Updating new version of devolv

Author: RkSinghDeo

devolv/__init__.py

@@ -1,2 +1,2 @@
-__version__ = "0.2.11"
+__version__ = "0.2.12"
 

devolv/drift/aws_fetcher.py

@@ -1,5 +1,6 @@
 import boto3
- 
+import json
+
 def get_aws_policy_document(policy_arn: str) -> dict:
     """
     Fetch the JSON document of the default version of a managed IAM policy.
@@ -23,3 +24,24 @@ def merge_policy_documents(local_doc: dict, aws_doc: dict) -> dict:
             merged.append(stmt)
     aws_doc["Statement"] = merged
     return aws_doc
+
+def build_superset_policy(local_doc: dict, aws_doc: dict) -> dict:
+    """
+    Combine local and AWS policy documents into a superset without duplicate statements.
+    """
+    local_statements = local_doc.get("Statement", [])
+    aws_statements = aws_doc.get("Statement", [])
+
+    seen = set()
+    combined = []
+
+    for stmt in local_statements + aws_statements:
+        stmt_str = json.dumps(stmt, sort_keys=True)
+        if stmt_str not in seen:
+            seen.add(stmt_str)
+            combined.append(stmt)
+
+    return {
+        "Version": "2012-10-17",
+        "Statement": combined
+    }

devolv/drift/cli.py

@@ -4,26 +4,20 @@
 import os
 import subprocess
 
-from devolv.drift.aws_fetcher import get_aws_policy_document, merge_policy_documents
+from devolv.drift.aws_fetcher import get_aws_policy_document, merge_policy_documents, build_superset_policy
 from devolv.drift.issues import create_approval_issue, wait_for_sync_choice
 from devolv.drift.github_approvals import create_github_pr
 from devolv.drift.report import detect_and_print_drift
 
 app = typer.Typer()
 
 def push_branch(branch_name: str):
-    """
-    Create and push a branch with committed changes.
-    """
     try:
         subprocess.run(["git", "checkout", "-b", branch_name], check=True)
-
-        # ✅ Ensure Git identity is set (important for CI runners)
         subprocess.run(["git", "config", "user.email", "github-actions@users.noreply.github.com"], check=True)
         subprocess.run(["git", "config", "user.name", "github-actions"], check=True)
-
         subprocess.run(["git", "add", "."], check=True)
-        subprocess.run(["git", "commit", "-m", f"Update policy from AWS: {branch_name}"], check=True)
+        subprocess.run(["git", "commit", "-m", f"Update policy: {branch_name}"], check=True)
         subprocess.run(["git", "push", "--set-upstream", "origin", branch_name], check=True)
         typer.echo(f"✅ Pushed branch {branch_name} to origin.")
     except subprocess.CalledProcessError as e:
@@ -35,18 +29,12 @@ def drift(
     policy_name: str = typer.Option(..., "--policy-name", help="Name of the IAM policy"),
     policy_file: str = typer.Option(..., "--file", help="Path to local policy file"),
     account_id: str = typer.Option(None, "--account-id", help="AWS Account ID (optional, auto-detected if not provided)"),
-    approvers: str = typer.Option("", help="Comma-separated GitHub usernames for approval"),
+    approvers: str = typer.Option("", help="Comma-separated GitHub usernames for approval (optional)"),
     approval_anyway: bool = typer.Option(False, "--approval-anyway", help="Request approval even if no drift"),
     repo_full_name: str = typer.Option(None, "--repo", help="GitHub repo full name (e.g., org/repo)")
 ):
-    """
-    Detect drift between local policy (file) and AWS policy (ARN),
-    create GitHub issue for approval, and perform sync based on comment.
-    """
     if not account_id:
-        sts = boto3.client("sts")
-        account_id = sts.get_caller_identity()["Account"]
-
+        account_id = boto3.client("sts").get_caller_identity()["Account"]
     policy_arn = f"arn:aws:iam::{account_id}:policy/{policy_name}"
 
     try:
@@ -63,9 +51,7 @@ def drift(
         typer.echo("✅ No drift detected. Use --approval-anyway to force approval.")
         raise typer.Exit()
 
