gitlabform 5.5.4__tar.gz → 5.5.6__tar.gz

{gitlabform-5.5.4 → gitlabform-5.5.6}/.github/workflows/_main.yml

@@ -18,31 +18,29 @@ on:
 
 jobs:
 
-  build-docs:
-    uses: ./.github/workflows/docs.yml
+  build:
+    name: Build
+    uses: ./.github/workflows/build.yml
     with:
       BRANCH_REF: ${{ github.ref }}
 
-  linters:
-    uses: ./.github/workflows/linters.yml
+  static-analysis:
+    name: Lint
+    uses: ./.github/workflows/static-analysis.yml
     with:
       BRANCH_REF: ${{ github.ref }}
 
-  tests-standard:
-    uses: ./.github/workflows/tests-standard.yml
+  tests:
+    name: Tests
+    uses: ./.github/workflows/tests-unit.yml
     with:
       BRANCH_REF: ${{ github.ref }}
-
-  tests-premium:
-    uses: ./.github/workflows/tests-premium.yml
-    with:
-      BRANCH_REF: ${{ github.ref }}
-      environment: Main Tests
     secrets: inherit
 
-  tests-ultimate:
-    uses: ./.github/workflows/tests-ultimate.yml
+  tests-acceptance:
+    name: Acceptance Tests
+    uses: ./.github/workflows/tests-acceptance.yml
     with:
       BRANCH_REF: ${{ github.ref }}
       environment: Main Tests
-    secrets: inherit
+    secrets: inherit

gitlabform-5.5.6/.github/workflows/_releases.yml

@@ -0,0 +1,203 @@
+name: Releases
+run-name: >-
+  ${{ github.event_name == 'workflow_dispatch'
+    && format('Manual Release: {0}', inputs.manual_tag)
+    || format('Release: {0}', github.event.workflow_run.display_title) }}
+
+on:
+  # Trigger A: Automatic execution when Main Workflow finishes
+  workflow_run:
+    workflows: ["Main branch"]
+    types:
+      - completed
+  
+  # Trigger B: Manual execution fallback from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      manual_tag:
+        description: 'Tag to release (e.g., v1.2.3)'
+        required: true
+        type: string
+      override_run_id:
+        description: 'Main Workflow Run ID (Required if downloading artifacts)'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  prep-release:
+    name: Prepare release
+    runs-on: ubuntu-latest
+    outputs:
+      is_valid_release: ${{ steps.validate.outputs.is_valid }}
+      semver_tag: ${{ steps.validate.outputs.version }}
+      target_run_id: ${{ steps.validate.outputs.run_id }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: "3.14"
+
+      - name: Validate release conditions
+        id: validate
+        env:
+          # Authentication Token
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Upstream Workflow Configuration
+          # This is the name of the workflow that both manual and automated
+          # release validations depend on.
+          UPSTREAM_WORKFLOW_NAME: "Main branch"
+          # GitHub Context Variables (provided by the workflow_run or workflow_dispatch event)
+          REPO: ${{ github.repository }}
+          EVENT: ${{ github.event_name }}
+          CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+          AUTOMATED_UPSTREAM_RUN_ID: ${{ github.event.workflow_run.id }}
+          # Manual Trigger Inputs (from workflow_dispatch)
+          MANUAL_RELEASE_TAG: ${{ inputs.manual_tag }}
+          MANUAL_UPSTREAM_RUN_ID: ${{ inputs.override_run_id }}
+        run: uv run release gh-workflow-check
+
+  # TODO: Remove this job when all the release jobs have been migrated
+  # to consume build artifacts from Main workflow instead of rebuilding.
+  build-release-artifacts:
+    name: Build release artifacts
+    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
+    needs:
+      - prep-release
+    uses: ./.github/workflows/build.yml
+    with:
+      BRANCH_REF: ${{ needs.prep-release.outputs.semver_tag }}
+
+  publish-docs:
+    name: Publish Docs
+    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
+    needs:
+      - prep-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prep-release.outputs.semver_tag }}
+          fetch-depth: 2
+      - name: Download built documentation
+        uses: actions/download-artifact@v4
+        with:
+          run-id: ${{ needs.prep-release.outputs.target_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: docs-site
+          path: site
+      - name: Deploy 🚀
+        uses: JamesIves/github-pages-deploy-action@v4.8.0
+        with:
+          branch: gh-pages
+          folder: site
+
+  publish-to-github:
+    name: Publish Release
+    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
+    needs:
+      - prep-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create release in GitHub
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ needs.prep-release.outputs.semver_tag }}
+          name: ${{ needs.prep-release.outputs.semver_tag }}
+          body: "(this is a placeholder, it will be replaced with a changelog contents)"
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-to-pypi:
+    name: Publish PyPI
+    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
+    needs:
+      - prep-release
+      - build-release-artifacts
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/gitlabform
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prep-release.outputs.semver_tag }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: "3.14"
+      - name: Setup Python ${{ env.UV_PYTHON }} and install dependencies
+        run: |
+          uv sync --frozen --no-dev --group release
+      # TODO: In a separate PR, consume the build artifact (package-dist) uploaded
+      # in build-release-artifacts instead of rebuilding and verifying the package here.
+      - name: Build and verify the package
+        run: |
+          uv run --no-sync package build
+          uv run --no-sync package verify
+      - name: Publish to PyPI
+        run: |
+          uv run --no-sync release pypi
+
+  publish-to-ghcr:
+    name: Publish GHCR
+    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
+    needs:
+      - prep-release
+      - build-release-artifacts
+      - publish-to-pypi
+    runs-on: ubuntu-latest
+    steps:
+      # TODO: In a separate PR, optimize docker image build to consume the built package artifact
+      # (package-dist) instead of copying and rebuilding from source if applicable.
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prep-release.outputs.semver_tag }}
+      - name: Get the version from the tag
+        run: echo "VERSION=${GITHUB_REF/refs\/tags\/v/}" >> $GITHUB_ENV
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ghcr.io/gitlabform/gitlabform
+          flavor: |
+            latest=auto
+          tags: |
+            type=pep440,pattern={{version}}
+            type=pep440,pattern={{major}}.{{minor}}
+            type=pep440,pattern={{major}}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      # gitlabform/gitlabform image is going to be here
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          # This token is provided by Actions, you do not need to create your own token
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # Docker image will use UV internally and builds the image from the Codebase at the current tag, rather than downloding from PyPi
+      - name: Publish image to registries
+        uses: docker/build-push-action@v7
+        with:
+          push: true
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}

