gitlabform 6.2.3__tar.gz → 6.2.4__tar.gz

{gitlabform-6.2.3 → gitlabform-6.2.4}/.github/workflows/pr-ci-workflow.yml

@@ -77,7 +77,7 @@ jobs:
     #   uses: actions/setup-example@v1
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.38.0
+      uses: github/codeql-action/init@v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -89,6 +89,6 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.38.0
+      uses: github/codeql-action/analyze@v4.38.2
       with:
         category: "/language:${{matrix.language}}"

{gitlabform-6.2.3 → gitlabform-6.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gitlabform
-Version: 6.2.3
+Version: 6.2.4
 Summary: 🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML
 Project-URL: Homepage, https://gitlabform.github.io/gitlabform/
 Project-URL: Repository, https://github.com/gitlabform/gitlabform.git

{gitlabform-6.2.3 → gitlabform-6.2.4}/docs/changelog.md

@@ -6,6 +6,22 @@ For details on how to migrate between major versions, please refer to the [upgra
 
 ---
 
+## 6.2.4
+
+### Performance
+
+* skip fetching projects when querying groups [#1436](https://github.com/gitlabform/gitlabform/pull/1436). ([ryanpham-gitlab](https://github.com/ryanpham-gitlab))
+
+### Refactors
+
+* migrate group ldap links processor to python-gitlab [#1428](https://github.com/gitlabform/gitlabform/pull/1428). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
 ## 6.2.3
 
 ### Bug Fixes

{gitlabform-6.2.3 → gitlabform-6.2.4}/gitlabform/gitlab/__init__.py

@@ -7,7 +7,7 @@ from typing import List
 from gitlab import Gitlab as GitlabClient, GraphQL
 
 from gitlabform.gitlab.commits import GitLabCommits
-from gitlabform.gitlab.group_ldap_links import GitLabGroupLDAPLinks
+from gitlabform.gitlab.groups import GitLabGroups
 from gitlabform.gitlab.merge_requests import GitLabMergeRequests
 from gitlabform.gitlab.pipelines import GitLabPipelines
 from gitlabform.gitlab.project_protected_environments import (
@@ -48,8 +48,8 @@ class AccessLevel(enum.IntEnum):
 
 class GitLab(
     GitLabCommits,
+    GitLabGroups,
     GitLabMergeRequests,
-    GitLabGroupLDAPLinks,
     GitLabPipelines,
     GitLabProjectProtectedEnvironments,
     GitLabProjectMergeRequestsApprovals,

{gitlabform-6.2.3 → gitlabform-6.2.4}/gitlabform/gitlab/core.py

@@ -154,7 +154,7 @@ class GitLabCore:
 
     @functools.lru_cache()
     def _get_group_id(self, path) -> int:
-        group = self._make_requests_to_api("groups/%s", path, "GET")
+        group = self._make_requests_to_api("groups/%s?with_projects=false", path, "GET")
         return int(group["id"])
 
     @functools.lru_cache()

{gitlabform-6.2.3 → gitlabform-6.2.4}/gitlabform/gitlab/groups.py

@@ -29,7 +29,7 @@ class GitLabGroups(GitLabCore):
             raise NotFoundException(f"Group/subgroup with path '{some_string}' not found.")
 
     def get_group(self, name):
-        return self._make_requests_to_api("groups/%s", name)
+        return self._make_requests_to_api("groups/%s?with_projects=false", name)
 
     def get_group_descendants(self, group_id_or_path):
         return self._make_requests_to_api("groups/%s/descendant_groups", group_id_or_path)

{gitlabform-6.2.3 → gitlabform-6.2.4}/gitlabform/gitlab/python_gitlab.py

@@ -84,7 +84,7 @@ class PythonGitlab(Gitlab):
 
