58,7 +58,7 @@ vm_tool/vm_setup/main.yml,sha256=QUWUFf7W1y9dvfL-sfYIgh491cxRBTm521jI4he24Jg,657
 vm_tool/vm_setup/monitoring.yml,sha256=u4WhkO2P6O2Mrqo02z8G_FshcFjAbY1Avve5mb5sxZs,1090
 vm_tool/vm_setup/project_service.yml,sha256=YlvRx9XgW2X1MsKa9XWr7LWK-BET2zFly8Q-7cNedH4,545
 vm_tool/vm_setup/push_code.yml,sha256=U5zqx04oV2S4U4VsXaecn8S9_UrZGEcTjKbhIZdCgs8,112
-vm_tool/vm_setup/push_code_tasks.yml,sha256=dgPgcn3WAxff50GiWB7z2cWpndoqPZWOvij7DZzBxwM,1773
+vm_tool/vm_setup/push_code_tasks.yml,sha256=jG_4MTJAvwslx42Jy4Q4JqECJyUGHzM59hLNVsK9H0c,2663
 vm_tool/vm_setup/setup.yml,sha256=D3qsBkzWEWEgeAmxO7bk99wxUaFImeSbZNVa3I2BXR8,659
 vm_tool/vm_setup/setup_project_env.yml,sha256=Q4K6ZgGfgP8pW-QKV3Wkvb0V82AGjHoWB9TM8xq2Nd0,274
 vm_tool/vm_setup/docker/create_docker_service.yml,sha256=C4nZpFBVzA7_xn0PEMIpYjXcYyA73ClxdMQgTh319eI,2140
@@ -66,9 +66,9 @@ vm_tool/vm_setup/docker/docker_setup.yml,sha256=kg6Abu3TjcLwV0JHnCAVUkj5l2HaGf7O
 vm_tool/vm_setup/docker/install_docker_and_compose.yml,sha256=NxPm4YkOekRH0dpJQVgxjcSqrmT6f912Dv0owYsLBxE,3402
 vm_tool/vm_setup/docker/login_to_docker_hub.yml,sha256=y9WaWLb1f1SuHVa1NNm24Gvf5bbwQ8eqEsImGLHGHGU,223
 vm_tool/vm_setup/github/git_configuration.yml,sha256=hKuzOFsVlYRoBAXujREfrLiqV7j4RnQYbL5s63AEAqk,2355
-vm_tool-1.0.41.dist-info/licenses/LICENSE,sha256=4OO6Zd_hYEOemzTNdgUR_E7oNvUJLuN2E7ZAgm7DcSM,1063
-vm_tool-1.0.41.dist-info/METADATA,sha256=KA8Bf6CN-LevNXhQQocYBSuyGn7kL8Xc5-6YzmwB9h4,6191
-vm_tool-1.0.41.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-vm_tool-1.0.41.dist-info/entry_points.txt,sha256=A2EAvw95ftFXzVAWfHKIM-SsxQVxrIrByRNe-ArOp2k,45
-vm_tool-1.0.41.dist-info/top_level.txt,sha256=jTLckJpKvJplpmKoMhPz2YKp_sQB9Q5-cCGmUHCp06M,17
-vm_tool-1.0.41.dist-info/RECORD,,
+vm_tool-1.0.43.dist-info/licenses/LICENSE,sha256=4OO6Zd_hYEOemzTNdgUR_E7oNvUJLuN2E7ZAgm7DcSM,1063
+vm_tool-1.0.43.dist-info/METADATA,sha256=1DmAVhK16JHzjPIgDwXMaTq7doMsC-BiuPlxYLcii_E,6191
+vm_tool-1.0.43.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+vm_tool-1.0.43.dist-info/entry_points.txt,sha256=A2EAvw95ftFXzVAWfHKIM-SsxQVxrIrByRNe-ArOp2k,45
+vm_tool-1.0.43.dist-info/top_level.txt,sha256=jTLckJpKvJplpmKoMhPz2YKp_sQB9Q5-cCGmUHCp06M,17
+vm_tool-1.0.43.dist-info/RECORD,,