v0.2.13

[StranDutton]

Note

This branch will contain work done for multiple unrelated tickets. We're merging into this feature branch so we don't increment the OH version a bunch of times upon release.

1. BED-9063: Split BloodHound asset upload config between config.toml and secrets.toml

Context

BED-8838 moved the BHE URL out of secrets.toml into config.toml for the scheduler/collection destination (destination.bloodhoundenterprise), but missed the CLI Asset Upload destination (destination.bloodhound), which still required url as a secret.

Changes

• destinations/bloodhound/destination.py: url param on saved_searches and privilege_zones now resolves via dlt.config.value instead of dlt.secrets.value. token remains dlt.secrets.value.
• core/convert.py: Removed dead code left over from an abandoned first implementation — the Credentials dataclass, Converter._credentials property, and the unused self.client / self.upload_id attributes (and their now-unused BloodHound import). These referenced a client that was never actually instantiated; the real ingest path uses BloodHoundEnterprise via the @dlt.destination function pattern.

Important

Please open a related PR for an update to the offical BloodHound documentation!
UPDATE: here is the PR for the doc update

Testing

• Full pytest suite run
• Backwards-compatibility check: manually verified that dlt.config.value still resolves url if a user's secrets.toml still has it there.

---

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes

  • Improved BloodHound connection configuration by treating the service URL as standard configuration rather than a secret.
  • Simplified conversion/ingestion setup to remove internal credential plumbing while keeping the same outputs and upload behavior.

• Chores

  • Updated release automation: container builds/signing now use a workflow-call input based on the published release tag.
  • Removed automatic release tagging on merge and removed branch-name validation workflow.

[coderabbitai]

Walkthrough

The converter no longer manages BloodHound clients or credentials, and destination URLs now use DLT configuration. Release automation now builds from published releases and invokes a reusable container build workflow.

Changes

BloodHound configuration

Layer / File(s)	Summary
Remove converter client wiring src/openhound/core/convert.py	Removes BloodHound client imports, credentials, client state, upload state, and credential assembly from Converter.
Use DLT configuration for URLs src/openhound/destinations/bloodhound/destination.py	Updates saved_searches and privilege_zones URL defaults to dlt.config.value.

Release automation

Layer / File(s)	Summary
Build from published releases .github/workflows/build-and-publish.yml	Switches package publishing to published release events, uses the release tag for checkout and version checks, and starts container publishing after the package build.
Parameterize container publishing .github/workflows/build-and-sign-container.yml	Converts the container workflow to workflow_call, accepts tag and prerelease inputs, and uses them for checkout and image tagging.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubRelease
  participant BuildWorkflow
  participant ContainerWorkflow
  GitHubRelease->>BuildWorkflow: published release tag and prerelease state
  BuildWorkflow->>BuildWorkflow: checkout and verify package version
  BuildWorkflow->>ContainerWorkflow: reusable workflow call with tag and prerelease

Loading

Possibly related PRs

• SpecterOps/OpenHound#63: Both changes remove converter BloodHound credential/client wiring and update destination URL configuration.

Suggested reviewers: emmanuelrobles

Poem

A bunny hops through workflows bright,
Tags guide builds from day to night.
DLT keeps secrets in its place,
Containers follow release pace.
Carrots cheer the cleaner race!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is only a version number and does not describe the pull request’s changes.	Replace it with a concise summary of the main change, such as updating BloodHound asset upload configuration and removing unused conversion code.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v0.2.13

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-and-publish.yml:
- Line 41: Stop interpolating release-controlled values directly into shell
commands. In .github/workflows/build-and-publish.yml at lines 41-41 and 54-54,
expose github.event.release.tag_name through the step environment and read it
via a shell variable; apply the same env-based handling to inputs.tag in
.github/workflows/build-and-sign-container.yml at line 50.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5fbd5117-d680-4894-a6a6-77469e5a08d3

📥 Commits

Reviewing files that changed from the base of the PR and between 23da1fb and fefbee9.

📒 Files selected for processing (4)

• .github/workflows/build-and-publish.yml
• .github/workflows/build-and-sign-container.yml
• .github/workflows/release-on-merge.yml
• .github/workflows/validate-branch.yml

💤 Files with no reviewable changes (2)

• .github/workflows/validate-branch.yml
• .github/workflows/release-on-merge.yml

[coderabbitai]

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Avoid interpolating release-controlled values directly into shell.

• .github/workflows/build-and-publish.yml#L41-L41 and #L54-L54: pass github.event.release.tag_name through env, then read it from a shell variable.
• .github/workflows/build-and-sign-container.yml#L50-L50: do the same for inputs.tag.

📍 Affects 2 files

• .github/workflows/build-and-publish.yml#L41-L41 (this comment)
• .github/workflows/build-and-publish.yml#L54-L54
• .github/workflows/build-and-sign-container.yml#L50-L50

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-and-publish.yml at line 41, Stop interpolating
release-controlled values directly into shell commands. In
.github/workflows/build-and-publish.yml at lines 41-41 and 54-54, expose
github.event.release.tag_name through the step environment and read it via a
shell variable; apply the same env-based handling to inputs.tag in
.github/workflows/build-and-sign-container.yml at line 50.