docling-pipelines 1.0.0.dev1__tar.gz

docling_pipelines-1.0.0.dev1/.coveragerc

@@ -0,0 +1,32 @@
+[run]
+branch = True
+source = src/docpipe_app
+omit =
+    */tests/*
+    */test_*.py
+    */*_test.py
+    */venv/*
+    */virtualenv/*
+    */.venv/*
+    */site-packages/*
+    */ui/*
+    */examples/*
+    */__init__.py
+    /data/*
+    /sonar/*
+    /docs/*
+    /dist/*
+    /build/*
+    /ui/*
+
+
+[report]
+exclude_lines =
+    pragma: no cover
+    if __name__ == "__main__":
+    def __repr__
+    raise AssertionError
+    raise NotImplementedError
+    if TYPE_CHECKING:
+    @abstractmethod
+    @abc.abstractmethod

docling_pipelines-1.0.0.dev1/.dockerignore

@@ -0,0 +1,77 @@
+# Git
+.git/
+.gitignore
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.pyc
+*.pyo
+*.pyd
+*.so
+.Python
+
+# Virtual environments
+venv/
+.venv/
+env/
+ENV/
+env.bak/
+venv.bak/
+
+# uv
+.uv/
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+*.cover
+.mypy_cache
+.ruff_cache
+pytest.ini
+
+# Documentation
+*.md
+docs/
+
+# Examples and scripts
+examples/
+scripts/
+scratch/
+
+# Data and artifacts
+data/
+artifacts/
+
+# Build artifacts
+dist/
+build/
+*.egg-info/
+
+# CI/CD
+.github/
+Jenkinsfile
+sonar/
+
+# Deployment examples
+k8s-deployment-examples/
+
+# Environment
+.env
+.env.local
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Test directory
+tests/

