Sigantry

Sigantry is an enterprise-grade governance, drift detection, and rollback engine for Microsoft Fabric CI/CD pipelines.

Built by JToye Digital, Sigantry wraps Microsoft's official deployment tooling (fabric-cicd, fab CLI, and Fabric REST APIs) rather than replacing them. While Microsoft owns the automation lane, Sigantry provides the mission-critical governance layer enterprise platform teams require: tamper-evident deploy ledgers, automated rollback, scheduled drift detection, destructive-operation gating, and headless PR-review bots.

Key Capabilities

• 🚀 Pre-Deployment Safety Probes: sigantry preflight runs four-phase non-destructive simulations (Schema Syntax, Dependency DAG, Entra ID Scope, Capacity State) before deploying.
• 🔄 Lossless Brownfield Adoption: sigantry sync pull introspects any hand-built Fabric workspace and generates an exact, round-trip lossless sync.yml manifest and code tree.
• 🏗️ Declarative Greenfield Scaffolding: sigantry workspace bootstrap provisions brand-new workspaces, capacity bindings, and medallion folder blueprints from a single workspace.yml manifest with idempotent probe-before-act convergence.
• ⚡ Concurrent Bulk Publishing: --bulk option accelerates workspace deployments via parallel item publishing pools, reducing deploy times by up to 3.8x on multi-item repositories.
• 🛡️ Automated Release Rollback: sigantry deploy run --rollback --to-release <id> re-publishes the exact historical version of items from immutable ledger snapshots.
• 🔍 Interactive Drift Detection: sigantry diff continuously compares live Fabric workspaces against Git manifests, outputting rich CLI tables, SemVer JSON, or standalone interactive HTML reports (--output html).
• 🛑 TMDL Breaking Change Impact Guard: sigantry pr-bot run --fail-on-breaking intercepts Power BI semantic model edits in CI/CD, highlighting dropped measures, columns, and tables before downstream reports break.
• 📜 Tamper-Evident Audit Ledger: Cryptographic SHA-256 hash-chained JSONL records (DeployRecord, BootstrapRecord) independently verifiable via sigantry release verify.
• 🔌 11 Protocol Seams: Pluggable architecture supporting custom notification sinks (Teams, Slack, Email), secret stores (Key Vault, GitHub, ADO), approval gates (OPA, ADO, GHA), and data quality gates.

60-Second Quickstart

1. Installation

pip install sigantry

Verify the installation:

sigantry --help
sigantry doctor

2. Adopt an Existing Workspace (Brownfield)

Bring an existing, hand-built Fabric workspace under version-controlled manifest management:

sigantry sync pull --workspace-id "<YOUR-WORKSPACE-GUID>" --into ./adopted

Inspect what was generated:

head -25 ./adopted/sync.yml

Prove the round-trip is lossless (should report 0 folders created and 0 items moved):

sigantry sync apply --manifest ./adopted/sync.yml --workspace-id "<YOUR-WORKSPACE-GUID>" --dry-run

3. Detect Drift

Check if anyone has modified, added, or deleted items out-of-band in the Fabric portal:

sigantry diff --manifest ./adopted/sync.yml --workspace-id "<YOUR-WORKSPACE-GUID>" --fail-on-drift

4. Bootstrap a Fresh Workspace (Greenfield)

Author a workspace.yml blueprint:

schema_version: "1.0"
workspace:
  name: "analytics-prod"
  description: "Production Fabric Workspace"
  capacity_id: "<YOUR-CAPACITY-GUID>"
folders:
  blueprint: medallion
git:
  enabled: false

Bootstrap with probe-before-act convergence:

sigantry workspace bootstrap workspace.yml --dry-run
sigantry workspace bootstrap workspace.yml

Documentation

Full documentation, architecture guides, and step-by-step tutorials are available at: 👉 https://bralabee.github.io/sigantry

License

Sigantry is licensed under the Apache License, Version 2.0.