gitlabform 6.2.4__tar.gz → 6.3.1__tar.gz

{gitlabform-6.2.4 → gitlabform-6.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gitlabform
-Version: 6.2.4
+Version: 6.3.1
 Summary: 🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML
 Project-URL: Homepage, https://gitlabform.github.io/gitlabform/
 Project-URL: Repository, https://github.com/gitlabform/gitlabform.git
@@ -19,14 +19,14 @@ Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Version Control :: Git
 Requires-Python: >=3.12.0
-Requires-Dist: certifi==2026.7.22
+Requires-Dist: certifi==2026.10.23
 Requires-Dist: cli-ui==0.19.0
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: luddite==1.0.4
-Requires-Dist: markupsafe==3.0.3
+Requires-Dist: markupsafe==3.0.4
 Requires-Dist: mergedeep==1.3.4
 Requires-Dist: packaging==26.3
-Requires-Dist: python-gitlab[graphql]==8.5.0
+Requires-Dist: python-gitlab[graphql]==8.6.0
 Requires-Dist: requests==2.34.2
 Requires-Dist: rich==15.0.0
 Requires-Dist: ruamel-yaml==0.19.1

{gitlabform-6.2.4 → gitlabform-6.3.1}/docs/changelog.md

@@ -6,6 +6,39 @@ For details on how to migrate between major versions, please refer to the [upgra
 
 ---
 
+## 6.3.1
+
+### Bug Fixes
+
+* keep long configuration values from being wrapped [#1470](https://github.com/gitlabform/gitlabform/pull/1470). ([robertrotaru](https://github.com/robertrotaru))
+
+### Refactors
+
+* migrate merge requests approval rules processor to python-gitlab [#1459](https://github.com/gitlabform/gitlabform/pull/1459). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
+## 6.3.0
+
+### Features
+
+* show diff in dry-run mode for group settings [#1462](https://github.com/gitlabform/gitlabform/pull/1462). ([vetlekise](https://github.com/vetlekise))
+* skip branch protection for non-existent branches [#1457](https://github.com/gitlabform/gitlabform/pull/1457). ([amimas](https://github.com/amimas))
+
+### Refactors
+
+* migrate protected environments processor to python-gitlab [#1438](https://github.com/gitlabform/gitlabform/pull/1438). ([rickbrouwer](https://github.com/rickbrouwer))
+
+### Dependencies
+
+* Update various dependencies to newer versions.
+
+Thanks to all the contributors of this release!
+
 ## 6.2.4
 
 ### Performance

{gitlabform-6.2.4 → gitlabform-6.3.1}/docs/contrib/implementation_design.md

@@ -99,8 +99,8 @@ Sometimes there is some logic in these methods if:
 
 * we only need a specific part of the response from GitLab API - see `GitLabProjects.get_all_projects()` as an example,
 * some GitLab APIs need some workarounds for their bugs or documentation inconsistencies, like:
-    * some APIs declare in the docs that they accept both "group/project" string OR a project id while in fact only the latter works - see `GitLabProjects.post_approvals()` as an example,
-    * some APIs return invalid HTTP error codes, like 404 instead of 400 - see `GitLabGroupLDAPLinks.add_ldap_group_link` as an example.
+    * some APIs declare in the docs that they accept both "group/project" string OR a project id while in fact only the latter works,
+    * some APIs return invalid HTTP error codes, like 404 instead of 400 - see `GroupLDAPLinksProcessor._create_link` as an example.
 
 **Note**: Some of the code here is **NOT used by the GitLabForm app**, but utilized by internal Egnyte
 applications that have not (yet) switched to the more standard `python-gitlab`.

