v0.2.13

[StranDutton]

Note

This branch will contain work done for multiple unrelated tickets. We're merging into this feature branch so we don't increment the OH version a bunch of times upon release.

1. BED-9063: Split BloodHound asset upload config between config.toml and secrets.toml

Context

BED-8838 moved the BHE URL out of secrets.toml into config.toml for the scheduler/collection destination (destination.bloodhoundenterprise), but missed the CLI Asset Upload destination (destination.bloodhound), which still required url as a secret.

Changes

• destinations/bloodhound/destination.py: url param on saved_searches and privilege_zones now resolves via dlt.config.value instead of dlt.secrets.value. token remains dlt.secrets.value. (backwards-compatible change - leaving the config as it was will not break the collector, but existing users should be encouraged to update their config).
• core/convert.py: cleanup, removed dead code

Important

Please open a related PR for an update to the offical BloodHound documentation!
UPDATE: here is the PR for the doc update

Testing

• Full pytest suite run
• Backwards-compatibility check: manually verified that dlt.config.value still resolves url if a user's secrets.toml still has it there.

2. BED-8672: Drive releases from a single published-release event

Context

Release automation was split across separate triggers: build-and-publish.yml ran on tag pushes while build-and-sign-container.yml ran independently on release: [published], with no ordering guarantee between the PyPI package and the container image. This makes a published GitHub (pre-)release the single source of truth: build + publish to PyPI, then build + sign the container image.

Changes

• build-and-publish.yml: now triggers on release: [published], sources the version from github.event.release.tag_name, and adds a containers job (needs: build) that calls the container workflow with secrets: inherit — so the image is only built after the PyPI publish succeeds.
• build-and-sign-container.yml: converted to a reusable workflow_call with tag and prerelease inputs. Skips the latest / latest-enterprise tags when prerelease == true; removed the unused pypi environment.
• Hardening: pass the tag via a RELEASE_TAG env var instead of interpolating ${{ ... }} into shell scripts.
• Removed obsolete release-on-merge.yml and validate-branch.yml.

Testing

• Verified containers runs only after build succeeds.
• Confirmed pre-releases publish to PyPI and build an image but do not promote latest / latest-enterprise; normal releases do.

3. Update openhound-github version to 0.4.0 and openhound-okta version to 0.2.1

---

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes

  • Improved BloodHound destination configuration by treating the service URL as standard configuration rather than a secret for saved searches and privilege zone outputs.

• Chores

  • Updated release publishing and container image build workflows to use published release tags.
  • Removed automatic release tagging and branch-name validation workflows.
  • Updated GitHub and Okta integration support.

[coderabbitai]

Walkthrough

The converter no longer manages BloodHound clients or credentials. BloodHound destination URLs now use DLT configuration. Release automation builds from published releases and invokes a reusable container workflow. Optional GitHub and Okta dependency versions are updated.

Changes

BloodHound configuration

Layer / File(s)	Summary
Remove converter client wiring src/openhound/core/convert.py	Removes BloodHound client imports, credentials, client state, upload state, and credential assembly from Converter.
Use DLT configuration for URLs src/openhound/destinations/bloodhound/destination.py	Updates saved_searches and privilege_zones URL defaults to dlt.config.value.

Release automation

Layer / File(s)	Summary
Build from published releases .github/workflows/build-and-publish.yml, .github/workflows/release-on-merge.yml, .github/workflows/validate-branch.yml	Builds from published release tags, verifies release versions, invokes container publishing, and removes the merge-release and branch-validation workflows.
Parameterize container publishing .github/workflows/build-and-sign-container.yml	Converts the container workflow to workflow_call, accepts tag and prerelease inputs, and uses them for checkout and image tagging.

Optional dependencies

Layer / File(s)	Summary
Update optional dependency versions pyproject.toml	Updates the optional GitHub dependency to 0.4.0 and the optional Okta dependency to 0.2.1.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubRelease
  participant BuildWorkflow
  participant ContainerWorkflow
  GitHubRelease->>BuildWorkflow: published release tag and prerelease state
  BuildWorkflow->>BuildWorkflow: checkout and verify package version
  BuildWorkflow->>ContainerWorkflow: reusable workflow call with tag and prerelease

Loading

Possibly related PRs

• SpecterOps/OpenHound#63: Both changes remove converter BloodHound credential and client wiring and update destination URL configuration.

Suggested reviewers: d3vzer0

Poem

A rabbit checks the release tag,
Then sends containers in a bag.
DLT holds configuration tight,
While cleaner workflows build right.
New dependencies join the flight.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title identifies a release version but does not describe the main changes to BloodHound configuration, conversion code, dependencies, and workflows.	Use a concise descriptive title, such as "Update BloodHound upload configuration and release workflows".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v0.2.13

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-and-publish.yml:
- Line 41: Stop interpolating release-controlled values directly into shell
commands. In .github/workflows/build-and-publish.yml at lines 41-41 and 54-54,
expose github.event.release.tag_name through the step environment and read it
via a shell variable; apply the same env-based handling to inputs.tag in
.github/workflows/build-and-sign-container.yml at line 50.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5fbd5117-d680-4894-a6a6-77469e5a08d3

📥 Commits

Reviewing files that changed from the base of the PR and between 23da1fb and fefbee9.

📒 Files selected for processing (4)

• .github/workflows/build-and-publish.yml
• .github/workflows/build-and-sign-container.yml
• .github/workflows/release-on-merge.yml
• .github/workflows/validate-branch.yml

💤 Files with no reviewable changes (2)

• .github/workflows/validate-branch.yml
• .github/workflows/release-on-merge.yml

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Avoid interpolating release-controlled values directly into shell.

• .github/workflows/build-and-publish.yml#L41-L41 and #L54-L54: pass github.event.release.tag_name through env, then read it from a shell variable.
• .github/workflows/build-and-sign-container.yml#L50-L50: do the same for inputs.tag.

📍 Affects 2 files

• .github/workflows/build-and-publish.yml#L41-L41 (this comment)
• .github/workflows/build-and-publish.yml#L54-L54
• .github/workflows/build-and-sign-container.yml#L50-L50

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-and-publish.yml at line 41, Stop interpolating
release-controlled values directly into shell commands. In
.github/workflows/build-and-publish.yml at lines 41-41 and 54-54, expose
github.event.release.tag_name through the step environment and read it via a
shell variable; apply the same env-based handling to inputs.tag in
.github/workflows/build-and-sign-container.yml at line 50.