Hackage :: [Package]

settei-preflight: Run application configuration checks on proposed deployment inputs

[ bsd3, configuration, library, program ] [ Propose Tags ] [ Report a vulnerability ]

Materialize explicitly proposed environment and file inputs, run the application's own check command, redact known secrets, and report honest deployment coverage.

[Skip to Readme]

Downloads

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Candidates

  • No Candidates
Versions [RSS] 0.3.0.0
Change log CHANGELOG.md
Dependencies aeson (>=2.2.4.1 && <2.4), base (>=4.21 && <5), bytestring (>=0.12 && <0.13), containers (>=0.6.8 && <0.8), directory (>=1.3.8 && <1.4), filepath (>=1.5.4 && <1.6), generic-lens (>=2.2 && <2.4), optparse-applicative (>=0.19 && <0.20), process (>=1.6.19 && <1.7), settei (==0.3.0.0), settei-env (==0.3.0.0), settei-preflight (==0.3.0.0), temporary (>=1.3 && <1.4), text (>=2.1 && <2.2) [details]
Tested with ghc ==9.12.4
License BSD-3-Clause
Author shinzui
Maintainer shinzui
Uploaded by shinzui at 2026-10-21T20:53:54Z
Category Configuration
Home page https://github.com/shinzui/settei
Bug tracker https://github.com/shinzui/settei/issues
Source repo head: git clone https://github.com/shinzui/settei.git
Distributions
Executables settei-preflight
Downloads 3 total (3 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs uploaded by user
Build status unknown [no reports yet]

Readme for settei-preflight-0.3.0.0

[back to package description]

settei-preflight

New in the shared 0.3.0.0 family release; this package was not part of 0.2.0.0.

Run an application's own configuration check against explicitly proposed inputs. Settei.Preflight isolates the environment, materializes files in a private directory, redacts exact known secrets, and reports pass, inconclusive, or fail. Only pass passes a gate; partial coverage is never deployment validation. Reports have private constructors; use preflightVerdict, preflightOutcome, preflightCoverage, preflightExecution, and the summary accessors to inspect them without a lens dependency. Supported execution platforms: Linux and macOS. The harness is not a sandbox.

Settei.Preflight.Request parses strict settei.preflight-request version 1 JSON. Unknown fields and conflicting forms fail. Each environment/file entry has a name and exactly one of value (public), secretFromEnvironment, secretFromFile, synthetic with reason and optional sensitivity, unresolved, or unavailableSecret. Secret files are read as strict UTF-8 without trimming. Request references are resolved from the harness process; they never mean inheritance into the checked process.

Run settei-preflight --request request.json [--json]. Exit codes: 0 pass, 1 inconclusive, 2 CLI usage, 3 harness failure, 4 application rejection. The child receives only proposed present inputs plus the explicit inherited allowlist (default PATH, LANG, LC_ALL, LC_CTYPE; inherit: [] disables it). The timeout covers child completion and both output streams. SIGTERM-resistant children and descendants are not force-killed. Temporary input directories use mode 0700; failed cleanup blocks the gate. Output is captured in memory, so use a trusted, bounded-output configuration check.

See the deployment preflight guide in the repository for the request schema, reference extraction workflow, and limitations.