Red-Govern

Local-first governance and operational intelligence for Amazon Redshift.

Project status: Alpha (0.1.0a1). Red-Govern is under active development. Commands, configuration fields, and report formats may change before the first stable release.

Overview

Red-Govern is a Python command-line toolkit for examining Amazon Redshift environments and producing local governance, inventory, quota, classification, privacy, workload, and operational-intelligence outputs.

The current alpha focuses on:

• discovering available Redshift system capabilities;
• collecting and normalising database-object inventory;
• analysing object usage against configured quotas;
• classifying Redshift objects;
• auditing effective privacy and safety settings;
• inspecting query workloads;
• creating local inventory snapshots;
• comparing recent snapshots;
• generating local governance reports;
• validating configuration without displaying credential values.

Red-Govern is designed for engineers, analytics teams, platform owners, and governance practitioners who need a structured view of Redshift estates without building a governance utility from scratch.

Key principles

Local-first operation

Configuration, snapshots, and generated reports are handled locally unless the user deliberately moves or shares them.

Credential-aware output

Commands that display effective configuration are intended to avoid exposing credential values. Credentials should never be committed to the repository, included in screenshots, or attached to public issues.

Explicit validation

The CLI includes configuration validation, environment diagnostics, dependency checks, typed source code, linting, automated tests, package validation, and continuous integration.

Incremental governance

Red-Govern separates inventory collection, classification, quota analysis, snapshotting, change comparison, reporting, and workload inspection so teams can adopt governance workflows progressively.

Installation

Install from source

Use the Python version declared in .python-version.

git clone https://github.com/InnoSN-Soft-Tech/red-govern.git
cd red-govern

python -m venv .venv
source .venv/bin/activate

python -m pip install --upgrade pip
python -m pip install --editable ".[dev]"

Confirm the installation:

red-govern version
red-govern --help

Install from PyPI

After the first public release is published:

python -m pip install red-govern

Quick start

Create a safe default configuration:

red-govern init

Validate it:

red-govern config-validate

Display the effective configuration without credential values:

red-govern config-show

Check local setup and optionally test Redshift connectivity:

red-govern doctor

Review the options available for an operational command before running it:

red-govern inventory --help

Command reference

Use command-specific help for current arguments and options:

red-govern <command> --help

Suggested workflow

A typical assessment can follow this sequence:

red-govern config-validate
red-govern privacy-audit
red-govern doctor
red-govern capabilities
red-govern inventory
red-govern quota
red-govern classify
red-govern queries
red-govern snapshot
red-govern changes
red-govern report

The precise commands and options depend on the Redshift environment, permissions, and analysis objective. Review command help before operating against a production cluster.

Redshift permissions

Red-Govern requires access to the system views and metadata needed by the selected command. Availability can differ by Redshift deployment type, configuration, software behaviour, and the permissions granted to the connecting principal.

Start with:

red-govern capabilities
red-govern doctor

Use a dedicated identity with only the permissions needed for metadata and workload inspection. Avoid using administrator credentials merely for convenience.

Configuration and sensitive data

Follow these rules when configuring Red-Govern:

• do not commit passwords, tokens, connection strings, or private endpoints;
• do not place credentials in examples or issue descriptions;
• use environment variables or another approved secret-management mechanism;
• review generated reports and snapshots before sharing them;
• redact account identifiers, usernames, query text, schema names, and business data when they are sensitive;
• run red-govern config-show to inspect effective non-secret configuration;
• run red-govern privacy-audit before sharing diagnostic information.

Generated operational outputs should be treated according to the data-handling requirements of the organisation that owns the Redshift environment.

Development

Install the project with development dependencies:

python -m pip install --editable ".[dev]"

Run the local quality gates:

python -m compileall -q src/red_govern
python -m ruff check src tests
python -m mypy src
python -m pytest -q

Build and validate the package:

rm -rf build dist
python -m build
python -m twine check --strict dist/*

See CONTRIBUTING.md for the contribution workflow.

Continuous integration

Pull requests and pushes to main run two sequential CI jobs:

1. Quality gates

   • dependency verification;
   • Python compilation;
   • Ruff;
   • MyPy;
   • automated tests.

2. Package validation

   • wheel and source-distribution build;
   • strict Twine metadata validation;
   • isolated wheel installation;
   • package import and CLI verification.

Release process

The release workflow supports two modes:

Manual execution

A manually dispatched workflow builds and validates the wheel and source distribution and uploads them as a GitHub Actions artifact. It does not publish to PyPI.

Published GitHub release

Publishing a GitHub release:

1. validates that the release tag matches the package version;
2. builds the wheel and source distribution;
3. validates package metadata;
4. uploads the validated distributions;
5. publishes to PyPI through OIDC Trusted Publishing.

No permanent PyPI password or API token is stored in the repository.

Project documentation

• Changelog
• Contributing guide
• Code of Conduct
• Security policy
• Support guide
• License
• Commercial licensing
• Notice

Maintainer

Red-Govern is maintained under InnoSN Soft Tech.

License

Red-Govern is source-available under the PolyForm Perimeter License 1.0.1.

The community licence permits use, modification, and distribution for purposes that do not involve providing a product that competes with Red-Govern. A separate written commercial licence is required for a competing hosted service, SaaS platform, library, plug-in, integration, interface, or other competing product.

See COMMERCIAL_LICENSE.md for commercial licensing guidance and NOTICE for required notices.

Commercial enquiries: info@snsoft.tech