gitlabform 6.0.0__tar.gz → 6.2.0__tar.gz

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/ISSUE_TEMPLATE/bug_report.md

@@ -18,3 +18,14 @@ Output of `gitlabform -V`
 **GitLab version**
 
 F.e. `13.12.4-ee`
+
+**GitLabForm configuration**
+
+The relevant part of your gitlabform config (optionally anonymized).  
+If applicable, share both the before and after config.
+
+**Would you be open to contributing a fix?**
+
+- [ ] Yes
+- [ ] No
+- [ ] Maybe

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/_releases.yml

@@ -37,7 +37,7 @@ jobs:
       target_run_id: ${{ steps.validate.outputs.run_id }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Configure uv environment
         uses: ./.github/actions/setup-uv-local
@@ -83,12 +83,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.prep-release.outputs.semver_tag }}
           fetch-depth: 2
       - name: Download built documentation
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           run-id: ${{ needs.prep-release.outputs.target_run_id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -129,7 +129,7 @@ jobs:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.prep-release.outputs.semver_tag }}
           fetch-depth: 2
@@ -162,7 +162,7 @@ jobs:
       # TODO: In a separate PR, optimize docker image build to consume the built package artifact
       # (package-dist) instead of copying and rebuilding from source if applicable.
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.prep-release.outputs.semver_tag }}
       - name: Docker metadata

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/build.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2
@@ -31,7 +31,7 @@ jobs:
           uv run --no-sync package build
           uv run --no-sync package verify
       - name: Upload package distribution
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: package-dist
           path: dist/*
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2
@@ -54,7 +54,7 @@ jobs:
       - name: Build documentation
         run: uv run --no-sync docs build
       - name: Upload docs site
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: docs-site
           path: site
@@ -70,7 +70,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2

gitlabform-6.2.0/.github/workflows/codecov-upload.yml

@@ -0,0 +1,104 @@
+name: "Codecov Upload"
+
+on:
+  workflow_run:
+    workflows:
+      - "CI - PRs"
+      - "CI - Acceptance Tests"
+    types:
+      - completed
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  upload-unit:
+    name: "Upload unit coverage (${{ matrix.python-version }})"
+    if: ${{ github.event.workflow_run.name == 'CI - PRs' && github.event.workflow_run.event == 'pull_request' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.14", "3.12"]
+    steps:
+      - name: Download coverage artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-${{ matrix.python-version }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+      - name: Read PR metadata
+        id: pr
+        run: |
+          pr=$(jq -r '.pr // empty' pr-info.json)
+          sha=$(jq -r '.sha // empty' pr-info.json)
+          if [[ "$pr" =~ ^[0-9]+$ ]]; then
+            echo "pr=$pr" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ "$sha" =~ ^[a-f0-9]{40}$ ]]; then
+            echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Upload coverage to Codecov
+        uses: Wandalen/wretry.action@v3
+        with:
+          action: codecov/codecov-action@v3
+          with: |
+            name: unit-tests-${{ matrix.python-version }}
+            flags: unittests
+            fail_ci_if_error: true
+            token: ${{ secrets.CODECOV_TOKEN }}
+            files: coverage.xml
+            override_pr: ${{ steps.pr.outputs.pr }}
+            override_commit: ${{ steps.pr.outputs.sha }}
+          attempt_limit: 5
+          attempt_delay: 10000
+
+  upload-acceptance:
+    name: "Upload acceptance coverage (${{ matrix.name }})"
+    if: ${{ github.event.workflow_run.name == 'CI - Acceptance Tests' && github.event.workflow_run.event == 'pull_request_target' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - artifact: coverage-standard-ce
+            name: codecov-acceptance-test-standard-ce
+          - artifact: coverage-standard-ee
+            name: codecov-acceptance-test-standard-ee
+          - artifact: coverage-licensed-premium
+            name: codecov-acceptance-test-premium
+          - artifact: coverage-licensed-ultimate
+            name: codecov-acceptance-test-ultimate
+    steps:
+      - name: Download coverage artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ matrix.artifact }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+      - name: Read PR metadata
+        id: pr
+        run: |
+          pr=$(jq -r '.pr // empty' pr-info.json)
+          sha=$(jq -r '.sha // empty' pr-info.json)
+          if [[ "$pr" =~ ^[0-9]+$ ]]; then
+            echo "pr=$pr" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ "$sha" =~ ^[a-f0-9]{40}$ ]]; then
+            echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Upload coverage to Codecov
+        uses: Wandalen/wretry.action@v3
+        with:
+          action: codecov/codecov-action@v3
+          with: |
+            name: ${{ matrix.name }}
+            flags: integration
+            fail_ci_if_error: true
+            token: ${{ secrets.CODECOV_TOKEN }}
+            files: coverage.xml
+            override_pr: ${{ steps.pr.outputs.pr }}
+            override_commit: ${{ steps.pr.outputs.sha }}
+          attempt_limit: 5
+          attempt_delay: 10000

