gitlabform 6.2.0__tar.gz → 6.2.1__tar.gz

{gitlabform-6.2.0 → gitlabform-6.2.1}/.github/workflows/_releases.yml

@@ -64,17 +64,6 @@ jobs:
           MANUAL_UPSTREAM_RUN_ID: ${{ inputs.override_run_id }}
         run: uv run release gh-workflow-check
 
-  # TODO: Remove this job when all the release jobs have been migrated
-  # to consume build artifacts from Main workflow instead of rebuilding.
-  build-release-artifacts:
-    name: Build release artifacts
-    if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
-    needs:
-      - prep-release
-    uses: ./.github/workflows/build.yml
-    with:
-      BRANCH_REF: ${{ needs.prep-release.outputs.semver_tag }}
-
   publish-docs:
     name: Publish Docs
     if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
@@ -120,7 +109,6 @@ jobs:
     if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
     needs:
       - prep-release
-      - build-release-artifacts
     runs-on: ubuntu-latest
     environment:
       name: pypi
@@ -140,12 +128,13 @@ jobs:
       - name: Setup Python ${{ env.UV_PYTHON }} and install dependencies
         run: |
           uv sync --frozen --no-dev --group release
-      # TODO: In a separate PR, consume the build artifact (package-dist) uploaded
-      # in build-release-artifacts instead of rebuilding and verifying the package here.
-      - name: Build and verify the package
-        run: |
-          uv run --no-sync package build
-          uv run --no-sync package verify
+      - name: Download built package
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ needs.prep-release.outputs.target_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: package-dist
+          path: dist
       - name: Publish to PyPI
         run: |
           uv run --no-sync release pypi
@@ -155,7 +144,6 @@ jobs:
     if: ${{ needs.prep-release.outputs.is_valid_release == 'true' }}
     needs:
       - prep-release
-      - build-release-artifacts
       - publish-to-pypi
     runs-on: ubuntu-latest
     steps:

gitlabform-6.2.1/.python-version

@@ -0,0 +1 @@
+3.14.6

{gitlabform-6.2.0 → gitlabform-6.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlabform
-Version: 6.2.0
+Version: 6.2.1
 Summary: 🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML
 Project-URL: Homepage, https://gitlabform.github.io/gitlabform/
 Project-URL: Repository, https://github.com/gitlabform/gitlabform.git

{gitlabform-6.2.0 → gitlabform-6.2.1}/docs/changelog.md

@@ -6,6 +6,24 @@ For details on how to migrate between major versions, please refer to the [upgra
 
 ---
 
+## 6.2.1
+
+### Bug Fixes
+
+* catch GitlabCreateError and GitlabDeleteError when modifying files on protected branches [#1361](https://github.com/gitlabform/gitlabform/pull/1361). ([haijeploeg](https://github.com/haijeploeg))
+* fix merge_request_approval_rules to stop redundant edit calls on unchanged rules [#1350](https://github.com/gitlabform/gitlabform/pull/1350). ([rickbrouwer](https://github.com/rickbrouwer))
+* use add instead of delete in commit message for new files to reflect what actually happened in commit history [#1363](https://github.com/gitlabform/gitlabform/pull/1363). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Build
+
+* consume package artifact from main workflow in pypi release [#1327](https://github.com/gitlabform/gitlabform/pull/1327). ([amimas](https://github.com/amimas))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
 ## 6.2.0
 
 ### Features

{gitlabform-6.2.0 → gitlabform-6.2.1}/gitlabform/processors/project/files_processor.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from logging import debug, info, warning, critical
 
 from jinja2 import Environment, FileSystemLoader
-from gitlab import GitlabGetError, GitlabUpdateError, GitlabListError
+from gitlab import GitlabCreateError, GitlabDeleteError, GitlabGetError, GitlabListError, GitlabUpdateError
 from gitlab.v4.objects import Project, ProjectFile, ProjectBranch
 from gitlab.base import RESTObject
 
@@ -235,7 +235,7 @@ class FilesProcessor(AbstractProcessor):
                 new_content,
             )
 
