gitlabform 5.5.4__tar.gz → 5.5.5__tar.gz

{gitlabform-5.5.4 → gitlabform-5.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlabform
-Version: 5.5.4
+Version: 5.5.5
 Summary: 🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML
 Project-URL: Homepage, https://gitlabform.github.io/gitlabform/
 Project-URL: Repository, https://github.com/gitlabform/gitlabform.git
@@ -19,7 +19,7 @@ Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Version Control :: Git
 Requires-Python: >=3.12.0
-Requires-Dist: certifi==2026.4.22
+Requires-Dist: certifi==2026.5.20
 Requires-Dist: cli-ui==0.19.0
 Requires-Dist: ez-yaml==1.2.0
 Requires-Dist: jinja2==3.1.6
@@ -27,8 +27,8 @@ Requires-Dist: luddite==1.0.4
 Requires-Dist: markupsafe==3.0.3
 Requires-Dist: mergedeep==1.3.4
 Requires-Dist: packaging==26.2
-Requires-Dist: python-gitlab[graphql]==8.3.0
-Requires-Dist: requests==2.33.1
+Requires-Dist: python-gitlab[graphql]==8.4.0
+Requires-Dist: requests==2.34.2
 Requires-Dist: rich==15.0.0
 Requires-Dist: ruamel-yaml==0.17.21
 Requires-Dist: yamlpath==3.8.2

{gitlabform-5.5.4 → gitlabform-5.5.5}/docs/changelog.md

@@ -5,6 +5,18 @@ This changelog follows industry-standard best practices. Each release includes t
 For details on how to migrate between major versions, please refer to the [upgrade guide](upgrade.md), which contains important instructions for breaking changes.
 
 ---
+## 5.5.5
+
+### Bug Fixes
+
+* allow editing and creation of files on wildcard protected branches [#1282](https://github.com/gitlabform/gitlabform/pull/1282). ([timknight01](https://github.com/TimKnight01) & [rickbrouwer](https://github.com/rickbrouwer))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
 ## 5.5.4
 
 ### Build

{gitlabform-5.5.4 → gitlabform-5.5.5}/docs/reference/files.md

@@ -8,7 +8,7 @@ Each key in this section is a path to a file in the repo and the values are dict
 
 * `overwrite` - if set to `false` and the file already exists, but has a different content, then it is not changed; default is `true`,
 * `skip_ci` - if set to `true` then the changes to a given file will be done with commits that will not trigger the CI pipeline; default is `false`,
-* `branches` - can be a single string `all`, string `protected` or an array of branch names,
+* `branches` - can be a single string `all`, string `protected` (all protected branches, with wildcard-protected rules expanded to matching branches), or an array of branch names where `*` can be used to match any sequence of characters (e.g. `bugfix/*`, `*release*`),
 * `only_first_branch` - if set to `true` then only the first branch from the list above that exists will be processed (unless you pass `--strict` as cli parameter to the app - then it will fail when trying to process a non-existent branch),
 * `commit_message` - set this to a custom commit message that will be used by the app; optional,
 * `content` - the literal contents that should be put into the target file; use this or `file`,
@@ -94,3 +94,45 @@ projects_and_groups:
         only_first_branch: true
         skip_ci: true
 ```
+
+Example 5 - adding a README to all branches with "gitlab" in their name:
+
+```yaml
+projects_and_groups:
+  group_1/project_1:
+    files:
+      "README.md":
+        overwrite: false
+        branches:
+          - "*gitlab*"
+        skip_ci: true
+        content: |
+          This is a default README. Please replace it with a proper one!
+        commit_message: Set default README
+```
+
+Example 6 - adding a README to protected branches, including protected branches defined with wildcards (e.g. all branches with "bugfix/" in their name are protected and will have the file added):
+
+```yaml
+projects_and_groups:
+  group_1/project_1:
+    branches:
+      main: 
+        allow_force_push: false
+        code_owner_approval_required: true
+        merge_access_level: developer
+        protected: true
+      bugfix/*: 
+        allow_force_push: true
+        code_owner_approval_required: false
+        merge_access_level: developer
+        protected: true
+    files:
+      "README.md":
+        overwrite: false
+        branches: protected
+        skip_ci: true
+        content: |
+          This is a protected branch README!