     @functools.lru_cache()
     def get_group_by_path_cached(self, groupname: str) -> Group:
-        group: Group = self.groups.get(groupname)
+        group: Group = self.groups.get(groupname, with_projects=False)
         if group:
             return group
 

gitlabform-6.2.4/gitlabform/processors/group/group_ldap_links_processor.py

@@ -0,0 +1,106 @@
+from logging import info
+from typing import Dict, List, Optional, Tuple
+
+from gitlab.exceptions import GitlabCreateError, GitlabListError
+from gitlab.v4.objects import Group, GroupLDAPGroupLink
+
+from gitlabform.gitlab import GitLab
+from gitlabform.processors.abstract_processor import AbstractProcessor
+
+# A link is identified by provider + exactly one of (cn, filter).
+DefiningKey = Tuple[Optional[str], Optional[str], Optional[str]]
+
+
+class GroupLDAPLinksProcessor(AbstractProcessor):
+    def __init__(self, gitlab: GitLab):
+        super().__init__("group_ldap_links", gitlab)
+
+    def _process_configuration(self, group_path_and_name: str, configuration: Dict):
+        configured_links: Dict = configuration.get("group_ldap_links", {})
+        enforce = configured_links.pop("enforce", False)
+
+        group: Group = self.gl.get_group_by_path_cached(group_path_and_name)
+        existing_links: List[GroupLDAPGroupLink] = self._list_existing_links(group)
+
+        processed_keys: set = set()
+
+        for entity_name, link_config in configured_links.items():
+            key = self._defining_key_of_config(link_config)
+            matching = next(
+                (link for link in existing_links if self._defining_key_of_link(link) == key),
+                None,
+            )
+
+            if link_config.get("delete", False):
+                if matching:
+                    info(f"Deleting {entity_name} of {self.configuration_name} in {group_path_and_name}")
+                    matching.delete()
+                else:
+                    info(
+                        f"Not deleting {entity_name} of {self.configuration_name} in {group_path_and_name},"
+                        f" because it doesn't exist"
+                    )
+                processed_keys.add(key)
+                continue
+
+            if matching:
+                if self._needs_update(matching.asdict(), link_config):
+                    # The API has no endpoint to update an LDAP link
+                    # (https://docs.gitlab.com/api/group_ldap_links/), so we recreate it.
+                    info(f" * Recreating {entity_name} of {self.configuration_name} in {group_path_and_name}")
+                    matching.delete()
+                    self._create_link(group, link_config)
+                else:
+                    info(
+                        f" * {entity_name} of {self.configuration_name} in {group_path_and_name}"
+                        f" doesn't need an update."
+                    )
+            else:
+                info(f" * Adding {entity_name} of {self.configuration_name} in {group_path_and_name}")
+                self._create_link(group, link_config)
+            processed_keys.add(key)
+
+        if enforce:
+            for existing in existing_links:
+                if self._defining_key_of_link(existing) not in processed_keys:
+                    info(
+                        f"Deleting LDAP link (provider={existing.provider},"
+                        f" cn={getattr(existing, 'cn', None)},"
+                        f" filter={getattr(existing, 'filter', None)})"
+                        f" of {self.configuration_name} in {group_path_and_name}"
+                        f" as it's not in config and enforce is set to true."
+                    )
+                    existing.delete()
+
+    @staticmethod
+    def _list_existing_links(group: Group) -> List[GroupLDAPGroupLink]:
+        # GitLab returns 404 (not an empty list) when a group has no LDAP links configured;
+        # python-gitlab surfaces that as GitlabListError.
+        try:
+            return group.ldap_group_links.list(get_all=True)
+        except GitlabListError as e:
+            if e.response_code == 404:
+                return []
+            raise
+
+    @staticmethod
+    def _create_link(group: Group, link_config: Dict) -> None:
+        try:
+            group.ldap_group_links.create(link_config)
+        except GitlabCreateError as e:
+            # GitLab returns 404 instead of 400 when the create parameters are invalid
+            # (e.g. a non-existent provider), so a 404 here does not mean a missing group.
+            if e.response_code == 404:
+                raise GitlabCreateError(
+                    f"Invalid parameters for an LDAP group link: {link_config}",
+                    response_code=404,
+                ) from e
+            raise
+
+    @staticmethod
+    def _defining_key_of_config(link_config: Dict) -> DefiningKey:
+        return (link_config.get("provider"), link_config.get("cn"), link_config.get("filter"))
+
+    @staticmethod
+    def _defining_key_of_link(link: GroupLDAPGroupLink) -> DefiningKey:
+        return (link.provider, getattr(link, "cn", None), getattr(link, "filter", None))

{gitlabform-6.2.3 → gitlabform-6.2.4}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["gitlabform"]
 
 [project]
 name = "gitlabform"
-version = "6.2.3"
+version = "6.2.4"
 requires-python = ">=3.12.0"
 authors = [{ name = "Greg Dubicki and Contributors" }]
 description = "🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML"