gitlabform-5.5.6/.github/workflows/build.yml

@@ -0,0 +1,84 @@
+name: Build and package artifacts
+
+on:
+  workflow_call:
+    inputs:
+      BRANCH_REF:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    name: Package
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: "3.14"
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group release
+      - name: Build and verify the package
+        run: |
+          uv run --no-sync package build
+          uv run --no-sync package verify
+      - name: Upload package distribution
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-dist
+          path: dist/*
+
+  docs:
+    name: Docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: "3.14"
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group docs
+      - name: Build documentation
+        run: uv run --no-sync docs build
+      - name: Upload docs site
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-site
+          path: site
+
+  smoke-tests:
+    name: "Smoke test - (${{ matrix.os == 'ubuntu-latest' && 'Linux' || matrix.os == 'macos-latest' && 'macOS' || 'Windows' }}, Python ${{ matrix.python-version }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.14", "3.12"]
+    needs: package
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group test
+      - name: Run smoke tests
+        run: uv run --no-sync gitlabform -V

gitlabform-5.5.4/.github/workflows/prs.yml → gitlabform-5.5.6/.github/workflows/pr-ci-workflow.yml

@@ -1,4 +1,11 @@
-name: Linter and tests (PRs)
+name: "CI - Build · Lint · Tests"
+
+# Reusable workflow containing the actual CI jobs for pull request validation.
+# This file is called by prs-entrypoint.yml and is intentionally separated so that
+# event/routing logic stays in the entrypoint while the CI job set remains reusable.
+
+# This reusable workflow does not receive secrets automatically from the PR event.
+# The caller workflow (prs-entrypoint.yml) must explicitly pass secrets when calling it.
 
 on:
   workflow_call:
@@ -9,54 +16,31 @@ on:
 
 jobs:
 
-  approve:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Approve
-        run: echo For security reasons, all pull requests need to be approved first before running the Premium Acceptance Tests.
-
-  build-docs:
-    uses: ./.github/workflows/docs.yml
-    permissions:
-      contents: read
-      pull-requests: write
-    with:
-      branch_ref: ${{ inputs.BRANCH_REF }}
-
-  linters:
-    uses: ./.github/workflows/linters.yml
-    permissions:
-      contents: read
-      pull-requests: write
+  build:
+    name: Build
+    uses: ./.github/workflows/build.yml
     with:
-      branch_ref: ${{ inputs.BRANCH_REF }}
+      BRANCH_REF: ${{ inputs.BRANCH_REF }}
 