docling_pipelines-1.0.0.dev1/.env.example

@@ -0,0 +1,122 @@
+# OpenSearch Connection Configuration
+# Copy this file to .env and update with your actual values
+# ============================================================================
+# PYTHON PATH CONFIGURATION
+# ============================================================================
+# Required for imports to work correctly
+# This should be set relative to the project root
+PYTHONPATH=./src
+
+
+# ============================================================================
+# LOCAL DOCKER SETUP (using docker-compose.opensearch.yml)
+# ============================================================================
+# To run OpenSearch locally with Docker:
+#   docker-compose -f docker-compose.opensearch.yml up -d
+#
+# Use these settings for local Docker instance:
+# OPENSEARCH_HOST=localhost
+# OPENSEARCH_PORT=9200
+# OPENSEARCH_USE_SSL=false
+# OPENSEARCH_VERIFY_CERTS=false
+# OPENSEARCH_USERNAME=admin
+# OPENSEARCH_PASSWORD=<your-opensearch-password>
+#
+# OpenSearch Dashboards will be available at: http://localhost:5601
+# ============================================================================
+
+# OpenSearch Server
+OPENSEARCH_HOST=localhost
+OPENSEARCH_PORT=9200
+OPENSEARCH_USE_SSL=false
+OPENSEARCH_VERIFY_CERTS=false
+
+# Authentication
+OPENSEARCH_USERNAME=admin
+# OPENSEARCH_PASSWORD=<set-your-password>
+
+# AWS Authentication (optional, set to true if using AWS OpenSearch)
+OPENSEARCH_AWS_AUTH=false
+# JWT Authentication (optional, for AWS OpenSearch with JWT tokens)
+# OPENSEARCH_JWT_TOKEN=your-jwt-token-here
+OPENSEARCH_AWS_REGION=us-east-1
+
+# Engine Configuration
+OPENSEARCH_ENGINE=faiss
+OPENSEARCH_ALGORITHM=hnsw
+OPENSEARCH_SPACE_TYPE=l2
+OPENSEARCH_VECTOR_DIMENSION=384
+
+# Performance Settings
+OPENSEARCH_BATCH_SIZE=100
+OPENSEARCH_CREATE_INDEX=true
+
+# Index Configuration
+OPENSEARCH_INDEX_NAME=docpipe_test
+OPENSEARCH_DOC_ID_COLUMN=doc_id_hash
+OPENSEARCH_EMBEDDINGS_COLUMN=embeddings
+
+# Document Retrieval API Configuration
+# Default index for document retrieval endpoints
+OPENSEARCH_DEFAULT_INDEX=documents
+# Connection timeout in seconds
+OPENSEARCH_TIMEOUT=30
+# Maximum number of retry attempts
+OPENSEARCH_MAX_RETRIES=3
+
+DOCPIPE_INDEX=docpipe_test
+DOCPIPE_MODEL=granite4:latest
+
+# Ollama Configuration
+# Ollama server host URL used by OllamaClient
+# Default: http://localhost:11434
+OLLAMA_HOST=http://localhost:11434
+
+# ============================================================================
+# VLM ENGINE CREDENTIALS (for ExtractOperator)
+# ============================================================================
+# These credentials are used by extract_operator_example.py for VLM engines
+# that require API access (watsonx, openai, generic)
+
+# Watsonx AI (IBM Cloud)
+# Required for --vlm-engine watsonx
+# WATSONX_API_KEY=your_ibm_cloud_api_key_here
+# WATSONX_CONTAINER_KIND=project  # optional: project, space, or catalog (default: project)
+# WATSONX_CONTAINER_ID=your_project_or_space_id_here
+# WATSONX_MODEL=meta-llama/llama-3-2-90b-vision-instruct
+# WATSONX_API_BASE_URL=https://us-south.ml.cloud.ibm.com  # optional, has default
+
+# OpenAI API
+# Required for --vlm-engine openai
+# OPENAI_API_KEY=your_openai_api_key_here
+# OPENAI_MODEL=gpt-4-vision-preview
+# OPENAI_API_BASE_URL=https://api.openai.com/v1  # optional, has default
+
+# Generic API (any OpenAI-compatible API)
+# Required for --vlm-engine generic
+# GENERIC_API_BASE_URL=https://your-api.com/v1/chat
+# GENERIC_API_KEY=your_api_key_here  # optional, some APIs don't require auth
+
+# ============================================================================
+# CORS CONFIGURATION
+# ============================================================================
+# Comma-separated list of allowed origins for CORS
+# For development: http://localhost:3000 (frontend/UI server)
+# For production: https://yourdomain.com,https://app.yourdomain.com
+CORS_ORIGINS=http://localhost:3000
+
+# ============================================================================
+# FLOW REPOSITORY CONFIGURATION
+# ============================================================================
+# Type of repository to use for storing flow definitions
+# Options: local (default)
+# If not set, defaults to 'local' repository type
+# FLOW_REPOSITORY_TYPE=local
+
+# Local repository settings (when FLOW_REPOSITORY_TYPE=local or not set)
+# Directory where flow JSON files are stored
+# If not set, defaults to:
+#   macOS/Linux: ~/Documents/pipeline/assets
+#   Windows: %USERPROFILE%\Documents\pipeline\assets
+# Use absolute paths for production deployments
+# LOCAL_FLOWS_DIR=/path/to/custom/flows/directory