{gitlabform-6.2.3 → gitlabform-6.2.4}/tbump.toml

@@ -2,7 +2,7 @@
 github_url = "https://github.com/gitlabform/gitlabform/"
 
 [version]
-current = "6.2.3"
+current = "6.2.4"
 
 # Example of a semver regexp.
 # Make sure this matches current_version before

{gitlabform-6.2.3 → gitlabform-6.2.4}/tests/acceptance/premium/test_group_ldap_links.py

@@ -120,3 +120,26 @@ class TestGroupLDAPLinks:
         assert ldap_links[0].provider == "LDAP Main"
         assert ldap_links[0].cn == "devops"
         assert ldap_links[0].group_access == AccessLevel.get_value("developer")
+
+    def test__delete_ldap_links(self, gl, group):
+        """Test deleting an LDAP link of a group with 'delete: true'."""
+
+        # Verify group has 1 ldap link - last state of the group in previous test
+        assert len(group.ldap_group_links.list()) == 1
+
+        delete_ldap_link = f"""
+        projects_and_groups:
+          {group.full_path}/*:
+            group_ldap_links:
+              devops_users:
+                provider: LDAP Main
+                cn: devops
+                delete: true
+        """
+        run_gitlabform(delete_ldap_link, group)
+
+        # Verify that the last LDAP link was removed.
+        # GitLab API returns 404 if there are no LDAP links configured.
+        refreshed_group = gl.groups.get(group.id)
+        with pytest.raises(GitlabListError):
+            refreshed_group.ldap_group_links.list(get_all=True)

{gitlabform-6.2.3 → gitlabform-6.2.4}/tests/unit/gitlab/test_core.py

@@ -4,6 +4,20 @@ import pytest
 from unittest.mock import patch, MagicMock
 
 
+def test_get_group_id_excludes_projects():
+    from gitlabform.gitlab.core import GitLabCore
+
+    core = GitLabCore.__new__(GitLabCore)
+    core._make_requests_to_api = MagicMock(return_value={"id": "123"})
+
+    assert core._get_group_id("parent/group") == 123
+    core._make_requests_to_api.assert_called_once_with(
+        "groups/%s?with_projects=false",
+        "parent/group",
+        "GET",
+    )
+
+
 class TestGitLabCoreRetryConfiguration:
     """
     Tests for GitLabCore retry configuration.

gitlabform-6.2.4/tests/unit/gitlab/test_groups.py

@@ -0,0 +1,15 @@
+from unittest.mock import MagicMock
+
+from gitlabform.gitlab.groups import GitLabGroups
+
+
+def test_get_group_excludes_projects():
+    gitlab = GitLabGroups.__new__(GitLabGroups)
+    gitlab._make_requests_to_api = MagicMock(return_value={})
+
+    gitlab.get_group("parent/group")
+
+    gitlab._make_requests_to_api.assert_called_once_with(
+        "groups/%s?with_projects=false",
+        "parent/group",
+    )

{gitlabform-6.2.3 → gitlabform-6.2.4}/tests/unit/gitlab/test_python_gitlab.py

@@ -8,6 +8,14 @@ from unittest.mock import MagicMock, patch
 
 class TestPythonGitlab:
 
+    def test_get_group_by_path_cached_excludes_projects(self):
+        python_gitlab = PythonGitlab(MagicMock())
+        group = MagicMock()
+        python_gitlab.groups.get = MagicMock(return_value=group)
+
+        assert python_gitlab.get_group_by_path_cached("parent/group") is group
+        python_gitlab.groups.get.assert_called_once_with("parent/group", with_projects=False)
+
     def test_get_member_role_id_cached_gets_role_id_from_roles_in_group_on_saas(self):
         group_name = "Test"
         role_name = "custom_role"