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/pr-ci-workflow.yml

@@ -1,12 +1,5 @@
 name: "CI - Build · Lint · Tests"
 
-# Reusable workflow containing the actual CI jobs for pull request validation.
-# This file is called by prs-entrypoint.yml and is intentionally separated so that
-# event/routing logic stays in the entrypoint while the CI job set remains reusable.
-
-# This reusable workflow does not receive secrets automatically from the PR event.
-# The caller workflow (prs-entrypoint.yml) must explicitly pass secrets when calling it.
-
 on:
   workflow_call:
     inputs:
@@ -33,15 +26,6 @@ jobs:
     uses: ./.github/workflows/tests-unit.yml
     with:
       BRANCH_REF: ${{ inputs.BRANCH_REF }}
-    secrets: inherit
-
-  tests-acceptance:
-    name: Acceptance Tests
-    uses: ./.github/workflows/tests-acceptance.yml
-    with:
-      BRANCH_REF: ${{ inputs.BRANCH_REF }}
-      environment: Integrate Pull Request
-    secrets: inherit
 
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -82,7 +66,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         ref: ${{ inputs.BRANCH_REF }}
 
@@ -92,7 +76,6 @@ jobs:
     # - name: Setup runtime (example)
     #   uses: actions/setup-example@v1
 
-    # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:
@@ -105,23 +88,6 @@ jobs:
         # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
 
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - name: Run manual build steps
-      if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        echo 'If you are using a "manual" build mode for one or more of the' \
-          'languages you are analyzing, replace this with the commands to build' \
-          'your code, for example:'
-        echo '  make bootstrap'
-        echo '  make release'
-        exit 1
-
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v4
       with:

gitlabform-6.2.0/.github/workflows/prs-entrypoint-forks.yml

@@ -0,0 +1,26 @@
+name: "CI - Acceptance Tests"
+
+permissions:
+  actions: read
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+on:
+  pull_request_target:
+    branches:
+      - main
+
+jobs:
+  tests-acceptance:
+    name: "Acceptance Tests"
+    uses: ./.github/workflows/tests-acceptance.yml
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+    with:
+      BRANCH_REF: ${{ github.event.pull_request.head.sha }}
+      environment: Integrate Pull Request
+    secrets: inherit

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/prs-entrypoint-main.yml

@@ -1,13 +1,8 @@
 name: "CI - PRs"
 
-# This workflow is the entrypoint for pull requests opened from host repository.
-# Fork PRs are handled by prs-entrypoint-forks.yml using pull_request_target.
-# It forwards the branch SHA and explicit secrets to the reusable workflow.
-
 permissions:
   actions: read
   contents: read
-  pull-requests: write
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -20,14 +15,11 @@ on:
 jobs:
   pr_jobs:
     name: "Pipeline"
-    # github.event.pull_request object defined here: https://docs.github.com/en/rest/pulls/pulls?apiVersion=2026-03-10#get-a-pull-request
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     uses: ./.github/workflows/pr-ci-workflow.yml
     permissions:
       actions: read
       contents: read
       packages: read
-      pull-requests: write
       security-events: write
     with:
       BRANCH_REF: ${{ github.event.pull_request.head.sha }}

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/static-analysis.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
       - name: Configure uv environment
@@ -37,7 +37,7 @@ jobs:
         check: [black, mypy, bandit]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/tests-acceptance.yml

@@ -15,12 +15,9 @@ on:
         required: false
       GITLAB_EE_ULTIMATE_LICENSE:
         required: false
-      CODECOV_TOKEN:
-        required: true
 
 permissions:
   contents: read
-  actions: read # Required by codecov/codecov-action
 
 jobs:
   acceptance-standard:
@@ -32,10 +29,11 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2
+          allow-unsafe-pr-checkout: true
       - name: Configure uv environment
         uses: ./.github/actions/setup-uv-local
       - name: Install dependencies
@@ -44,16 +42,21 @@ jobs:
         run: uv run --no-sync gitlab-local up --gitlab-flavor ${{ matrix.flavor }}
       - name: Run Standard acceptance tests for ${{ matrix.flavor }} flavor
         run: uv run --no-sync qa test tests/acceptance/standard --cov=. --cov-report=xml --durations=0 --reruns 3 --reruns-delay 10 --log-cli-level=WARNING
-      - name: Upload coverage
-        uses: Wandalen/wretry.action@v3
+      - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '{"pr": %s, "sha": "%s"}\n' "$PR_NUMBER" "$PR_SHA" > pr-info.json
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v7
         with:
-          action: codecov/codecov-action@v3
-          with: |
-            name: codecov-acceptance-test-standard-${{ matrix.flavor }}
-            flags: integration
-            token: ${{ secrets.CODECOV_TOKEN }}
-          attempt_limit: 5
-          attempt_delay: 10000
+          name: coverage-standard-${{ matrix.flavor }}
+          path: |
+            coverage.xml
+            pr-info.json
+          if-no-files-found: error
+          retention-days: 1
 
