Sigantry

Sigantry is an enterprise-grade governance, drift detection, and rollback engine for Microsoft Fabric CI/CD pipelines.

Built by JToye Digital, Sigantry wraps Microsoft's official deployment tooling (fabric-cicd, fab CLI, and Fabric REST APIs) rather than replacing them. While Microsoft owns the automation lane, Sigantry provides the mission-critical governance layer enterprise platform teams require: integrity-checked deploy ledgers, release rollback, scheduled drift detection, destructive-operation gating, and headless PR-review bots.

Key Capabilities

• 🚀 Pre-Deployment Safety Probes: sigantry preflight runs three non-destructive probes before deploying: the manifest, its item tree and parameters.yml parse; a Fabric token is acquired through the credential chain (and checked against --tenant-id, or core.tenant_id in the settings); the target workspace's capacity is Active (--workspace-id). A probe that could not check says so, and fails the run under --strict.
• 🔄 Brownfield Adoption: sigantry sync pull introspects a hand-built Fabric workspace and generates a sync.yml manifest and code tree from it.
• 🏗️ Declarative Greenfield Scaffolding: sigantry workspace bootstrap provisions brand-new workspaces, capacity bindings, and medallion folder blueprints from a single workspace.yml manifest with idempotent probe-before-act convergence.
• ⚡ Concurrent Bulk Publishing: --bulk publishes items through a parallel worker pool instead of one at a time, cutting wall-clock deploy time on multi-item repositories.
• 🛡️ Release Rollback: sigantry deploy run --rollback --to-release <id> --rollback-force publishes again the items a recorded release names whose type is in --item-types (by default Lakehouse, Environment, Notebook and DataPipeline), taking their content from the --source checkout you pass. The ledger records item names, not item content or a commit, so check out the source you want to restore before you run it.
• 🔍 Interactive Drift Detection: sigantry diff compares a live Fabric workspace with a Git manifest at the moment it runs, by item name, type and folder (not item content), and outputs rich CLI tables, SemVer JSON, or standalone interactive HTML reports (--output html). To check on a schedule, call the reusable drift workflow from a scheduled workflow of your own.
• 🛑 TMDL Breaking Change Impact Guard: sigantry pr-bot run --fail-on-breaking intercepts Power BI semantic model edits in CI/CD, highlighting dropped measures, columns, and tables before downstream reports break.
• 📜 Integrity-Checked Audit Ledger: SHA-256 hash-chained JSONL records (DeployRecord, BootstrapRecord). sigantry release verify checks the deploy ledger's chain; no sigantry command checks the bootstrap ledger's chain. The chain is unkeyed and unanchored: it detects accidental corruption, unsealed edits and middle-record deletion, but anyone who can write the ledger file can re-seal it, and tail truncation is undetectable without an external anchor. Read the audit ledger threat model before treating the ledger as evidence against an insider.
• 🔌 11 Protocol Seams: Pluggable architecture supporting custom notification sinks (Teams, Slack, Email), secret stores (Key Vault, GitHub, ADO), approval gates (OPA, ADO, GHA), and data quality gates.

60-Second Quickstart

1. Installation

pip install sigantry

Verify the installation:

sigantry --help
sigantry doctor

2. Adopt an Existing Workspace (Brownfield)

Bring an existing, hand-built Fabric workspace under version-controlled manifest management:

sigantry sync pull --workspace-id "<YOUR-WORKSPACE-GUID>" --into ./adopted

Inspect what was generated:

head -25 ./adopted/sync.yml

Check that re-applying the pulled manifest changes nothing (the dry run should report 0 folders created and 0 items moved):

sigantry sync apply --manifest ./adopted/sync.yml --workspace-id "<YOUR-WORKSPACE-GUID>" --dry-run

3. Detect Drift

Check if anyone has modified, added, or deleted items out-of-band in the Fabric portal:

sigantry diff --manifest ./adopted/sync.yml --workspace-id "<YOUR-WORKSPACE-GUID>" --fail-on-drift

4. Bootstrap a Fresh Workspace (Greenfield)

Author a workspace.yml blueprint:

schema_version: "1.0"
workspace:
  name: "analytics-prod"
  description: "Production Fabric Workspace"
  capacity_id: "<YOUR-CAPACITY-GUID>"
folders:
  blueprint: medallion
git:
  enabled: false

Bootstrap with probe-before-act convergence:

sigantry workspace bootstrap workspace.yml --dry-run
sigantry workspace bootstrap workspace.yml

Documentation

Full documentation, architecture guides, and step-by-step tutorials are available at: 👉 https://github.com/Bralabee/sigantry/tree/main/docs

License

Sigantry is licensed under the Apache License, Version 2.0.