-    if not repo_full_name:
-        repo_full_name = os.getenv("GITHUB_REPOSITORY")
-
+    repo_full_name = repo_full_name or os.getenv("GITHUB_REPOSITORY")
     if not repo_full_name:
         typer.echo("❌ GitHub repo not specified. Use --repo or set GITHUB_REPOSITORY.")
         raise typer.Exit(1)
@@ -75,38 +61,51 @@ def drift(
         typer.echo("❌ GITHUB_TOKEN not set in environment.")
         raise typer.Exit(1)
 
-    issue_num = create_approval_issue(repo_full_name, token, policy_name)
-    typer.echo(f"Issue #{issue_num} created for approval.")
+    assignees = [a.strip() for a in approvers.split(",") if a.strip()]
+    issue_num, _ = create_approval_issue(repo_full_name, token, policy_name, assignees=assignees)
+    typer.echo(f"✅ Created issue #{issue_num} for approval.")
 
     choice = wait_for_sync_choice(repo_full_name, issue_num, token)
+    iam = boto3.client("iam")
 
     if choice == "local->aws":
         merged_doc = merge_policy_documents(local_doc, aws_doc)
-        iam = boto3.client("iam")
-        versions = iam.list_policy_versions(PolicyArn=policy_arn)['Versions']
-        if len(versions) >= 5:
-            oldest = sorted((v for v in versions if not v['IsDefaultVersion']),
-                            key=lambda v: v['CreateDate'])[0]
-            iam.delete_policy_version(PolicyArn=policy_arn, VersionId=oldest['VersionId'])
-        iam.create_policy_version(
-            PolicyArn=policy_arn,
-            PolicyDocument=json.dumps(merged_doc),
-            SetAsDefault=True
-        )
+        _update_aws_policy(iam, policy_arn, merged_doc)
         typer.echo(f"✅ AWS policy {policy_arn} updated with local changes (append-only).")
 
     elif choice == "aws->local":
-        new_content = json.dumps(aws_doc, indent=2)
-        with open(policy_file, "w") as f:
-            f.write(new_content)
-
-        branch = f"update-policy-{policy_name}"
-        pr_title = f"Update {policy_file} from AWS policy"
-        pr_body = "This PR updates the local policy file with the AWS default version."
+        _update_local_and_create_pr(aws_doc, policy_file, repo_full_name, policy_name, issue_num, description="from AWS policy")
 
-        push_branch(branch)
-        pr_num = create_github_pr(repo_full_name, branch, pr_title, pr_body)
-        typer.echo(f"✅ Created PR #{pr_num}: updated {policy_file} from AWS policy.")
+    elif choice == "aws<->local":
+        superset_doc = build_superset_policy(local_doc, aws_doc)
+        _update_aws_policy(iam, policy_arn, superset_doc)
+        typer.echo(f"✅ AWS policy {policy_arn} updated with superset of local + AWS.")
+        _update_local_and_create_pr(superset_doc, policy_file, repo_full_name, policy_name, issue_num, description="with superset of local + AWS")
 
     else:
         typer.echo("⏭ No synchronization performed (skip).")
+
+def _update_aws_policy(iam, policy_arn, policy_doc):
+    versions = iam.list_policy_versions(PolicyArn=policy_arn)['Versions']
+    if len(versions) >= 5:
+        oldest = sorted((v for v in versions if not v['IsDefaultVersion']), key=lambda v: v['CreateDate'])[0]
+        iam.delete_policy_version(PolicyArn=policy_arn, VersionId=oldest['VersionId'])
+    iam.create_policy_version(
+        PolicyArn=policy_arn,
+        PolicyDocument=json.dumps(policy_doc),
+        SetAsDefault=True
+    )
+
+def _update_local_and_create_pr(doc, policy_file, repo_full_name, policy_name, issue_num, description=""):
+    new_content = json.dumps(doc, indent=2)
+    with open(policy_file, "w") as f:
+        f.write(new_content)
+
+    branch = f"{description.replace(' ', '-')}-policy-{policy_name}".strip("-")
+    push_branch(branch)
+
+    pr_title = f"Update {policy_file} {description}".strip()
+    pr_body = f"This PR updates `{policy_file}` {description}.\n\nLinked to issue #{issue_num}.".strip()
+    pr_num, pr_url = create_github_pr(repo_full_name, branch, pr_title, pr_body, issue_num=issue_num)
+
+    typer.echo(f"✅ Created PR #{pr_num}: {pr_url}")

devolv/drift/github_approvals.py

@@ -2,6 +2,7 @@
 import subprocess
 from github import Github
 import typer
+
 def _get_github_token():
     token = os.getenv("GITHUB_TOKEN")
     if not token:
@@ -16,22 +17,23 @@ def _get_github_repo(repo_full_name: str):
     gh = Github(_get_github_token())
     return gh.get_repo(repo_full_name)
 