   acceptance-licensed:
     name: "GitLab ${{ matrix.tier == 'premium' && 'Premium' || 'Ultimate' }}"
@@ -65,10 +68,11 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2
+          allow-unsafe-pr-checkout: true
       - name: Configure uv environment
         uses: ./.github/actions/setup-uv-local
       - name: Install dependencies
@@ -79,13 +83,18 @@ jobs:
         run: uv run --no-sync gitlab-local up
       - name: Run acceptance Tests for ${{ matrix.tier }} features
         run: uv run --no-sync qa test tests/acceptance/${{ matrix.tier }} --cov=. --cov-report=xml --durations=0 --reruns 3 --reruns-delay 10 --log-cli-level=WARNING
-      - name: Upload coverage
-        uses: Wandalen/wretry.action@v3
+      - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '{"pr": %s, "sha": "%s"}\n' "$PR_NUMBER" "$PR_SHA" > pr-info.json
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v7
         with:
-          action: codecov/codecov-action@v3
-          with: |
-            name: codecov-acceptance-test-${{ matrix.tier }}
-            flags: integration
-            token: ${{ secrets.CODECOV_TOKEN }}
-          attempt_limit: 5
-          attempt_delay: 10000
+          name: coverage-licensed-${{ matrix.tier }}
+          path: |
+            coverage.xml
+            pr-info.json
+          if-no-files-found: error
+          retention-days: 1

{gitlabform-6.0.0 → gitlabform-6.2.0}/.github/workflows/tests-unit.yml

@@ -7,9 +7,6 @@ on:
       BRANCH_REF:
         type: string
         required: true
-    secrets:
-      CODECOV_TOKEN:
-        required: true
 
 permissions:
   contents: read
@@ -24,7 +21,7 @@ jobs:
         python-version: ["3.14", "3.12"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.BRANCH_REF }}
           fetch-depth: 2
@@ -36,14 +33,18 @@ jobs:
         run: uv sync --frozen --no-dev --group test
       - name: Run unit tests
         run: uv run --no-sync qa test tests/unit --cov=. --cov-report=xml --log-cli-level=WARNING
-      - name: Upload coverage to Codecov
-        uses: Wandalen/wretry.action@v3
+      - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '{"pr": %s, "sha": "%s"}\n' "$PR_NUMBER" "$PR_SHA" > pr-info.json
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v7
         with:
-          action: codecov/codecov-action@v3
-          with: |
-            name: unit-tests-${{ matrix.python-version }}
-            flags: unittests
-            fail_ci_if_error: true
-            token: ${{ secrets.CODECOV_TOKEN }}
-          attempt_limit: 5
-          attempt_delay: 10000
+          name: coverage-${{ matrix.python-version }}
+          path: |
+            coverage.xml
+            pr-info.json
+          if-no-files-found: error
+          retention-days: 1

{gitlabform-6.0.0 → gitlabform-6.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlabform
-Version: 6.0.0
+Version: 6.2.0
 Summary: 🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML
 Project-URL: Homepage, https://gitlabform.github.io/gitlabform/
 Project-URL: Repository, https://github.com/gitlabform/gitlabform.git
@@ -19,7 +19,7 @@ Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Version Control :: Git
 Requires-Python: >=3.12.0
-Requires-Dist: certifi==2026.5.20
+Requires-Dist: certifi==2026.6.17
 Requires-Dist: cli-ui==0.19.0
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: luddite==1.0.4

{gitlabform-6.0.0 → gitlabform-6.2.0}/dev/gitlab/gitlab.rb

@@ -1,4 +1,7 @@
 gitlab_rails['initial_root_password']='mK9JnG7jwYdFcBNoQ3W3'
+# Bind nginx on IPv4 and IPv6 loopback. Without IPv6, Sidekiq's mirror sync
+# fails intermittently with ECONNREFUSED when libcurl resolves localhost to ::1.
+nginx['listen_addresses'] = ['0.0.0.0', '[::]']
 registry['enable']=false
 prometheus_monitoring['enable']=false
 gitlab_rails['initial_license_file']='/etc/gitlab/Gitlab.gitlab-license'
@@ -38,4 +41,4 @@ gitlab_rails['omniauth_providers'] = [
            },
     label: 'SAML Login'
   }
-]
+]

{gitlabform-6.0.0 → gitlabform-6.2.0}/docs/changelog.md

@@ -6,6 +6,46 @@ For details on how to migrate between major versions, please refer to the [upgra
 