docling_pipelines-1.0.0.dev1/.env.oauth2.example

@@ -0,0 +1,123 @@
+# OAuth2 and OIDC Configuration Example
+# Copy this file to .env and configure your OAuth2 settings
+
+# ============================================================================
+# JWT Configuration (Required for all auth methods)
+# ============================================================================
+JWT_SECRET_KEY=your-secret-key-here-change-this-in-production
+JWT_ALGORITHM=HS256
+JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
+
+# ============================================================================
+# OAuth2 General Settings
+# ============================================================================
+OAUTH2_ENABLED=true
+OAUTH2_PROVIDER=google  # Options: google, azure, generic
+OAUTH2_CLIENT_ID=your-client-id
+OAUTH2_CLIENT_SECRET=your-client-secret
+OAUTH2_REDIRECT_URI=http://localhost:8000/auth/oauth2/callback
+OAUTH2_SCOPE=openid profile email
+OAUTH2_TOKEN_VALIDATION=true
+OAUTH2_STATE_SECRET=your-state-secret-here
+OAUTH2_SESSION_EXPIRE_MINUTES=60
+
+# ============================================================================
+# Google OAuth2 Configuration
+# ============================================================================
+# When using OAUTH2_PROVIDER=google, these are auto-configured:
+# OAUTH2_DISCOVERY_URL=https://accounts.google.com/.well-known/openid-configuration
+# OAUTH2_AUTHORIZATION_ENDPOINT=https://accounts.google.com/o/oauth2/v2/auth
+# OAUTH2_TOKEN_ENDPOINT=https://oauth2.googleapis.com/token
+# OAUTH2_USERINFO_ENDPOINT=https://openidconnect.googleapis.com/v1/userinfo
+# OAUTH2_JWKS_URI=https://www.googleapis.com/oauth2/v3/certs
+# OIDC_ISSUER=https://accounts.google.com
+# OIDC_AUDIENCE=your-client-id
+
+# Google OAuth2 Setup:
+# 1. Go to https://console.cloud.google.com/
+# 2. Create a new project or select existing
+# 3. Enable Google+ API
+# 4. Go to Credentials > Create Credentials > OAuth 2.0 Client ID
+# 5. Set application type to "Web application"
+# 6. Add authorized redirect URI: http://localhost:8000/auth/oauth2/callback
+# 7. Copy Client ID and Client Secret to OAUTH2_CLIENT_ID and OAUTH2_CLIENT_SECRET
+
+# ============================================================================
+# Azure AD OAuth2 Configuration
+# ============================================================================
+# When using OAUTH2_PROVIDER=azure, configure:
+AZURE_TENANT_ID=common  # Or your specific tenant ID
+
+# Azure AD Setup:
+# 1. Go to https://portal.azure.com/
+# 2. Navigate to Azure Active Directory > App registrations
+# 3. Click "New registration"
+# 4. Set redirect URI: http://localhost:8000/auth/oauth2/callback
+# 5. Go to Certificates & secrets > New client secret
+# 6. Copy Application (client) ID to OAUTH2_CLIENT_ID
+# 7. Copy client secret value to OAUTH2_CLIENT_SECRET
+# 8. Copy Directory (tenant) ID to AZURE_TENANT_ID
+
+# ============================================================================
+# Generic OIDC Provider Configuration
+# ============================================================================
+# When using OAUTH2_PROVIDER=generic, manually configure all endpoints:
+# OAUTH2_DISCOVERY_URL=https://your-provider.com/.well-known/openid-configuration
+# OAUTH2_AUTHORIZATION_ENDPOINT=https://your-provider.com/oauth2/authorize
+# OAUTH2_TOKEN_ENDPOINT=https://your-provider.com/oauth2/token
+# OAUTH2_USERINFO_ENDPOINT=https://your-provider.com/oauth2/userinfo
+# OAUTH2_JWKS_URI=https://your-provider.com/oauth2/jwks
+# OIDC_ISSUER=https://your-provider.com
+# OIDC_AUDIENCE=your-client-id
+
+# Generic OIDC providers include:
+# - Okta: https://your-domain.okta.com/.well-known/openid-configuration
+# - Auth0: https://your-domain.auth0.com/.well-known/openid-configuration
+# - Keycloak: https://your-domain.com/auth/realms/{realm}/.well-known/openid-configuration
+# - GitLab: https://gitlab.com/.well-known/openid-configuration
+
+# ============================================================================
+# LDAP Configuration (Optional - for LDAP authentication)
+# ============================================================================
+LDAP_SERVER=ldap://localhost:389
+LDAP_BASE_DN=dc=example,dc=com
+LDAP_USER_DN=ou=users,dc=example,dc=com
+LDAP_BIND_DN=cn=admin,dc=example,dc=com
+# LDAP_BIND_PASSWORD=<set-your-ldap-bind-password>
+LDAP_USE_SSL=false
+LDAP_USE_ACTIVE_DIRECTORY=false
+LDAP_AD_DOMAIN=example.com
+
+# ============================================================================
+# CORS Configuration
+# ============================================================================
+CORS_ORIGINS=http://localhost:3000,http://localhost:8080
+
+# ============================================================================
+# Usage Examples
+# ============================================================================
+
+# Example 1: Google OAuth2
+# OAUTH2_ENABLED=true
+# OAUTH2_PROVIDER=google
+# OAUTH2_CLIENT_ID=123456789-abcdefg.apps.googleusercontent.com
+# OAUTH2_CLIENT_SECRET=GOCSPX-your-secret-here
+# OAUTH2_REDIRECT_URI=http://localhost:8000/auth/oauth2/callback
+
+# Example 2: Azure AD OAuth2
+# OAUTH2_ENABLED=true
+# OAUTH2_PROVIDER=azure
+# AZURE_TENANT_ID=your-tenant-id-here
+# OAUTH2_CLIENT_ID=your-application-id-here
+# OAUTH2_CLIENT_SECRET=your-client-secret-here
+# OAUTH2_REDIRECT_URI=http://localhost:8000/auth/oauth2/callback
+
+# Example 3: Okta OIDC
+# OAUTH2_ENABLED=true
+# OAUTH2_PROVIDER=generic
+# OAUTH2_DISCOVERY_URL=https://your-domain.okta.com/.well-known/openid-configuration
+# OAUTH2_CLIENT_ID=your-okta-client-id
+# OAUTH2_CLIENT_SECRET=your-okta-client-secret
+# OAUTH2_REDIRECT_URI=http://localhost:8000/auth/oauth2/callback
+# OIDC_ISSUER=https://your-domain.okta.com
+# OIDC_AUDIENCE=your-okta-client-id