-        except GitlabUpdateError as e:
+        except (GitlabUpdateError, GitlabCreateError, GitlabDeleteError) as e:
             if (
                 e.response_code == 400 or e.response_code == 403
             ) and "You are not allowed to push into this branch" in e.error_message:
@@ -302,9 +302,7 @@ class FilesProcessor(AbstractProcessor):
                     "file_path": file_to_operate_on,
                     "branch": branch.name,
                     "content": new_content,
-                    "commit_message": self.get_commit_message_for_file_change(
-                        "delete", file_to_operate_on, configuration
-                    ),
+                    "commit_message": self.get_commit_message_for_file_change("add", file_to_operate_on, configuration),
                 }
             )
         elif operation == "delete" and isinstance(file_to_operate_on, ProjectFile):

gitlabform-6.2.1/gitlabform/processors/project/merge_requests_approval_rules.py

@@ -0,0 +1,38 @@
+from gitlabform.gitlab import GitLab
+from gitlabform.processors.defining_keys import Key, And
+from gitlabform.processors.multiple_entities_processor import MultipleEntitiesProcessor
+
+
+class MergeRequestsApprovalRules(MultipleEntitiesProcessor):
+    def __init__(self, gitlab: GitLab):
+        super().__init__(
+            "merge_requests_approval_rules",
+            gitlab,
+            list_method_name="get_approval_rules",
+            add_method_name="add_approval_rule",
+            edit_method_name="edit_approval_rule",
+            delete_method_name="delete_approval_rule",
+            defining=Key("name"),
+            required_to_create_or_update=And(Key("name"), Key("approvals_required")),
+        )
+
+    def _needs_update(self, entity_in_gitlab: dict, entity_in_configuration: dict) -> bool:
+        # GitLab returns users/groups as lists of objects and protected_branches as list
+        # of objects with a "name" field, while the config (post-transform) has user_ids /
+        # group_ids as int lists and protected_branches as list of names. Without
+        # normalization the base _needs_update always triggers an update, even when nothing
+        # changed. We normalize both sides unconditionally so keys line up regardless of
+        # whether GitLab omitted an empty list or the user omitted the field in config.
+        gitlab_norm = dict(entity_in_gitlab)
+        gitlab_norm["user_ids"] = sorted(u["id"] for u in gitlab_norm.pop("users", []))
+        gitlab_norm["group_ids"] = sorted(g["id"] for g in gitlab_norm.pop("groups", []))
+        gitlab_norm["protected_branches"] = sorted(b["name"] for b in gitlab_norm.get("protected_branches", []))
+
+        # edit_approval_rule treats missing user_ids/group_ids/protected_branches
+        # in config as "clear them", so mirror that here to keep the comparison honest.
+        config_norm = dict(entity_in_configuration)
+        config_norm["user_ids"] = sorted(config_norm.get("user_ids", []))
+        config_norm["group_ids"] = sorted(config_norm.get("group_ids", []))
+        config_norm["protected_branches"] = sorted(config_norm.get("protected_branches", []))
+
+        return super()._needs_update(gitlab_norm, config_norm)

{gitlabform-6.2.0 → gitlabform-6.2.1}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["gitlabform"]
 
 [project]
 name = "gitlabform"
-version = "6.2.0"
+version = "6.2.1"
 requires-python = ">=3.12.0"
 authors = [{ name = "Greg Dubicki and Contributors" }]
 description = "🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML"
@@ -53,12 +53,12 @@ dev = [
     { include-group = "lint" },
     { include-group = "docs" },
     { include-group = "release" },
-    "commitizen==4.16.4",
-    "prek==0.4.9",
+    "commitizen==4.16.5",
+    "prek==0.4.10",
 ]
 # Minimum set of dependencies required to execute the test suite.
 test = [
-    "coverage==7.15.0",
+    "coverage==7.15.2",
     "cryptography==49.0.0",
     "pytest==9.1.1",
     "pytest-cov==7.1.0",
@@ -69,17 +69,17 @@ test = [
 lint = [
     "bandit==1.9.4",
     "black==26.5.1",
-    "codespell==2.4.2",
-    "mypy==2.2.0",
+    "codespell==2.4.3",
+    "mypy==2.3.0",
     "mypy-extensions==1.1.0",
-    "ruff==0.15.21",
+    "ruff==0.15.22",
     "types-requests==2.33.0.20260712",
 ]
 # Documentation generation stack.
 docs = [
     "markdown==3.10.2",
     "mkdocs==1.6.1",
-    "mkdocs-material==9.7.6",
+    "mkdocs-material==9.7.7",
     "mkdocs-material-extensions==1.3.1",
     "pygments==2.20.0",
     "pymdown-extensions==11.0.1",