+        commit_message: Set protected branch README
+```

{gitlabform-5.5.4 → gitlabform-5.5.5}/gitlabform/processors/project/files_processor.py

@@ -4,10 +4,9 @@ import sys
 from pathlib import Path
 
 from logging import debug, info, warning, critical
-from typing import List
 
 from jinja2 import Environment, FileSystemLoader
-from gitlab import GitlabGetError, GitlabUpdateError
+from gitlab import GitlabGetError, GitlabUpdateError, GitlabListError
 from gitlab.v4.objects import Project, ProjectFile, ProjectBranch
 from gitlab.base import RESTObject
 
@@ -35,27 +34,20 @@ class FilesProcessor(AbstractProcessor):
                 continue
 
             config_target_ref = configuration["files"][file]["branches"]
-            branches_to_update: List[RESTObject] = []
-
-            if isinstance(config_target_ref, str):
-                # Target ref could be either 'all' or 'protected'.
-                # Get a list of branches that should be updated.
-                if config_target_ref == "all":
-                    branches_to_update.extend(project.branches.list(get_all=True, lazy=True))
-                elif config_target_ref == "protected":
-                    branches_to_update.extend(project.protectedbranches.list(get_all=True, lazy=True))
+            branches_to_update: list[ProjectBranch] = []
+
+            if config_target_ref == "all":
+                # Get all Branches in the Project
+                branches_to_update.extend(project.branches.list(get_all=True, lazy=True))
+            elif config_target_ref == "protected":
+                # Get all Protected Branch definitions -> this could return wildcard branch names
+                protected_branches = project.protectedbranches.list(get_all=True, lazy=True)
+                for protected_branch in protected_branches:
+                    self.append_branches_matching_ref(branches_to_update, file, project, protected_branch.name)
             elif isinstance(config_target_ref, list):
-                # Get a list of branches from the config that should be updated.
-                for branch_name in config_target_ref:
-                    try:
-                        branches_to_update.append(project.branches.get(branch_name))
-                    except GitlabGetError:
-                        message = f"! Branch '{branch_name}' not found, not processing file '{file}' in it"
-                        if self.strict:
-                            critical(message)
-                            sys.exit(EXIT_INVALID_INPUT)
-                        else:
-                            warning(message)
+                # List of specific branch refs to update -> this could contain wildcard branch names
+                for ref in config_target_ref:
+                    self.append_branches_matching_ref(branches_to_update, file, project, ref)
 
             debug(
                 "File '%s' to be updated in '%s' branche(s)",
@@ -63,105 +55,150 @@ class FilesProcessor(AbstractProcessor):
                 len(branches_to_update),
             )
 
-            for branch in branches_to_update:
-                info(f"Processing file '{file}' in branch '{branch.name}'")
+            for branch_to_update in branches_to_update:
+                process_only_first: bool = configuration.get("files|" + file + "|only_first_branch", False)
 
-                if configuration.get("files|" + file + "|content") and configuration.get("files|" + file + "|file"):
-                    critical(
-                        f"File '{file}' in '{project_and_group}' has both `content` and `file` set - "
-                        "use only one of these keys."
-                    )
+                self.process_branch(branch_to_update, configuration, file, project, project_and_group)
+
+                if process_only_first:
+                    info("Skipping other branches for this file, as configured by only_first_branch.")