-  tests-standard:
-    uses: ./.github/workflows/tests-standard.yml
-    permissions:
-      contents: read
-      pull-requests: write
+  static-analysis:
+    name: Lint
+    uses: ./.github/workflows/static-analysis.yml
     with:
-      branch_ref: ${{ inputs.BRANCH_REF }}
+      BRANCH_REF: ${{ inputs.BRANCH_REF }}
 
-  tests-premium:
-    uses: ./.github/workflows/tests-premium.yml
-    permissions:
-      contents: read
-      pull-requests: write
+  tests:
+    name: Tests
+    uses: ./.github/workflows/tests-unit.yml
     with:
-      branch_ref: ${{ inputs.BRANCH_REF }}
-      environment: Integrate Pull Request # Our dummy environment
+      BRANCH_REF: ${{ inputs.BRANCH_REF }}
     secrets: inherit
 
-  tests-ultimate:
-    uses: ./.github/workflows/tests-ultimate.yml
-    permissions:
-      contents: read
-      pull-requests: write
+  tests-acceptance:
+    name: Acceptance Tests
+    uses: ./.github/workflows/tests-acceptance.yml
     with:
-      branch_ref: ${{ inputs.BRANCH_REF }}
-      environment: Integrate Pull Request # Our dummy environment
+      BRANCH_REF: ${{ inputs.BRANCH_REF }}
+      environment: Integrate Pull Request
     secrets: inherit
 
   analyze:

gitlabform-5.5.6/.github/workflows/prs-entrypoint-forks.yml

@@ -0,0 +1,34 @@
+name: "CI - Fork PRs"
+
+# This workflow handles pull requests from forked repositories.
+# It uses pull_request_target so the reusable CI workflow can receive explicit secrets.
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+  security-events: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+on:
+  pull_request_target:
+    branches:
+      - main
+
+jobs:
+  pr_jobs:
+    name: "Pipeline"
+    # github.event.pull_request object defined here: https://docs.github.com/en/rest/pulls/pulls?apiVersion=2026-03-10#get-a-pull-request
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/pr-ci-workflow.yml
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: write
+      security-events: write
+    with:
+      BRANCH_REF: ${{ github.event.pull_request.head.sha }}
+    secrets: inherit

gitlabform-5.5.6/.github/workflows/prs-entrypoint-main.yml

@@ -0,0 +1,34 @@
+name: "CI - PRs"
+
+# This workflow is the entrypoint for pull requests opened from host repository.
+# Fork PRs are handled by prs-entrypoint-forks.yml using pull_request_target.
+# It forwards the branch SHA and explicit secrets to the reusable workflow.
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  pr_jobs:
+    name: "Pipeline"
+    # github.event.pull_request object defined here: https://docs.github.com/en/rest/pulls/pulls?apiVersion=2026-03-10#get-a-pull-request
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+    uses: ./.github/workflows/pr-ci-workflow.yml
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: write
+      security-events: write
+    with:
+      BRANCH_REF: ${{ github.event.pull_request.head.sha }}
+    secrets: inherit

gitlabform-5.5.6/.github/workflows/static-analysis.yml

@@ -0,0 +1,56 @@
+name: Static Analysis
+
+on:
+  workflow_call:
+    inputs:
+      BRANCH_REF:
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+# This workflow currently covers lockfile verification plus lint-style checks.
+# Bandit is treated here as a lightweight quality/security guardrail, not a full
+# security scanning pipeline. Future security-only workflows can be introduced
+# once heavier security tooling is needed.
+jobs:
+  lockfile-verify:
+    name: Lockfile
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+      - name: Verify that uv.lock is in sync
+        run: uv lock --check
+
+  linting:
+    name: "${{ matrix.check == 'black' && 'Black' || matrix.check == 'mypy' && 'Mypy' || 'Bandit' }}"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        check: [black, mypy, bandit]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group lint
+      - name: Run ${{ matrix.check }}
+        run: |
+          if [ "${{ matrix.check }}" == "black" ]; then
+            uv run --no-sync qa lint black --check .
+          elif [ "${{ matrix.check }}" == "mypy" ]; then
+            uv run --no-sync qa lint mypy .
+          elif [ "${{ matrix.check }}" == "bandit" ]; then
+            uv run --no-sync qa lint bandit .
+          fi