{gitlabform-6.2.4 → gitlabform-6.3.1}/docs/reference/protected_branches.md

@@ -105,6 +105,38 @@ projects_and_groups:
         allow_force_push: true
 ```
 
+### Project only option
+
+This option is only supported for project-level branch protection under `branches`, and is a GitLabForm-specific feature.
+
+GitLab allows creating branch protection even when a branch does not exist. This is useful so that a branch is automatically protected when it matches the configured name. If this is not desired, use a top-level key named `skip_missing_branch: true`. Setting this flag will skip branch protection for a branch when it does not exist.
+
+This is intended for exact branch names only. It does not apply to wildcard patterns such as `release-*`.
+
+- If `strict` mode is enabled, GitLabForm still fails on missing literal branches.
+- If `strict` mode is disabled, GitLabForm skips protecting a missing literal branch and continues.
+
+Example:
+
+```yaml
+projects_and_groups:
+  group_1/project_1:
+    branches:
+      skip_missing_branch: true
+      main:
+        protected: true
+        push_access_level: no access
+        merge_access_level: maintainer
+      branch-that-does-not-exist-yet:  # This will be skipped
+        protected: true
+        push_access_level: no access
+        merge_access_level: maintainer
+      "release-*":
+        protected: true
+        push_access_level: no access
+        merge_access_level: maintainer
+```
+
 ### Premium-only features
 
 !!! info

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/__init__.py

@@ -56,6 +56,7 @@ class GitLabForm:
         noop=False,
         output_file=None,
         recurse_subgroups=True,
+        strict=True,
     ):
         if target and config_string:
             # this mode is basically only for testing
@@ -64,7 +65,7 @@ class GitLabForm:
             self.config_string = config_string
             self.verbose = True
             self.debug = True
-            self.strict = True
+            self.strict = strict
             self.start_from = 1
             self.start_from_group = 1
             self.noop = noop

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/gitlab/__init__.py

@@ -10,12 +10,7 @@ from gitlabform.gitlab.commits import GitLabCommits
 from gitlabform.gitlab.groups import GitLabGroups
 from gitlabform.gitlab.merge_requests import GitLabMergeRequests
 from gitlabform.gitlab.pipelines import GitLabPipelines
-from gitlabform.gitlab.project_protected_environments import (
-    GitLabProjectProtectedEnvironments,
-)
-from gitlabform.gitlab.project_merge_requests_approvals import (
-    GitLabProjectMergeRequestsApprovals,
-)
+from gitlabform.gitlab.projects import GitLabProjects
 from gitlabform.gitlab.python_gitlab import PythonGitlab
 
 
@@ -46,13 +41,13 @@ class AccessLevel(enum.IntEnum):
         return [level.name.lower().replace("_", " ") for level in AccessLevel]
 
 
+# GitLabGroups and GitLabProjects stay as bases until gitlabform/lists/ no longer uses their methods
 class GitLab(
     GitLabCommits,
     GitLabGroups,
     GitLabMergeRequests,
     GitLabPipelines,
-    GitLabProjectProtectedEnvironments,
-    GitLabProjectMergeRequestsApprovals,
+    GitLabProjects,
 ):
     pass
 

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/gitlab/core.py

@@ -157,17 +157,6 @@ class GitLabCore:
         group = self._make_requests_to_api("groups/%s?with_projects=false", path, "GET")
         return int(group["id"])
 
-    @functools.lru_cache()
-    def _get_protected_branch_id(self, project_and_group_name, branch) -> int:
-        branch = self._make_requests_to_api("projects/%s/protected_branches/%s", (project_and_group_name, branch))
-        return int(branch["id"])
-
-    @functools.lru_cache()
-    def _get_project_id(self, project_and_group):
-        # This is a NEW workaround for https://github.com/gitlabhq/gitlabhq/issues/8290
-        result = self.get_project(project_and_group)
-        return str(result["id"])
-
     def _make_requests_to_api(
         self,
         path_as_format_string,

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/processors/group/group_settings_processor.py

@@ -11,6 +11,9 @@ class GroupSettingsProcessor(AbstractProcessor):
     def __init__(self, gitlab: GitLab):
         super().__init__("group_settings", gitlab)
 
+    def _get_current_state(self, group: str) -> dict:
+        return self.gl.get_group_by_path_cached(group).asdict()
+
     def _process_configuration(self, group: str, configuration: Dict):
         configured_group_settings = configuration.get("group_settings", {})
 

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/processors/project/__init__.py

@@ -36,7 +36,7 @@ from gitlabform.processors.project.resource_groups_processor import (
 from gitlabform.processors.project.schedules_processor import SchedulesProcessor
 from gitlabform.processors.project.tags_processor import TagsProcessor
 from gitlabform.processors.project.project_variables_processor import ProjectVariablesProcessor
-from gitlabform.processors.shared.protected_environments_processor import (
+from gitlabform.processors.project.protected_environments_processor import (
     ProtectedEnvironmentsProcessor,
 )
 

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/processors/project/branches_processor.py

@@ -39,8 +39,11 @@ class BranchesProcessor(AbstractProcessor):
         self.custom_diff_analyzers["unprotect_access_levels"] = BranchProtection.naive_access_level_diff_analyzer
 
     def _can_proceed(self, project_or_group: str, configuration: dict):