-def create_github_issue(repo: str, title: str, body: str, assignees: list) -> int:
+def create_github_issue(repo: str, title: str, body: str, assignees: list) -> tuple:
     """
-    Create a GitHub issue using the GitHub API.
+    Create a GitHub issue and return (number, url)
     """
     try:
         repo_obj = _get_github_repo(repo)
         issue = repo_obj.create_issue(title=title, body=body, assignees=assignees)
-        print(f"✅ Created issue #{issue.number} in {repo}")
-        return issue.number
+        print(f"✅ Created issue #{issue.number} in {repo}: {issue.html_url}")
+        return issue.number, issue.html_url
     except Exception as e:
         print(f"❌ Failed to create issue in {repo}: {e}")
         raise
 
-def create_github_pr(repo: str, head_branch: str, title: str, body: str, base: str = "main") -> int:
+def create_github_pr(repo: str, head_branch: str, title: str, body: str, base: str = "main", issue_num: int = None) -> tuple:
     """
-    Create a GitHub pull request using the GitHub API.
+    Create a GitHub PR. If issue_num is provided, comment on the issue and close it.
+    Return (PR number, PR URL).
     """
     try:
         repo_obj = _get_github_repo(repo)
@@ -41,23 +43,29 @@ def create_github_pr(repo: str, head_branch: str, title: str, body: str, base: s
             head=head_branch,
             base=base
         )
-        print(f"✅ Created PR #{pr.number} in {repo}")
-        return pr.number
+        print(f"✅ Created PR #{pr.number} in {repo}: {pr.html_url}")
+
+        if issue_num:
+            issue = repo_obj.get_issue(number=issue_num)
+            issue.create_comment(f"A PR has been created for this sync: {pr.html_url}")
+            issue.edit(state="closed")
+            print(f"💬 Commented on and closed issue #{issue_num}.")
+
+        return pr.number, pr.html_url
+
     except Exception as e:
         print(f"❌ Failed to create PR in {repo}: {e}")
         raise
 
+
 def push_branch(branch_name: str):
     """
     Create and push a branch with committed changes.
     """
     try:
         subprocess.run(["git", "checkout", "-b", branch_name], check=True)
-
-        # Configure git user identity locally
         subprocess.run(["git", "config", "user.email", "github-actions@users.noreply.github.com"], check=True)
         subprocess.run(["git", "config", "user.name", "github-actions"], check=True)
-
         subprocess.run(["git", "add", "."], check=True)
         subprocess.run(["git", "commit", "-m", f"Update policy from AWS: {branch_name}"], check=True)
         subprocess.run(["git", "push", "--set-upstream", "origin", branch_name], check=True)
@@ -66,4 +74,3 @@ def push_branch(branch_name: str):
     except subprocess.CalledProcessError as e:
         typer.echo(f"❌ Git command failed: {e}")
         raise typer.Exit(1)
-

devolv/drift/issues.py

@@ -9,6 +9,7 @@ def create_approval_issue(repo_full_name, token, policy_name):
         "Please comment:\n"
         "- `local->aws` to sync local changes to AWS\n"
         "- `aws->local` to sync AWS changes to local file\n"
+        "- `aws<->local` to sync both ways (first AWS -> local, then local -> AWS)\n"
         "- `skip` to do nothing"
     )
     issue = repo.create_issue(
@@ -26,7 +27,7 @@ def wait_for_sync_choice(repo_full_name, issue_number, token):
         comments = issue.get_comments()
         for comment in comments:
             content = comment.body.strip().lower()
-            if content in ["local->aws", "aws->local", "skip"]:
+            if content in ["local->aws", "aws->local", "aws<->local" "skip"]:
                 return content
         print("Waiting for approval comment...")
         time.sleep(30)  # Poll every 30 seconds