gitlabform-5.5.6/.github/workflows/tests-acceptance.yml

@@ -0,0 +1,91 @@
+name: Acceptance Tests
+
+on:
+  workflow_call:
+    inputs:
+      BRANCH_REF:
+        type: string
+        required: true
+      environment:
+        description: "Environment to run licensed acceptance tests in: 'Integrate Pull Request' for PRs (requires approval) or 'Main Tests' for main/release runs."
+        type: string
+        required: true
+    secrets:
+      GITLAB_EE_LICENSE:
+        required: false
+      GITLAB_EE_ULTIMATE_LICENSE:
+        required: false
+      CODECOV_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+  actions: read # Required by codecov/codecov-action
+
+jobs:
+  acceptance-standard:
+    name: "GitLab ${{ matrix.flavor == 'ce' && 'CE' || 'EE' }}"
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        flavor: [ce, ee]
+      fail-fast: false
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group test
+      - name: Start GitLab (${{ matrix.flavor }}) in docker
+        run: uv run --no-sync gitlab-local up --gitlab-flavor ${{ matrix.flavor }}
+      - name: Run Standard acceptance tests for ${{ matrix.flavor }} flavor
+        run: uv run --no-sync qa test tests/acceptance/standard --cov=. --cov-report=xml --durations=0 --reruns 3 --reruns-delay 10 --log-cli-level=WARNING
+      - name: Upload coverage
+        uses: Wandalen/wretry.action@v3
+        with:
+          action: codecov/codecov-action@v3
+          with: |
+            name: codecov-acceptance-test-standard-${{ matrix.flavor }}
+            flags: integration
+            token: ${{ secrets.CODECOV_TOKEN }}
+          attempt_limit: 5
+          attempt_delay: 10000
+
+  acceptance-licensed:
+    name: "GitLab ${{ matrix.tier == 'premium' && 'Premium' || 'Ultimate' }}"
+    environment: ${{ inputs.environment }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        tier: [premium, ultimate]
+      fail-fast: false
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group test
+      - name: Start GitLab (${{ matrix.tier }}) in docker
+        env:
+          GITLAB_EE_LICENSE: "${{ matrix.tier == 'premium' && secrets.GITLAB_EE_LICENSE || secrets.GITLAB_EE_ULTIMATE_LICENSE }}"
+        run: uv run --no-sync gitlab-local up
+      - name: Run acceptance Tests for ${{ matrix.tier }} features
+        run: uv run --no-sync qa test tests/acceptance/${{ matrix.tier }} --cov=. --cov-report=xml --durations=0 --reruns 3 --reruns-delay 10 --log-cli-level=WARNING
+      - name: Upload coverage
+        uses: Wandalen/wretry.action@v3
+        with:
+          action: codecov/codecov-action@v3
+          with: |
+            name: codecov-acceptance-test-${{ matrix.tier }}
+            flags: integration
+            token: ${{ secrets.CODECOV_TOKEN }}
+          attempt_limit: 5
+          attempt_delay: 10000

gitlabform-5.5.6/.github/workflows/tests-unit.yml

@@ -0,0 +1,49 @@
+name: Unit Tests
+# Reusable workflow for unit tests only.
+
+on:
+  workflow_call:
+    inputs:
+      BRANCH_REF:
+        type: string
+        required: true
+    secrets:
+      CODECOV_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    name: "Unit (${{ matrix.python-version }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.14", "3.12"]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.BRANCH_REF }}
+          fetch-depth: 2
+      - name: Configure uv environment
+        uses: ./.github/actions/setup-uv-local
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: uv sync --frozen --no-dev --group test
+      - name: Run unit tests
+        run: uv run --no-sync qa test tests/unit --cov=. --cov-report=xml --log-cli-level=WARNING
+      - name: Upload coverage to Codecov
+        uses: Wandalen/wretry.action@v3
+        with:
+          action: codecov/codecov-action@v3
+          with: |
+            name: unit-tests-${{ matrix.python-version }}
+            flags: unittests
+            fail_ci_if_error: true
+            token: ${{ secrets.CODECOV_TOKEN }}
+          attempt_limit: 5
+          attempt_delay: 10000