+                    break
+
+    def append_branches_matching_ref(self, branches_to_update: list[ProjectBranch], file, project: Project, ref: str):
+
+        if self.branch_processor.branch_name_contains_supported_wildcard(ref):
+            try:
+                # GitLab's branches API expects an RE2 regex
+                regex_ref = "^" + re.escape(ref).replace(r"\*", ".*") + "$"
+                # sorted for deterministic only_first_branch
+                wildcard_branches = sorted(
+                    project.branches.list(get_all=True, regex=regex_ref),
+                    key=lambda b: b.name,
+                )
+                for wildcard_branch in wildcard_branches:
+                    branch_id = wildcard_branch.get_id()
+                    if branch_id:
+                        branches_to_update.append(wildcard_branch)
+            except GitlabListError:
+                message = f"! Could not list branches using {ref}, not processing file '{file}' on them"
+                if self.strict:
+                    critical(message)
                     sys.exit(EXIT_INVALID_INPUT)
+                else:
+                    warning(message)
+        else:
+            try:
+                branches_to_update.append(project.branches.get(ref))
+            except GitlabGetError:
+                message = f"! Branch '{ref}' not found, not processing file '{file}' in it"
+                if self.strict:
+                    critical(message)
+                    sys.exit(EXIT_INVALID_INPUT)
+                else:
+                    warning(message)
 
-                if configuration.get("files|" + file + "|delete"):
-                    try:
-                        file_to_delete: ProjectFile = project.files.get(file_path=file, ref=branch.name)
-                        debug("Deleting file '%s' in branch '%s'", file, branch.name)
-                        self.modify_file_dealing_with_branch_protection(
-                            project,
-                            branch,
-                            file_to_delete,
-                            "delete",
-                            configuration,
-                        )
-                    except GitlabGetError:
+    def process_branch(
+        self,
+        branch: ProjectBranch,
+        configuration: dict,
+        file: str,
+        project: Project,
+        project_and_group: str,
+    ):
+        info(f"Processing file '{file}' in branch '{branch.name}'")
+
+        if configuration.get("files|" + file + "|content") and configuration.get("files|" + file + "|file"):
+            critical(
+                f"File '{file}' in '{project_and_group}' has both `content` and `file` set - "
+                "use only one of these keys."
+            )
+            sys.exit(EXIT_INVALID_INPUT)
+
+        if configuration.get("files|" + file + "|delete"):
+            try:
+                file_to_delete: ProjectFile = project.files.get(file_path=file, ref=branch.name)
+                debug("Deleting file '%s' in branch '%s'", file, branch.name)
+                self.modify_file_dealing_with_branch_protection(
+                    project,
+                    branch,
+                    file_to_delete,
+                    "delete",
+                    configuration,
+                )
+            except GitlabGetError:
+                debug(
+                    "Not deleting file '%s' in branch '%s' (already doesn't exist)",
+                    file,
+                    branch.name,
+                )
+        else:
+            # change or create file
+
+            if configuration.get("files|" + file + "|content"):
+                new_content = configuration.get("files|" + file + "|content")
+            else:
+                path_in_config = Path(str(configuration.get("files|" + file + "|file")))
+                if path_in_config.is_absolute():
+                    effective_path = path_in_config
+                else:
+                    # relative paths are relative to config file location
+                    effective_path = Path(os.path.join(self.config.config_dir, str(path_in_config)))
+                new_content = effective_path.read_text()
+
+            # templating is documented to be enabled by default,
+            # see https://gitlabform.github.io/gitlabform/reference/files/#files
+            templating_enabled = True
+
+            if configuration.get("files|" + file + "|template", templating_enabled):
+                new_content = self.get_file_content_as_template(
+                    new_content,
+                    project_and_group,
+                    **configuration.get("files|" + file + "|jinja_env", dict()),
+                )
+
+            try:
+                # Returns base64 encoded content: https://python-gitlab.readthedocs.io/en/stable/gl_objects/projects.html#project-files
+                repo_file: ProjectFile = project.files.get(file_path=file, ref=branch.name)
+                decoded_file: bytes = repo_file.decode()
+                current_content: str = decoded_file.decode("utf-8")
+
+                if current_content != new_content:
+                    if configuration.get("files|" + file + "|overwrite"):
                         debug(
-                            "Not deleting file '%s' in branch '%s' (already doesn't exist)",
+                            "Changing file '%s' in branch '%s'",
                             file,
                             branch.name,
                         )
-                else:
-                    # change or create file
-
-                    if configuration.get("files|" + file + "|content"):
-                        new_content = configuration.get("files|" + file + "|content")
-                    else:
-                        path_in_config = Path(str(configuration.get("files|" + file + "|file")))