gitlabform-6.2.4/tests/unit/processors/test_group_ldap_links_processor.py

@@ -0,0 +1,165 @@
+from unittest.mock import MagicMock, patch
+
+import pytest
+from gitlab.exceptions import GitlabCreateError, GitlabListError
+
+from gitlabform.processors.group.group_ldap_links_processor import GroupLDAPLinksProcessor
+
+
+class TestGroupLDAPLinksProcessor:
+    def setup_method(self):
+        with patch("gitlabform.processors.abstract_processor.GitlabWrapper"):
+            self.processor = GroupLDAPLinksProcessor(MagicMock())
+        self.gl = MagicMock()
+        self.processor.gl = self.gl
+
+    @staticmethod
+    def _link(provider: str = "LDAP Main", cn=None, filter=None, group_access: int = 30) -> MagicMock:
+        link = MagicMock()
+        link.provider = provider
+        link.cn = cn
+        link.filter = filter
+        link.group_access = group_access
+        link.asdict.return_value = {
+            "provider": provider,
+            "cn": cn,
+            "filter": filter,
+            "group_access": group_access,
+        }
+        return link
+
+    def _group(self, *links: MagicMock) -> MagicMock:
+        group = MagicMock()
+        group.ldap_group_links.list.return_value = list(links)
+        self.gl.get_group_by_path_cached.return_value = group
+        return group
+
+    def _process(self, group_ldap_links: dict) -> None:
+        self.processor._process_configuration("test/group", {"group_ldap_links": group_ldap_links})
+
+    # ------------------------------------------------------------------ add
+
+    def test_creates_link_when_missing(self):
+        group = self._group()
+        link_config = {"provider": "LDAP Main", "cn": "devops", "group_access": 40}
+
+        self._process({"devops_users": link_config})
+
+        group.ldap_group_links.create.assert_called_once_with(link_config)
+
+    def test_cn_link_does_not_match_filter_link(self):
+        # provider + cn and provider + filter are different identities
+        existing = self._link(cn="devops")
+        group = self._group(existing)
+        link_config = {"provider": "LDAP Main", "filter": "(devType=security)", "group_access": 30}
+
+        self._process({"security_users": link_config})
+
+        group.ldap_group_links.create.assert_called_once_with(link_config)
+        existing.delete.assert_not_called()
+
+    # --------------------------------------------------------------- update
+
+    def test_recreates_link_when_group_access_changed(self):
+        existing = self._link(cn="devops", group_access=40)
+        group = self._group(existing)
+        link_config = {"provider": "LDAP Main", "cn": "devops", "group_access": 30}
+
+        self._process({"devops_users": link_config})
+
+        # the API has no update endpoint for LDAP links, so it is deleted and added again
+        existing.delete.assert_called_once()
+        group.ldap_group_links.create.assert_called_once_with(link_config)
+
+    def test_no_churn_when_configured_link_matches_existing(self):
+        existing = self._link(cn="devops", group_access=40)
+        group = self._group(existing)
+
+        self._process({"devops_users": {"provider": "LDAP Main", "cn": "devops", "group_access": 40}})
+
+        existing.delete.assert_not_called()
+        group.ldap_group_links.create.assert_not_called()
+
+    # --------------------------------------------------------------- delete
+
+    def test_delete_true_removes_matching_link(self):
+        existing = self._link(cn="devops")
+        group = self._group(existing)
+
+        self._process({"devops_users": {"provider": "LDAP Main", "cn": "devops", "delete": True}})
+
+        existing.delete.assert_called_once()
+        group.ldap_group_links.create.assert_not_called()
+
+    def test_delete_true_on_non_existent_is_logged_and_skipped(self, caplog):
+        group = self._group()
+
+        with caplog.at_level("INFO"):
+            self._process({"devops_users": {"provider": "LDAP Main", "cn": "devops", "delete": True}})
+
+        matching = [r for r in caplog.records if "Not deleting devops_users of group_ldap_links" in r.message]
+        assert len(matching) == 1
+        group.ldap_group_links.create.assert_not_called()
+
+    # -------------------------------------------------------------- enforce
+
+    def test_enforce_deletes_unmanaged_links(self):
+        managed = self._link(cn="devops", group_access=40)
+        stray = self._link(filter="(devType=security)")
+        self._group(managed, stray)
+
+        self._process(
+            {
+                "enforce": True,
+                "devops_users": {"provider": "LDAP Main", "cn": "devops", "group_access": 40},
+            }
+        )
+
+        stray.delete.assert_called_once()
+        managed.delete.assert_not_called()
+
+    def test_without_enforce_unmanaged_links_are_left_alone(self):
+        stray = self._link(cn="stray")
+        self._group(stray)
+
+        self._process({})
+
+        stray.delete.assert_not_called()
+
+    # ------------------------------------------------------- empty list 404
+
+    def test_list_404_is_treated_as_no_links(self):
+        # GitLab returns 404 instead of an empty list when a group has no LDAP links
+        group = self._group()
+        group.ldap_group_links.list.side_effect = GitlabListError("404 Not Found", response_code=404)
+        link_config = {"provider": "LDAP Main", "cn": "devops", "group_access": 40}
+
+        self._process({"devops_users": link_config})
+
+        group.ldap_group_links.create.assert_called_once_with(link_config)
+
+    def test_other_list_error_is_reraised(self):
+        group = self._group()
+        group.ldap_group_links.list.side_effect = GitlabListError("403 Forbidden", response_code=403)
+
+        with pytest.raises(GitlabListError):
+            self._process({"devops_users": {"provider": "LDAP Main", "cn": "devops", "group_access": 40}})
+
+        group.ldap_group_links.create.assert_not_called()
+
+    # -------------------------------------------------------- create errors
+
+    def test_create_404_is_reraised_with_clearer_message(self):
+        # GitLab returns 404 instead of 400 when the create parameters are invalid
+        group = self._group()
+        group.ldap_group_links.create.side_effect = GitlabCreateError("404 Not Found", response_code=404)
+
+        with pytest.raises(GitlabCreateError, match="Invalid parameters"):
+            self._process({"devops_users": {"provider": "nonexistent", "cn": "devops", "group_access": 40}})
+
+    def test_other_create_error_is_reraised_unchanged(self):
+        group = self._group()
+        group.ldap_group_links.create.side_effect = GitlabCreateError("400 Bad Request", response_code=400)
+
+        with pytest.raises(GitlabCreateError, match="400 Bad Request"):
+            self._process({"devops_users": {"provider": "LDAP Main", "cn": "devops", "group_access": 40}})