 ---
 
+## 6.2.0
+
+### Features
+
+* Add support for "Security Manager role" [issue: #1329](https://github.com/gitlabform/gitlabform/issues/1329), [#1342](https://github.com/gitlabform/gitlabform/pull/1342). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Bug Fixes
+
+* don't re-validate inherited config in subgroup lookup [#1318](https://github.com/gitlabform/gitlabform/pull/1318). ([rickbrouwer](https://github.com/rickbrouwer))
+* format group member expiry dates [#1349](https://github.com/gitlabform/gitlabform/pull/1349). ([w3lld1](https://github.com/w3lld1))
+* escape regex as a raw string to prevent errors in loges [#1351](https://github.com/gitlabform/gitlabform/pull/1351). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Documentation
+
+* update license renewal instructions (#1358)[https://github.com/gitlabform/gitlabform/pull/1358]. ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
+## 6.1.0
+
+### Features
+
+* Add wildcard pattern support for project configuration [#1311](https://github.com/gitlabform/gitlabform/pull/1311). ([nikaro](https://github.com/nikaro)) 
+
+### Bug Fixes
+
+* group_saml_links: stop delete-and-recreate churn on unchanged links [#1331](https://github.com/gitlabform/gitlabform/pull/1331). ([rickbrouwer](https://github.com/rickbrouwer))
+* validate key in files config to avoid cryptic KeyError [#1317](https://github.com/gitlabform/gitlabform/pull/1317), resolves [#1312](https://github.com/gitlabform/gitlabform/issues/1312). ([rickbrouwer](https://github.com/rickbrouwer))
+* Normalize GitLab URL while parsing configuration [#1338](https://github.com/gitlabform/gitlabform/pull/1338). ([schurzi](https://github.com/schurzi))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
 ## 6.0.0
 
 ### Breaking Changes

{gitlabform-6.0.0 → gitlabform-6.2.0}/docs/contrib/workflows.md

@@ -16,6 +16,12 @@ only on the main repository.
 
 ## License management
 
-Requesting new Premium/Ultimate Licenses is done via GitLab's Contribution to EE process [here](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributing-to-the-gitlab-enterprise-edition-ee).
+Requesting new Premium/Ultimate Licenses is done via GitLab's Contribution to EE process [here](https://handbook.gitlab.com/handbook/marketing/developer-relations/engineering/community-contributors-workflows/#contributing-to-the-gitlab-enterprise-edition-ee).
 
-As a Maintainer, when you receive a new license key, please add/update it to the GitHub Repository Secrets.
+To request a license, create an issue via the [Wider Community Contributor License Request](https://gitlab.com/gitlab-org/developer-relations/contributor-success/team-task/-/issues/new?issuable_template=contributor_ee_license_request) template, and select 'New Request'. Use the following text in the request:
+
+> As a Maintainer of GitlabForm, I like to requesting new Premium and Ultimate License for https://github.com/gitlabform/gitlabform.
+
+Note that the Premium and Ultimate licenses are sent separately, and there may be some time between receiving them.
+
+As a Maintainer, when you receive a new license key, please add/update it to the GitHub Repository Secrets.

{gitlabform-6.0.0 → gitlabform-6.2.0}/gitlabform/configuration/core.py

@@ -1,3 +1,4 @@
+import fnmatch
 import sys
 from typing import Any
 
@@ -211,6 +212,26 @@ class ConfigurationCore(ABC):
 
         return dict(merged_dict)
 
+    @staticmethod
+    def _get_key_type(a_key: str) -> str:
+        """
+        Classify a config key used under 'projects_and_groups'.
+        """
+        if a_key == "*":
+            return "common"
+        if a_key.endswith("/*"):
+            return "group"
+        if "*" in a_key:
+            return "project_pattern"
+        return "project"
+
+    @staticmethod
+    def _match_pattern(pattern: str, item: str) -> bool:
+        """
+        Case-insensitive fnmatch between pattern and item.
+        """
+        return fnmatch.fnmatchcase(item.lower(), pattern.lower())
+
     @staticmethod
     def _get_case_insensitively(a_dict: dict, a_key: str):
         for dict_key in a_dict.keys():
@@ -231,6 +252,7 @@ class ConfigurationCore(ABC):
             if list_element == item:
                 return True
 
+            # Support for traditional group/* skip pattern
             if (
                 list_element.endswith("/*")
                 and item.startswith(list_element[:-2])
@@ -238,6 +260,10 @@ class ConfigurationCore(ABC):
             ):
                 return True
 
+            # Support for partial wildcard patterns like group/foo-*
+            if "*" in list_element and fnmatch.fnmatchcase(item, list_element):
+                return True
+
         return False
 
     def _find_almost_duplicates(self):