-                        if path_in_config.is_absolute():
-                            effective_path = path_in_config
-                        else:
-                            # relative paths are relative to config file location
-                            effective_path = Path(os.path.join(self.config.config_dir, str(path_in_config)))
-                        new_content = effective_path.read_text()
-
-                    # templating is documented to be enabled by default,
-                    # see https://gitlabform.github.io/gitlabform/reference/files/#files
-                    templating_enabled = True
-
-                    if configuration.get("files|" + file + "|template", templating_enabled):
-                        new_content = self.get_file_content_as_template(
-                            new_content,
-                            project_and_group,
-                            **configuration.get("files|" + file + "|jinja_env", dict()),
-                        )
-
-                    try:
-                        # Returns base64 encoded content: https://python-gitlab.readthedocs.io/en/stable/gl_objects/projects.html#project-files
-                        repo_file: ProjectFile = project.files.get(file_path=file, ref=branch.name)
-                        decoded_file: bytes = repo_file.decode()
-                        current_content: str = decoded_file.decode("utf-8")
-
-                        if current_content != new_content:
-                            if configuration.get("files|" + file + "|overwrite"):
-                                debug(
-                                    "Changing file '%s' in branch '%s'",
-                                    file,
-                                    branch.name,
-                                )
-                                self.modify_file_dealing_with_branch_protection(
-                                    project,
-                                    branch,
-                                    repo_file,
-                                    "modify",
-                                    configuration,
-                                    new_content,
-                                )
-                            else:
-                                debug(
-                                    "Not changing file '%s' in branch '%s' - overwrite flag not set.",
-                                    file,
-                                    branch.name,
-                                )
-                        else:
-                            debug(
-                                "Not changing file '%s' in branch '%s' - it's content is already" " as provided)",
-                                file,
-                                branch.name,
-                            )
-                    except GitlabGetError:
-                        debug("Creating file '%s' in branch '%s'", file, branch.name)
                         self.modify_file_dealing_with_branch_protection(
                             project,
                             branch,
-                            file,
-                            "add",
+                            repo_file,
+                            "modify",
                             configuration,
                             new_content,
                         )
-
-                if configuration.get("files|" + file + "|only_first_branch"):
-                    info("Skipping other branches for this file, as configured.")
-                    break
+                    else:
+                        debug(
+                            "Not changing file '%s' in branch '%s' - overwrite flag not set.",
+                            file,
+                            branch.name,
+                        )
+                else:
+                    debug(
+                        "Not changing file '%s' in branch '%s' - it's content is already" " as provided)",
+                        file,
+                        branch.name,
+                    )
+            except GitlabGetError:
+                debug("Creating file '%s' in branch '%s'", file, branch.name)
+                self.modify_file_dealing_with_branch_protection(
+                    project,
+                    branch,
+                    file,
+                    "add",
+                    configuration,
+                    new_content,
+                )
 
     def modify_file_dealing_with_branch_protection(
         self,

{gitlabform-5.5.4 → gitlabform-5.5.5}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["gitlabform"]
 
 [project]
 name = "gitlabform"
-version = "5.5.4"
+version = "5.5.5"
 requires-python = ">=3.12.0"
 authors = [{ name = "Greg Dubicki and Contributors" }]
 description = "🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML"
@@ -31,7 +31,7 @@ classifiers = [
 
 # Main runtime dependencies. Pinned strictly to ensure production stability.
 dependencies = [
-    "certifi==2026.4.22",
+    "certifi==2026.5.20",
     "cli-ui==0.19.0",
     # ez_yaml >1.2.0 changes imports and also uses ruamel.yaml tied to 1.2 so wouldn't support "yes" as True
     "ez-yaml==1.2.0",
@@ -40,8 +40,8 @@ dependencies = [
     "markupsafe==3.0.3",
     "mergedeep==1.3.4",
     "packaging==26.2",
-    "python-gitlab[graphql]==8.3.0",
-    "requests==2.33.1",
+    "python-gitlab[graphql]==8.4.0",
+    "requests==2.34.2",
     "rich==15.0.0",
     # yamlpath and ruamel and tightly coupled, currently 0.19.1 of ruamel and 3.9.0 of yamlpath break support for
     # yaml 1.1 "yes" -> True conversion. If we want to upgrade we'd need to make a breaking-change and drop support for
@@ -58,27 +58,27 @@ dev = [
     { include-group = "lint" },
     { include-group = "docs" },
     { include-group = "release" },
-    "commitizen==4.16.2",
-    "prek==0.4.0",
+    "commitizen==4.16.3",
+    "prek==0.4.3",
 ]