{gitlabform-6.2.0 → gitlabform-6.2.1}/tbump.toml

@@ -2,7 +2,7 @@
 github_url = "https://github.com/gitlabform/gitlabform/"
 
 [version]
-current = "6.2.0"
+current = "6.2.1"
 
 # Example of a semver regexp.
 # Make sure this matches current_version before
@@ -25,6 +25,7 @@ tag_template = "v{new_version}"
 # tbump.toml location.
 [[file]]
 src = "pyproject.toml"
+search = 'version = "{current_version}"'
 
 # You can specify a list of commands to
 # run after the files have been patched

{gitlabform-6.2.0 → gitlabform-6.2.1}/tests/acceptance/premium/test_merge_request_approval_rules.py

@@ -1,3 +1,5 @@
+import logging
+
 import pytest
 
 from gitlabform.gitlab import AccessLevel
@@ -546,3 +548,54 @@ class TestMergeRequestApprovers:
         coverage_check_approval_rule_details = mr_approval_rules_under_this_project[1]
         assert coverage_check_approval_rule_details.name == "Coverage-Check"
         assert coverage_check_approval_rule_details.approvals_required == 0
+
+    def test__no_churn_when_config_unchanged(
+        self,
+        project_for_function,
+        group_with_one_owner_and_two_developers,
+        make_user,
+        branch_for_function,
+        caplog,
+    ):
+        user1 = make_user(AccessLevel.DEVELOPER, add_to_project=False)
+        project_for_function.members.create({"user_id": user1.id, "access_level": AccessLevel.DEVELOPER.value})
+
+        config = f"""
+            projects_and_groups:
+              {project_for_function.path_with_namespace}:
+                branches:
+                  {branch_for_function}:
+                    protected: true
+                    push_access_level: no access
+                    merge_access_level: developer
+                    unprotect_access_level: maintainer
+                merge_requests_approval_rules:
+                  standard:
+                    approvals_required: 1
+                    name: "Regular approvers"
+                    users:
+                      - {user1.username}
+                  security:
+                    approvals_required: 2
+                    name: "Extra Security Team approval for selected branches"
+                    users:
+                      - {user1.username}
+                    groups:
+                      - {group_with_one_owner_and_two_developers.full_path}
+                    protected_branches:
+                      - {branch_for_function}
+            """
+
+        run_gitlabform(config, project_for_function)
+        assert len(project_for_function.approvalrules.list()) >= 2
+
+        caplog.clear()
+        with caplog.at_level(logging.INFO):
+            run_gitlabform(config, project_for_function)
+
+        assert (
+            "Editing standard of merge_requests_approval_rules" not in caplog.text
+        ), f"Expected no edit for unchanged 'standard' rule, got: {caplog.text}"
+        assert (
+            "Editing security of merge_requests_approval_rules" not in caplog.text
+        ), f"Expected no edit for unchanged 'security' rule, got: {caplog.text}"

{gitlabform-6.2.0 → gitlabform-6.2.1}/tests/acceptance/standard/test_files.py

@@ -177,6 +177,101 @@ class TestFiles:
                 break
         assert is_protected == True
 