docling_pipelines-1.0.0.dev1/.gitattributes

@@ -0,0 +1,4 @@
+# Jupyter Notebooks
+*.ipynb filter=nbstripout
+*.ipynb diff=jupyternotebook
+*.ipynb merge=jupyternotebook

docling_pipelines-1.0.0.dev1/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Report an issue to help improve docling-pipelines
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+### Bug
+<!-- Describe the buggy behavior you have observed. -->
+...
+
+### Steps to reproduce
+<!-- Describe the sequence of steps for reproducing the bug. -->
+...
+
+### docling-pipelines version
+<!-- Copy the output of `docling-pipelines --version`. -->
+...
+
+### Python version
+<!-- Copy the output of `python --version`. -->
+...
+
+<!-- ⚠️ ATTENTION: When sharing screenshots, attachments, or other data make sure not to include any sensitive information. -->

docling_pipelines-1.0.0.dev1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

docling_pipelines-1.0.0.dev1/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea for enhancing docling-pipelines
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+### Requested feature
+<!-- Describe the feature you have in mind and the user need it addresses. -->
+...
+
+### Alternatives
+<!-- Describe any alternatives you have considered. -->
+...
+
+<!-- ⚠️ ATTENTION: When sharing screenshots, attachments, or other data make sure not to include any sensitive information. -->

docling_pipelines-1.0.0.dev1/.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,14 @@
+---
+name: Question
+about: Ask a question
+title: ''
+labels: question
+assignees: ''
+
+---
+
+### Question
+<!-- Describe what you would like to achieve and which part you need help with. -->
+...
+
+<!-- ⚠️ ATTENTION: When sharing screenshots, attachments, or other data make sure not to include any sensitive information. -->