-        for branch in sorted(configuration["branches"]):
-            branch_config = configuration["branches"][branch]
+        branches_config = dict(configuration.get("branches", {}))
+        branches_config.pop("skip_missing_branch", None)
+
+        for branch in sorted(branches_config):
+            branch_config = branches_config[branch]
             if branch_config.get("protected") is None:
                 critical(f"The Protected key is mandatory in branches configuration, fix {branch} YAML config")
                 sys.exit(EXIT_INVALID_INPUT)
@@ -54,36 +57,51 @@ class BranchesProcessor(AbstractProcessor):
         """
 
         project: Project = self.gl.get_project_by_path_cached(project_and_group)
+        branches_config: dict = dict(configuration["branches"])
+        skip_missing_branch_enabled: bool = branches_config.pop("skip_missing_branch", False)
 
-        for branch in sorted(configuration["branches"]):
-            branch_configuration: dict = self.convert_user_and_group_names_to_ids(configuration["branches"][branch])
-
-            self.process_branch_protection(project, branch, branch_configuration)
+        for branch in sorted(branches_config):
+            self.process_branch_protection(project, branch, branches_config[branch], skip_missing_branch_enabled)
 
-    def process_branch_protection(self, project: Project, branch_name: str, branch_config: dict):
+    def process_branch_protection(
+        self, project: Project, branch_name: str, branch_configuration: dict, skip_if_missing: bool
+    ):
         """
         High-level logic for processing branch protection.
 
         1. Validates branch existence (unless wildcard).
         2. Handles 'protected: false' (unprotecting).
         3. Handles 'protected: true':
-           - If not currently protected: Create protection.
-           - If protected: Update using PATCH (EE > 15.6) or Unprotect/Reprotect (CE/Old EE).
+            - If not currently protected: Create protection.
+            - If protected: Update using PATCH (EE > 15.6) or Unprotect/Reprotect (CE/Old EE).
+        4. Skips protection if the branch does not exist and 'skip_if_missing' is enabled.
+            - This is only applicable for literal branch names, not wildcards.
         """
         protected_branch: Optional[ProjectProtectedBranch] = None
 
         # If protected branch name contains a supported wildcard do not try looking it up
         if not self.branch_name_contains_supported_wildcard(branch_name):
-            # Check branch we are trying to protect actually exists first
+            # Check branch we are trying to protect actually exists first.
+            # When explicitly requested, skip missing literal branches instead of creating
+            # a protection rule for a branch that does not exist yet.
             try:
                 project.branches.get(branch_name)
-            except GitlabGetError:
+            except GitlabGetError as e:
+                if e.response_code != 404:
+                    raise
+
                 message = f"Branch '{branch_name}' not found when processing it to be protected/unprotected!"
                 if self.strict:
                     critical(message)
                     sys.exit(EXIT_INVALID_INPUT)
                 else:
                     warning(message)
+                    if skip_if_missing:
+                        info(
+                            f"Skipping branch protection for '{branch_name}' because the branch does not exist and "
+                            "skip_missing_branch is enabled."
+                        )
+                        return
 
         try:
             protected_branch = project.protectedbranches.get(branch_name)
@@ -91,6 +109,8 @@ class BranchesProcessor(AbstractProcessor):
             message = f"The branch '{branch_name}' is not protected!"
             info(message)
 
+        branch_config: dict = self.convert_user_and_group_names_to_ids(branch_configuration)
+
         if branch_config.get("protected"):
             if not protected_branch:
                 info(f"Creating branch protection for {branch_name}")

gitlabform-6.3.1/gitlabform/processors/project/merge_requests_approval_rules.py

@@ -0,0 +1,158 @@
+import sys
+from logging import critical, info
+from typing import Dict, List
+
+from gitlab.exceptions import GitlabGetError
+from gitlab.v4.objects import Project, ProjectApprovalRule
+
+from gitlabform.constants import EXIT_INVALID_INPUT
+from gitlabform.gitlab import GitLab
+from gitlabform.processors.abstract_processor import AbstractProcessor
+
+
+class MergeRequestsApprovalRules(AbstractProcessor):
+    def __init__(self, gitlab: GitLab):
+        super().__init__("merge_requests_approval_rules", gitlab)
+
+    def _process_configuration(self, project_and_group: str, configuration: Dict):
+        # copy, so that popping "enforce" does not mutate the shared configuration,
+        # which is reused when this method is retried
+        configured_rules: Dict = dict(configuration.get("merge_requests_approval_rules", {}))
+        enforce = configured_rules.pop("enforce", False)
+
+        # Rules are matched against GitLab by name, so entries sharing a name would
+        # reconcile ambiguously; reject them before any changes are made.
+        self._fail_on_duplicate_names(project_and_group, configured_rules)
+
+        project: Project = self.gl.get_project_by_path_cached(project_and_group)
+        existing_rules: List[ProjectApprovalRule] = project.approvalrules.list(get_all=True)