+    def test__add_new_file_strongly_protected_branch(self, project, no_access_branch, is_enterprise_edition):
+        """
+        Creating a NEW file (as opposed to modifying an existing one) goes through
+        python-gitlab's files.create(), which raises GitlabCreateError instead of
+        GitlabUpdateError. This test validates that the temporary unprotect/re-protect
+        fallback also works in that case.
+        """
+        protected_branch = project.protectedbranches.get(no_access_branch.name)
+        push_access_level = protected_branch.push_access_levels[0]["access_level"]
+        merge_access_level = protected_branch.merge_access_levels[0]["access_level"]
+
+        # Unprotect access level is not available in GitLab CE.
+        unprotect_access_level_config = ""
+        if is_enterprise_edition:
+            unprotect_access_level = protected_branch.unprotect_access_levels[0]["access_level"]
+            unprotect_access_level_config = f"unprotect_access_level: {unprotect_access_level}"
+
+        add_file_to_protected_branch = f"""
+            projects_and_groups:
+              {project.path_with_namespace}:
+                branches:
+                  {no_access_branch.name}:
+                    protected: true
+                    push_access_level: {push_access_level}
+                    merge_access_level: {merge_access_level}
+                    {unprotect_access_level_config}
+                files:
+                  "newly-created-file.txt":
+                    overwrite: true
+                    branches:
+                      - {no_access_branch.name}
+                    content: "Content of a new file on a strongly protected branch"
+            """
+
+        run_gitlabform(add_file_to_protected_branch, project)
+
+        project_file = project.files.get(ref=no_access_branch.name, file_path="newly-created-file.txt")
+        assert project_file.decode().decode("utf-8") == "Content of a new file on a strongly protected branch"
+
+        branch = project.branches.get(no_access_branch.name)
+        assert branch.commit["message"] == "Automated add made by gitlabform"
+
+        # the file must not exist on main
+        with pytest.raises(GitlabGetError):
+            project.files.get(ref="main", file_path="newly-created-file.txt")
+
+        # check that the branch protection was restored
+        protected_branches = project.protectedbranches.list()
+        assert any(pb.name == no_access_branch.name for pb in protected_branches)
+
+    def test__delete_file_strongly_protected_branch(self, project, no_access_branch, is_enterprise_edition):
+        """
+        Deleting a file goes through python-gitlab's file.delete(), which raises
+        GitlabDeleteError instead of GitlabUpdateError. This test validates that
+        the temporary unprotect/re-protect fallback also works in that case.
+        """
+        protected_branch = project.protectedbranches.get(no_access_branch.name)
+        push_access_level = protected_branch.push_access_levels[0]["access_level"]
+        merge_access_level = protected_branch.merge_access_levels[0]["access_level"]
+
+        # Unprotect access level is not available in GitLab CE.
+        unprotect_access_level_config = ""
+        if is_enterprise_edition:
+            unprotect_access_level = protected_branch.unprotect_access_levels[0]["access_level"]
+            unprotect_access_level_config = f"unprotect_access_level: {unprotect_access_level}"
+
+        delete_file_on_protected_branch = f"""
+            projects_and_groups:
+              {project.path_with_namespace}:
+                branches:
+                  {no_access_branch.name}:
+                    protected: true
+                    push_access_level: {push_access_level}
+                    merge_access_level: {merge_access_level}
+                    {unprotect_access_level_config}
+                files:
+                  "README.md":
+                    branches:
+                      - {no_access_branch.name}
+                    delete: true
+            """
+
+        run_gitlabform(delete_file_on_protected_branch, project)
+
+        with pytest.raises(GitlabGetError):
+            project.files.get(ref=no_access_branch.name, file_path="README.md")
+
+        # the file must still exist on main
+        project_file = project.files.get(ref="main", file_path="README.md")
+        assert project_file.decode().decode("utf-8") == DEFAULT_README
+
+        # check that the branch protection was restored
+        protected_branches = project.protectedbranches.list()
+        assert any(pb.name == no_access_branch.name for pb in protected_branches)
+
     def test__delete_file_protected_branch(self, project, branch):
         set_file_specific_branch = f"""
             projects_and_groups:

{gitlabform-6.2.0 → gitlabform-6.2.1}/tests/acceptance/standard/test_remote_mirrors.py

@@ -754,7 +754,7 @@ class TestRemoteMirrorsProcessor:
 
     def test_remote_mirrors_print_details(
         self,
-        project: Project,
+        project_for_function: Project,
         mirror_urls: Tuple[str, str, str],
         root_username,
         root_access_token,
@@ -764,7 +764,7 @@ class TestRemoteMirrorsProcessor:
         Validates that when print_details is true, the full mirror object
         details are retrieved and printed to the info logs.
         """
-        target_path = project.path_with_namespace
+        target_path = project_for_function.path_with_namespace
         first_url, second_url, _ = mirror_urls
 
         # Normalize URLs as they will appear in the masked logs
@@ -773,7 +773,7 @@ class TestRemoteMirrorsProcessor:
 
         # 1. Setup: Ensure at least one mirror exists manually that is NOT in the config
         # This tests that the report shows the "Final State" of GitLab, not just the config.
-        project.remote_mirrors.create({"url": second_url, "enabled": True, "auth_method": "password"})
+        project_for_function.remote_mirrors.create({"url": second_url, "enabled": True, "auth_method": "password"})
 
         # 2. Run GitLabForm with global print_details: true
         # Config only contains the first mirror

gitlabform-6.2.1/tests/unit/processors/test_merge_requests_approval_rules_processor.py