docling_pipelines-1.0.0.dev1/.github/SECURITY.md

@@ -0,0 +1,51 @@
+# Security and Disclosure Information Policy for the Docling Project
+
+The Docling-pipelines team and community take security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+### Security
+
+- Participation in the [OpenSSF Best Practices Badge Program](https://bestpractices.coreinfrastructure.org/en/projects/) for Free/Libre and FLOSS projects to ensure that we follow current best practices for quality and security
+- Use of [HTTPS](https://en.wikipedia.org/wiki/HTTPS) for network communication
+- Use of secure protocols for network communication (through the use of HTTPS)
+- Up-to-date support for TLS/SSL (through the use of [OpenSSL](https://www.openssl.org/))
+- Performance of TLS certificate verification by default before sending HTTP headers with private information (through the use of OpenSSL and HTTPS)
+- Distribution of the software via cryptographically signed releases (on the [PyPI](https://pypi.org/), [Quay.io](https://quay.io/organization/docling-project/) and [GHCR.io](https://github.com/orgs/docling-project/packages) package repositories)
+- Use of [GitHub](https://github.com/) Issues for vulnerability reporting and tracking
+
+### Analysis
+
+- Use of [Ruff](https://docs.astral.sh/ruff/), [ty](https://docs.astral.sh/ty/) and [Pytest](https://docs.pytest.org/en/7.2.x/) for Python code linting (static and dynamic analysers) on pull requests and builds
+- Use of GitHub Issues for bug reporting and tracking
+
+## Reporting a Vulnerability
+
+If you think you've identified a security issue in a Docling project repository, please DO NOT report the issue publicly via the GitHub issue tracker, discussions, or any other public forum.
+
+### Preferred Method: GitHub Private Vulnerability Reporting
+
+**We strongly encourage you to use GitHub's Private Vulnerability Reporting feature**, which provides a secure and streamlined process for disclosing security issues:
+
+1. Navigate to the [Security tab](https://github.com/docling-project/docling/security) of the Docling repository
+2. Click on "Report a vulnerability"
+3. Fill out the vulnerability report form with as many details as possible
+4. Submit the report
+
+This method allows for:
+- **Secure communication** directly with the maintainers team
+- **Coordinated disclosure** through GitHub's built-in workflow
+- **Automatic tracking** of the vulnerability lifecycle
+- **Credit attribution** when the vulnerability is published
+
+### Alternative Method: Email Disclosure
+
+Alternatively, you can send an email with as many details as possible to [docling_pipeline_team-dg@ibm.com](mailto:docling_pipeline_team-dg@ibm.com). This is a distribution list for the maintainers team.
+
+**Important:** Please do not create a public issue or discuss the vulnerability in any public channel until it has been addressed.
+
+### Security Vulnerability Response
+
+Each report is acknowledged and analyzed by the core maintainers within 3 working days.
+
+Any vulnerability information shared with core maintainers stays within the Docling project and will not be disseminated to other projects unless it is necessary to get the issue fixed.
+
+After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

docling_pipelines-1.0.0.dev1/.github/dco.yml

@@ -0,0 +1,2 @@
+allowRemediationCommits:
+  individual: true

docling_pipelines-1.0.0.dev1/.github/mergify.yml

@@ -0,0 +1,22 @@
+merge_protections:
+  - name: Enforce conventional commit
+    description: Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
+    if:
+      - base = main
+    success_conditions:
+      - "title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(\\(.+\\))?(!)?:"
+  - name: Require two reviewers for breaking changes
+    description: Breaking changes require additional scrutiny with 2 approvers
+    if:
+      - base = main
+      - "title ~= !:"
+    success_conditions:
+      - "#approved-reviews-by >= 2"
+  - name: Require one reviewer for small changes
+    description: All non-breaking PRs to main require at least 1 approval
+    if:
+      - base = main
+    success_conditions:
+      - "#approved-reviews-by >= 1"
+merge_protections_settings:
+  reporting_method: check-runs