 # Minimum set of dependencies required to execute the test suite.
 test = [
-    "coverage==7.14.0",
+    "coverage==7.14.1",
     "cryptography==48.0.0",
     "deepdiff==9.1.0",
     "pytest==9.0.3",
     "pytest-cov==7.1.0",
-    "pytest-rerunfailures==16.2",
+    "pytest-rerunfailures==16.3",
     "xkcdpass==1.30.0",
 ]
 # Static analysis and formatting tools.
 lint = [
     "bandit==1.9.4",
-    "black==26.5.0",
+    "black==26.5.1",
     "codespell==2.4.2",
     "mypy==2.1.0",
     "mypy-extensions==1.1.0",
-    "ruff==0.15.13",
+    "ruff==0.15.15",
     "types-requests==2.33.0.20260518",
 ]
 # Documentation generation stack.

{gitlabform-5.5.4 → gitlabform-5.5.5}/tbump.toml

@@ -2,7 +2,7 @@
 github_url = "https://github.com/gitlabform/gitlabform/"
 
 [version]
-current = "5.5.4"
+current = "5.5.5"
 
 # Example of a semver regexp.
 # Make sure this matches current_version before

{gitlabform-5.5.4 → gitlabform-5.5.5}/tests/acceptance/standard/test_branches.py

@@ -4,7 +4,7 @@ import time
 from gitlab import GitlabGetError
 
 from gitlabform.gitlab import AccessLevel
-from tests.acceptance import get_only_branch_access_levels, run_gitlabform
+from tests.acceptance import get_only_branch_access_levels, run_gitlabform, get_random_name
 
 
 @pytest.mark.ce
@@ -401,3 +401,54 @@ class TestBranches:
             assert other_branch_unprotect_access_level is AccessLevel.MAINTAINER.value
         else:
             assert other_branch_unprotect_access_level is None
+
+    def test__can_protect_branches_with_wildcard(self, project_for_function, branch_for_function):
+        # Setup Test
+
+        ### Test-config:
+        set_file_protected_branches = f"""
+        protected branch: &protected_branch
+          allow_force_push: false
+          code_owner_approval_required: true
+          merge_access_level: developer
+          protected: true
+          push_access_level: maintainer
+          unprotect_access_level: maintainer
+
+        projects_and_groups:
+          {project_for_function.path_with_namespace}:
+            branches:
+              main: *protected_branch
+              bugfix/*: *protected_branch
+        """
+
+        ### Make sure "main" exists on project
+        main_branch_name: str = "main"
+        assert project_for_function.branches.get(main_branch_name) is not None
+
+        ### Make sure "branch_for_function" exists on project
+        assert project_for_function.branches.get(branch_for_function) is not None
+
+        ### Add a "bugfix/some-branch" and a "bugfix/other-fix" to project
+        bug_fix_branch_name_1 = f"bugfix/{get_random_name("branch")}"
+        bug_fix_branch_name_2 = f"bugfix/{get_random_name("branch")}"
+
+        project_for_function.branches.create({"branch": bug_fix_branch_name_1, "ref": "main"})
+        project_for_function.branches.create({"branch": bug_fix_branch_name_2, "ref": "main"})
+
+        time.sleep(5)
+        # Wait a bit to make sure GitLab has asynchronously created the branches before we run GitLabForm
+
+        # Run Test
+        run_gitlabform(set_file_protected_branches, project_for_function.path_with_namespace)
+
+        # Assert correct changes are applied
+        ### Check Main branch is protected
+        assert project_for_function.branches.get(main_branch_name).protected is True
+
+        ### Check both Bugfix branches are protected
+        assert project_for_function.branches.get(bug_fix_branch_name_1).protected is True
+        assert project_for_function.branches.get(bug_fix_branch_name_2).protected is True
+
+        ### Check branch_for_function is not protected
+        assert project_for_function.branches.get(branch_for_function).protected is False