{gitlabform-6.2.3 → gitlabform-6.2.4}/uv.lock

@@ -555,7 +555,7 @@ wheels = [
 
 [[package]]
 name = "gitlabform"
-version = "6.2.3"
+version = "6.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },
@@ -1939,11 +1939,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
 
 [[package]]

gitlabform-6.2.3/gitlabform/gitlab/group_ldap_links.py

@@ -1,40 +0,0 @@
-from gitlabform.gitlab.core import NotFoundException, InvalidParametersException
-from gitlabform.gitlab.groups import GitLabGroups
-
-
-class GitLabGroupLDAPLinks(GitLabGroups):
-    def get_ldap_group_links(self, group):
-        group_id = self.get_group_id_case_insensitive(group)
-        return self._make_requests_to_api("groups/%s/ldap_group_links", group_id, expected_codes=[200, 404])
-
-    def add_ldap_group_link(self, group, data):
-        group_id = self.get_group_id_case_insensitive(group)
-        data["id"] = group_id
-
-        try:
-            return self._make_requests_to_api(
-                "groups/%s/ldap_group_links",
-                group_id,
-                method="POST",
-                data=data,
-                expected_codes=[200, 201],
-            )
-        # this is a GitLab API bug - it returns 404 here instead of 400 for bad requests...
-        except NotFoundException:
-            raise InvalidParametersException(f"Invalid parameters for a Group LDAP link for group {group}: {data}")
-
-    def delete_ldap_group_link(self, group, data):
-        if "group_access" in data:
-            del data["group_access"]
-
-        group_id = self.get_group_id_case_insensitive(group)
-        data["id"] = group_id
-
-        # 404 means that the LDAP group link is already removed, so let's accept it for idempotency
-        self._make_requests_to_api(
-            "groups/%s/ldap_group_links",
-            group_id,
-            method="DELETE",
-            data=data,
-            expected_codes=[204, 404],
-        )

gitlabform-6.2.3/gitlabform/processors/group/group_ldap_links_processor.py

@@ -1,16 +0,0 @@
-from gitlabform.gitlab import GitLab
-from gitlabform.processors.defining_keys import And, Or, Key, Xor
-from gitlabform.processors.multiple_entities_processor import MultipleEntitiesProcessor
-
-
-class GroupLDAPLinksProcessor(MultipleEntitiesProcessor):
-    def __init__(self, gitlab: GitLab):
-        super().__init__(
-            "group_ldap_links",
-            gitlab,
-            list_method_name="get_ldap_group_links",
-            add_method_name="add_ldap_group_link",
-            delete_method_name="delete_ldap_group_link",
-            defining=And(Key("provider"), Or(Key("cn"), Key("filter"))),
-            required_to_create_or_update=And(Key("provider"), Xor(Key("cn"), Key("filter"))),
-        )