docling_pipelines-1.0.0.dev1/.github/pull_request_template.md

@@ -0,0 +1,66 @@
+<!--
+Note -
+1. PR title must follow Conventional Commits: https://www.conventionalcommits.org/en/v1.0.0/#summary
+   Format: <type>[optional scope][optional !]: <description>
+   Types: fix | feat | docs | style | refactor | perf | test | build | ci | chore | revert
+   Example: feat(chunker): add sliding window chunking strategy
+   Append ! before the colon for breaking changes: feat(api)!: remove deprecated endpoint
+2. Tag the issue this PR resolves (or remove the Issue section if there is none)
+3. Headings that are not applicable to the PR can be removed from the below template
+-->
+
+## Issue
+<!-- Tag the issue this PR resolves, or remove this section if there is none -->
+Resolves #
+
+## Dev Tracking
+<!-- Link to epic or parent task if this PR is part of a larger feature/epic -->
+<!-- Example: Part of Epic #123 or Subtask of #456 -->
+
+## Description
+<!-- Concise Summary of the PR -->
+
+## Basic Checklist
+- [ ] Code follows project standards (keyword-only arguments, no unicode in logging)
+- [ ] Tests added/updated for new functionality
+- [ ] Documentation updated (see Documentation Update Checklist below)
+- [ ] No breaking changes (or documented in Breaking Changes section)
+
+## Breaking Changes
+<!-- List any breaking changes introduced by this PR -->
+<!-- If none, write "None" -->
+
+## Dependencies
+<!-- List any new dependencies added or version updates -->
+<!-- Include package name, version, and reason for addition/update -->
+<!-- If none, write "None" -->
+
+## Testing Details
+<!-- Details about how the changes were tested -->
+<!-- Include test commands, test files, or manual testing steps -->
+
+## Documentation Update Checklist
+<!-- Check all documentation files that were updated or reviewed for this PR -->
+- [ ] README.md (if adding features, changing structure, or modifying setup)
+- [ ] ARCHITECTURE.md (if modifying operators, data flow, or system design)
+- [ ] CONTRIBUTING.md (if changing development workflow or code standards)
+- [ ] USER_GUIDE_PIPELINE_SETUP.md (if changing installation, setup, or execution)
+- [ ] QUICKSTART.md (if changing quick start steps or examples)
+- [ ] OPERATOR_REFERENCE.md (if adding/modifying operators)
+- [ ] TROUBLESHOOTING.md (if discovering new issues or solutions)
+- [ ] Operator documentation in docs/operators/ (if operator added/modified)
+- [ ] N/A - No documentation updates needed
+
+## Screenshots/Videos
+<!-- For UI changes, include screenshots or videos demonstrating the changes -->
+<!-- If not applicable, remove this section -->
+
+### Pre-Commit Hook Results
+<!-- Paste the output of pre-commit hooks execution to verify all checks passed -->
+
+
+### Note
+ 1. **Keyword Arguments** - Ensure function arguments are keyword-based, not positional - [Link](https://docs.python.org/3/glossary.html#term-argument)
+ 2. **Metadata Independence:** When adding or modifying operator metadata, ensure the data does not depend on instance variables.
+ 3. **Method Requirements:** Ensure `get_metadata` is a static method. If `get_required_features` depends on instance variables, the operator must implement `get_static_required_features` using the default values referenced in `get_required_features`
+ 4. For every PR, ensure that the pre-commit hook output has been included.

docling_pipelines-1.0.0.dev1/.github/workflows/ci.yml

@@ -0,0 +1,108 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Code Quality & Type Checking
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+          enable-cache: true
+          cache-suffix: "py312"
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install System Dependencies
+        run: sudo apt-get install -y libldap2-dev libsasl2-dev
+
+      - name: Install Dependencies
+        run: uv sync --extra dev
+
+      - name: Check Formatting (Ruff)
+        run: |
+          MODIFIED=$(git diff --name-only --diff-filter=ACMR $(git merge-base HEAD origin/main)..HEAD | grep '\.py$' || true)
+          if [ -z "$MODIFIED" ]; then echo "No modified Python files."; exit 0; fi
+          uv run ruff format --check $MODIFIED
+
+      - name: Lint Code (Ruff)
+        run: |
+          MODIFIED=$(git diff --name-only --diff-filter=ACMR $(git merge-base HEAD origin/main)..HEAD | grep '\.py$' || true)
+          if [ -z "$MODIFIED" ]; then echo "No modified Python files."; exit 0; fi
+          uv run ruff check $MODIFIED
+
+      - name: Static Type Checking (Mypy)
+        run: |
+          MODIFIED=$(git diff --name-only --diff-filter=ACMR $(git merge-base HEAD origin/main)..HEAD | grep '\.py$' | grep -v '^examples/' || true)
+          if [ -z "$MODIFIED" ]; then echo "No modified Python files."; exit 0; fi
+          uv run mypy --config-file=pyproject.toml $MODIFIED
+
+  test:
+    name: Test Suite (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: lint
+
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12"]
+
+    env:
+      PYTHONPATH: src
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+          enable-cache: true
+          cache-suffix: "py312"
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install System Dependencies
+        run: sudo apt-get install -y libldap2-dev libsasl2-dev
+
+      - name: Install Dependencies
+        run: uv sync --extra dev
+
+      - name: Run Unit Tests
+        run: uv run pytest tests/unit -m "unit and not integration" -v --cov=src --cov-report=xml --cov-report=term-missing
+
+      - name: Run CLI Tests
+        run: uv run pytest tests/test_docpipe_cli.py -v
+
+      - name: Upload Test Coverage Artifact
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage.xml
+          retention-days: 14