v0.2.13

.github/workflows/build-and-publish.yml

@@ -1,16 +1,8 @@
 name: Build and Publish
 
 on:
-  push:
-    tags:
-      - "v*"
-  workflow_call:
-    inputs:
-      tag:
-        description: "Tag to build and publish"
-        required: true
-        type: string
-
+  release:
+    types: [published]
 
 permissions:
   contents: read
@@ -25,7 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }} # using input tags or github ref if tags are manually pushed
+          ref: refs/tags/${{ github.event.release.tag_name }} # build from the tag created when the (pre-)release was published
           fetch-depth: 0
 
       - name: Set up Python
@@ -43,8 +35,12 @@ jobs:
         run: uv build
 
       - name: Verify built version matches tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          REF="${{ inputs.tag || github.ref_name }}"
+          # RC tags are written without a dash (e.g. v0.2.13rc1) so the stripped
+          # tag is already the PEP 440 / PyPI version hatch-vcs produces.
+          REF="$RELEASE_TAG"
           TAG_VERSION="${REF#v}"
           echo "Tag version: ${TAG_VERSION}"
           ls dist/
@@ -56,8 +52,10 @@ jobs:
           fi
 
       - name: Verify version not already on PyPI
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          REF="${{ inputs.tag || github.ref_name }}"
+          REF="$RELEASE_TAG"
           TAG_VERSION="${REF#v}"
           STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/openhound/${TAG_VERSION}/json")
           if [ "${STATUS}" = "200" ]; then
@@ -67,3 +65,11 @@ jobs:
 
       - name: Publish package
         run: uv publish --check-url https://pypi.org/simple/
+
+  containers:
+    needs: build
+    uses: ./.github/workflows/build-and-sign-container.yml
+    with:
+      tag: ${{ github.event.release.tag_name }}
+      prerelease: ${{ github.event.release.prerelease }}
+    secrets: inherit

.github/workflows/build-and-sign-container.yml

@@ -1,8 +1,17 @@
 name: Build, Sign, and Publish Container Image
 
 on:
-  release:
-    types: [ published ]
+  workflow_call:
+    inputs:
+      tag:
+        description: "Release tag to build and sign the container image for"
+        required: true
+        type: string
+      prerelease:
+        description: "Whether this release is a pre-release (skips the 'latest' tag)"
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -12,7 +21,6 @@ jobs:
   push-to-docker-registry:
     name: Push Image to Docker Registry (${{ matrix.target }})
     runs-on: ubuntu-latest
-    environment: pypi
     strategy:
       fail-fast: false
       matrix:
@@ -33,13 +41,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          ref: refs/tags/${{ github.event.release.tag_name }}
+          ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Set image reference
         id: image-ref
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
         run: |
-          CLEAN_VERSION="${{ github.event.release.tag_name }}"
+          CLEAN_VERSION="$RELEASE_TAG"
 
           if [ -z "$CLEAN_VERSION" ]; then
             echo "Error: version is empty"
@@ -57,7 +67,7 @@ jobs:
         run: |
           TAGS="${{ steps.image-ref.outputs.version_tag }}"
 
-          if [ "${{ github.event.release.prerelease }}" != "true" ] && [ -n "${{ matrix.latest_tag }}" ]; then
+          if [ "${{ inputs.prerelease }}" != "true" ] && [ -n "${{ matrix.latest_tag }}" ]; then
             TAGS="${TAGS}"$'\n'"${DOCKER_REGISTRY}/${DOCKER_REPOSITORY}:${{ matrix.latest_tag }}"
           fi
 

pyproject.toml

@@ -24,18 +24,18 @@ dependencies = [
 [project.optional-dependencies]
 all = [
     "openhound-jamf==0.2.3",
-    "openhound-github==0.3.7",
-    "openhound-okta==0.1.6",
+    "openhound-github==0.4.0",
+    "openhound-okta==0.2.1",
 ]
 jamf = [
     "openhound-jamf==0.2.3",
 ]
 github = [
-    "openhound-github==0.3.7"
+    "openhound-github==0.4.0"
 ]
 
 okta = [
-    "openhound-okta==0.1.6",
+    "openhound-okta==0.2.1",
 ]
 
 [project.scripts]

src/openhound/core/convert.py

@@ -10,7 +10,6 @@
 from dlt.pipeline.pipeline import Pipeline
 
 from openhound.core.asset import BaseAsset
-from openhound.core.clients.bloodhound import BloodHound
 from openhound.core.logging import logger_override
 from openhound.core.lookup import LookupManager
 from openhound.core.pipeline import BasePipeline
@@ -22,13 +21,6 @@
 logger = logging.getLogger(__name__)
 
 
-@dataclass
-class Credentials:
-    url: str
-    token_key: str
-    token_id: str
-
-
 class Method(str, Enum):
     write = "write"
     ingest = "ingest"
@@ -52,16 +44,6 @@ def __init__(
         self.lookup = lookup
         self.progress = progress
         self.method = method
-        self.client: BloodHound | None = None
-        self.upload_id: int | None = None
-
-    @property
-    def _credentials(self) -> Credentials:
-        return Credentials(
-            url=dlt.secrets["destination.bloodhound.url"],
-            token_id=dlt.secrets["destination.bloodhound.token_id"],
-            token_key=dlt.secrets["destination.bloodhound.token_key"],
-        )
 
     @property
     def pipeline(self) -> Pipeline:

src/openhound/destinations/bloodhound/destination.py

@@ -29,7 +29,7 @@ class Permissions(str, Enum):
 def saved_searches(
     items: TDataItems,
     table: TTableSchema,
-    url: str = dlt.secrets.value,
+    url: str = dlt.config.value,
     token: str = dlt.secrets.value,
     strategy: Strategy = Strategy.skip,
     permissions: Permissions = Permissions.public,
@@ -68,7 +68,7 @@ def saved_searches(
 def privilege_zones(
     items: TDataItems,
     table: TTableSchema,
-    url: str = dlt.secrets.value,
+    url: str = dlt.config.value,
     token: str = dlt.secrets.value,
     strategy: Strategy = Strategy.skip,
 ):