Define boundaries between Python modules

[agateau-gg]

Goal

To help keeping the code-base manageable, we need clearer boundaries between the various Python modules inside GGShield.

The proposed architecture is the following:

 Command layer   | cmd.iac | cmd.secret | cmd.auth | cmd.config
---------------- | ---↓----|------↓-----|----↓-----|
 Vertical layer  |   iac   |   secret   |  auth    |
---------------- | ============================================
 Support layers  |                 scan | config
                 | -----------------↓-------↓------------------
                 |                    core

A module from the command layer can only import code from its matching vertical layer (cmd.iac can import from iac but not from secret or auth). Modules from the command and vertical layers can import from any support layer modules.

Current problems and steps to fix them

• core.config.user_config imports iac to verify IaC policy syntax
  • Move IaC policy syntax code to core.config.user_config
• core.oauth imports config
  • Move core.oauth to auth (new module)
• core.check_updates imports config.utils
  • Move core.config.utils.*_yaml_dict() functions from core.config.utils to a new core.yaml_utils module
• core.client imports config
  • Move core.client to core.config

Next steps

• Move core.config to config
• Document the final architecture in doc/dev/architecture.md
• Setup import-linter to enforce boundaries