Metadata-Version: 2.4
Name: foretop-ebb
Version: 0.1.1
Summary: Tells an engineering team which repos, jobs, prompts and owners break when an AI provider retires a model — before the deadline becomes an outage.
License-Expression: Apache-2.0
License-File: LICENSE
Requires-Dist: typer>=0.15
Requires-Dist: rich>=13.9
Requires-Dist: pathspec>=0.12
Requires-Dist: pydantic>=2.9
Requires-Dist: pyyaml>=6.0
Requires-Dist: httpx>=0.28
Requires-Python: >=3.12
Description-Content-Type: text/markdown

# ebb

> Find AI model references before their provider retirement dates become outages.

`ebb` scans a repository for model identifiers, resolves them against a reviewed retirement
registry, and reports the file, deadline, replacement, severity, and owner for every match.

## Install and run

```console
uvx foretop-ebb scan .
```

The default command prints a terminal report and exits successfully. Add a gate only when you
want findings to affect CI:

```console
uvx foretop-ebb scan . --fail-on high
```

Run `uvx foretop-ebb scan --help` for every option.

## What it checks

- Model identifiers in Python, TypeScript, YAML, TOML, JSON, Terraform, Dockerfiles, and
  Jupyter notebooks.
- Canonical model aliases and dated snapshots against the registry bundled with the package.
- Repository ownership through CODEOWNERS, with git attribution as a fallback.
- Published retirement dates, suggested replacements, and evidence for each result.

Unverified identifiers are reported as `unknown`; they are never treated as clear.

## Output and CI gating

`--format` supports `table`, `markdown`, `json`, `sarif`, `annotations`, and `triage-json`.
Without `--fail-on`, the scan is report-only. With a severity threshold, exit code `1` means a
finding met the threshold and `2` means the scan itself failed.

## GitHub Action

```yaml
- uses: foretop-dev/ebb@v0.1.1
  with:
    fail-on: critical
```

The Action emits inline annotations and can maintain one summary comment on pull requests.
Grant `pull-requests: write` to the job when comments are enabled. Set `comment-on-pr: false`
to disable them, or set `fail-on` to an empty string for report-only operation.

## Privacy

Detection is local and deterministic. The registry ships inside the package, so a normal scan
does not upload source or require an account. `--report` and `--gate` are explicit hosted-mode
options that require `FORETOP_TOKEN`; the CLI prints the metadata payload before reporting it.
Source contents are never part of that payload.

## Current limitations

- Detection is static: dynamically constructed identifiers may not be visible.
- Retirement coverage is limited to entries with reviewed provider evidence.
- A missing registry entry produces `unknown`, not a claim that the model is supported.

## License

Apache-2.0. See [LICENSE](LICENSE).

Questions and bug reports are welcome in [GitHub Issues](https://github.com/foretop-dev/ebb/issues).
