Metadata-Version: 2.5
Name: af-cicd
Version: 0.4.0
Summary: shared cicd tooling
Author-email: hello <hello@allfly.io>
License-Expression: MIT
Requires-Python: <4.0,>=3.13
Requires-Dist: boto3>=1.35.0
Requires-Dist: inquirer<4.0.0,>=3.3.0
Requires-Dist: packaging>=24.1
Requires-Dist: slack-sdk<4.0.0,>=3.34.0
Requires-Dist: typer[slim]<0.21.0,>=0.20.0
Description-Content-Type: text/markdown

# tools-cicd
share cicd scripts

# Running tool locally

## Example:
```shell
uv sync
AWS_PROFILE=dev-admin-terraform uv run cicd --help
uv run cicd --version      # or `cicd version`
uv run pytest
```

# Release Procedures
- This project uses "trunk" based development off of `master`.
- PRs are allowed but always folded back to `master`.
- Releasing is manual through the `publish.yml` workflow.
- **To release**:
  - Ensure all your features are ready on `master`
  - Trigger the `publish.yml` workflow with `workflow_dispatch` and choose `patch`, `minor`, or `major` for `bump`.
    - The workflow runs `uv version --bump` to auto-rev the version, commits `pyproject.toml` + `uv.lock`,
      tags `vX.Y.Z`, then builds with `uv build` and publishes to PyPI.


# Multi-Repository Release Coordination

The `quest-v2` project includes a coordinated release script that allows you to trigger deployments across all related Quest v2 repositories simultaneously, rather than having to manually trigger each repository's release workflow individually.

### Prerequisites

1. **GitHub CLI**: Install the GitHub CLI tool
   ```bash
   # macOS
   brew install gh
   
   # Ubuntu/Debian
   sudo apt install gh
   
   # Windows
   winget install GitHub.cli
   ```

2. **Authentication**: Authenticate with GitHub
   ```bash
   gh auth login
   ```

3. **Script Setup**: Navigate to the quest-v2 directory and make the script executable
   ```bash
   cd quest-v2
   chmod +x release-all.sh
   ```

### Usage

From the `quest-v2` directory, the script supports promoting from `develop` to `qa`:

```bash
# Promote to QA
./release-all.sh

# Show help and options
./release-all.sh --help
```

### What it does

The script will:
1. Trigger the "Release" workflow on all three Quest v2 repositories:
   - `allfly-quest-ui`
   - `allfly-quest-core-api`
   - `gds-api`
2. Promote code from `develop` branch to `qa`
3. Provide real-time status updates and links to monitor progress
4. Display a summary of successful and failed releases

### Monitoring

After triggering the releases, you can monitor progress through:
- The provided GitHub Actions URLs in the script output
- GitHub's Actions tab in each repository
- Your configured Slack notifications (if enabled)

> **Note**: The script requires appropriate permissions to trigger workflows on all three Quest v2 repositories. Ensure your GitHub account has the necessary access rights.

# Vulnerability scans (`cicd vscan`)

Weekly dependency audit that also fixes what it can, as **one PR per repo**:

```shell
cicd vscan python                      # scan only (pip-audit against uv.lock)
cicd vscan python --fix --dry-run      # show the upgrade plan, touch nothing
cicd vscan python --fix                # upgrade uv.lock locally and re-scan
cicd vscan python --open-pr --notify   # CI: commit, open/update `chore/vscan-python` PR, post to Slack
```

`cicd vscan npm` takes the same flags. It runs `npm audit fix --package-lock-only` (never `--force`) and
diffs `package-lock.json` to report what moved; fixes that need a breaking upgrade are listed under
"Needs attention". A dry run fixes and re-audits a throwaway copy, so its report matches a real run.

- Each vulnerable package is pinned to the **smallest version that fixes all of its advisories**
  (`uv lock --upgrade-package pkg==x`). Upgrades that `uv` can't resolve (e.g. another dependency
  caps the version) or that exceed `max_bump` are listed under "Needs attention" instead.
- The PR branch is stable, so an unmerged PR is updated in place the next week instead of piling up.
- The PR must be pushed with `ACTIONS_PAT` (not `GITHUB_TOKEN`) so PR checks run on it.
- Per-repo overrides (display name, base branch, `max_bump`, expiring ignores) live in
  `.github/vscan.toml`; see `src/allfly/vscan/config.py`.
- Repos call the reusable workflow `.github/workflows/vscan.yml` (usage at the top of that file).
- Slack: posts when there are findings or the scan fails. Add `--notify-clean` (or `notify_clean = true`
  in `vscan.toml`) to also post on clean runs. The reusable workflow posts its own alert if the job dies
  before `cicd` can report (e.g. checkout/token errors).