@@ -0,0 +1,120 @@
+from unittest.mock import MagicMock, patch
+
+from gitlabform.processors.project.merge_requests_approval_rules import MergeRequestsApprovalRules
+
+
+class TestMergeRequestsApprovalRulesProcessor:
+    def setup_method(self):
+        self.gitlab = MagicMock()
+        with patch("gitlabform.processors.abstract_processor.GitlabWrapper"):
+            self.processor = MergeRequestsApprovalRules(self.gitlab)
+
+    @staticmethod
+    def _gitlab_rule(
+        name="standard",
+        approvals_required=1,
+        users=None,
+        groups=None,
+        protected_branches=None,
+        applies_to_all_protected_branches=False,
+        rule_type="regular",
+    ):
+        return {
+            "id": 1,
+            "name": name,
+            "rule_type": rule_type,
+            "report_type": None,
+            "eligible_approvers": [],
+            "approvals_required": approvals_required,
+            "users": users or [],
+            "groups": groups or [],
+            "contains_hidden_groups": False,
+            "protected_branches": protected_branches or [],
+            "applies_to_all_protected_branches": applies_to_all_protected_branches,
+        }
+
+    def test_no_update_when_users_match(self):
+        gitlab_rule = self._gitlab_rule(
+            users=[{"id": 5, "username": "alice"}, {"id": 7, "username": "bob"}],
+        )
+        config = {"name": "standard", "approvals_required": 1, "user_ids": [7, 5]}
+
+        assert self.processor._needs_update(gitlab_rule, config) is False
+
+    def test_no_update_when_groups_match(self):
+        gitlab_rule = self._gitlab_rule(groups=[{"id": 3, "name": "sec"}])
+        config = {"name": "standard", "approvals_required": 1, "group_ids": [3]}
+
+        assert self.processor._needs_update(gitlab_rule, config) is False
+
+    def test_no_update_when_protected_branches_match(self):
+        gitlab_rule = self._gitlab_rule(
+            protected_branches=[
+                {"id": 1, "name": "main"},
+                {"id": 2, "name": "release"},
+            ],
+        )
+        config = {
+            "name": "standard",
+            "approvals_required": 1,
+            "protected_branches": ["release", "main"],
+        }
+
+        assert self.processor._needs_update(gitlab_rule, config) is False
+
+    def test_no_update_when_config_omits_user_ids_and_gitlab_has_no_users(self):
+        gitlab_rule = self._gitlab_rule()
+        config = {"name": "standard", "approvals_required": 1}
+
+        assert self.processor._needs_update(gitlab_rule, config) is False
+
+    def test_no_update_when_gitlab_omits_users_groups_protected_branches_keys(self):
+        gitlab_rule = {
+            "id": 1,
+            "name": "standard",
+            "rule_type": "regular",
+            "approvals_required": 1,
+        }
+        config = {"name": "standard", "approvals_required": 1}
+
+        assert self.processor._needs_update(gitlab_rule, config) is False
+
+    def test_update_when_user_ids_differ(self):
+        gitlab_rule = self._gitlab_rule(users=[{"id": 5, "username": "alice"}])
+        config = {"name": "standard", "approvals_required": 1, "user_ids": [9]}
+
+        assert self.processor._needs_update(gitlab_rule, config) is True
+
+    def test_update_when_config_clears_users_but_gitlab_has_users(self):
+        gitlab_rule = self._gitlab_rule(users=[{"id": 5, "username": "alice"}])
+        config = {"name": "standard", "approvals_required": 1}
+
+        assert self.processor._needs_update(gitlab_rule, config) is True
+
+    def test_update_when_protected_branches_differ(self):
+        gitlab_rule = self._gitlab_rule(
+            protected_branches=[{"id": 1, "name": "main"}],
+        )
+        config = {
+            "name": "standard",
+            "approvals_required": 1,
+            "protected_branches": ["release"],
+        }
+
+        assert self.processor._needs_update(gitlab_rule, config) is True
+
+    def test_update_when_approvals_required_changes(self):
+        gitlab_rule = self._gitlab_rule(approvals_required=1)
+        config = {"name": "standard", "approvals_required": 2}
+
+        assert self.processor._needs_update(gitlab_rule, config) is True
+
+    def test_no_update_for_any_approver_rule(self):
+        gitlab_rule = self._gitlab_rule(rule_type="any_approver", approvals_required=0)
+        config = {
+            "name": "standard",
+            "approvals_required": 0,
+            "rule_type": "any_approver",
+        }
+
+        assert self.processor._needs_update(gitlab_rule, config) is False