+
+        # Resolve branch names to ids before anything is deleted, so that a bad branch
+        # name in the config fails the section before it can remove existing rules,
+        # and so that each unique branch is fetched only once.
+        protected_branch_ids = self._protected_branch_ids(project, configured_rules)
+
+        if enforce:
+            # Delete stale rules before adding new ones, so that unique-constraint slots
+            # (e.g. only one any_approver rule per project) are freed for the rules below.
+            configured_names = {c.get("name") for c in configured_rules.values() if c.get("name")}
+            for existing in existing_rules:
+                if existing.name not in configured_names:
+                    info(
+                        f"Deleting rule '{existing.name}' of {self.configuration_name} in {project_and_group}"
+                        f" as it's not in config and enforce is set to true."
+                    )
+                    existing.delete()
+            existing_rules = [rule for rule in existing_rules if rule.name in configured_names]
+
+        for entity_name, rule_config in configured_rules.items():
+            name = rule_config.get("name")
+            matching = next((rule for rule in existing_rules if rule.name == name), None)
+
+            if rule_config.get("delete", False):
+                if matching:
+                    info(f"Deleting {entity_name} of {self.configuration_name} in {project_and_group}")
+                    matching.delete()
+                else:
+                    info(
+                        f"Not deleting {entity_name} of {self.configuration_name} in {project_and_group},"
+                        f" because it doesn't exist"
+                    )
+                continue
+
+            if matching:
+                if self._needs_update(matching.asdict(), rule_config):
+                    info(f" * Editing {entity_name} of {self.configuration_name} in {project_and_group}")
+                    project.approvalrules.update(
+                        matching.id, self._payload_for_update(rule_config, protected_branch_ids)
+                    )
+                else:
+                    info(
+                        f" * {entity_name} of {self.configuration_name} in {project_and_group}"
+                        f" doesn't need an update."
+                    )
+            else:
+                info(f" * Adding {entity_name} of {self.configuration_name} in {project_and_group}")
+                project.approvalrules.create(self._payload_for_create(rule_config, protected_branch_ids))
+
+    def _needs_update(self, entity_in_gitlab: Dict, entity_in_configuration: Dict) -> bool:
+        # GitLab returns users/groups as lists of objects and protected_branches as list
+        # of objects with a "name" field, while the config (post-transform) has user_ids /
+        # group_ids as int lists and protected_branches as list of names. Without
+        # normalization the base _needs_update always triggers an update, even when nothing
+        # changed. We normalize both sides unconditionally so keys line up regardless of
+        # whether GitLab omitted an empty list or the user omitted the field in config.
+        gitlab_norm = dict(entity_in_gitlab)
+        gitlab_norm["user_ids"] = sorted(u["id"] for u in gitlab_norm.pop("users", []))
+        gitlab_norm["group_ids"] = sorted(g["id"] for g in gitlab_norm.pop("groups", []))
+        gitlab_protected_branches = gitlab_norm.pop("protected_branches", [])
+
+        # The update payload still sends omitted user_ids/group_ids/protected_branches as
+        # empty lists (old behavior, kept until #1468), so the comparison here has to
+        # mirror what _payload_for_update will send, or a rule would never converge.
+        # "delete" is a gitlabform control key, not a rule attribute.
+        config_norm = dict(entity_in_configuration)
+        config_norm.pop("delete", None)
+        config_norm["user_ids"] = sorted(config_norm.get("user_ids", []))
+        config_norm["group_ids"] = sorted(config_norm.get("group_ids", []))
+
+        # The config can reference branches by name (protected_branches) or directly
+        # by id (protected_branch_ids); compare whichever representation it uses.
+        if "protected_branch_ids" in config_norm:
+            gitlab_norm["protected_branch_ids"] = sorted(b["id"] for b in gitlab_protected_branches)
+            config_norm["protected_branch_ids"] = sorted(config_norm["protected_branch_ids"])
+        if "protected_branch_ids" not in config_norm or "protected_branches" in config_norm:
+            gitlab_norm["protected_branches"] = sorted(b["name"] for b in gitlab_protected_branches)
+            config_norm["protected_branches"] = sorted(config_norm.get("protected_branches", []))
+
+        return super()._needs_update(gitlab_norm, config_norm)
+
+    def _fail_on_duplicate_names(self, project_and_group: str, configured_rules: Dict) -> None:
+        names = [rule_config.get("name") for rule_config in configured_rules.values() if rule_config.get("name")]
+        duplicates = {name for name in names if names.count(name) > 1}
+        if duplicates:
+            critical(
+                f"Entities in {self.configuration_name} for {project_and_group}"
+                f" share the same name(s): {sorted(duplicates)}"
+            )
+            sys.exit(EXIT_INVALID_INPUT)
+
+    @staticmethod
+    def _protected_branch_ids(project: Project, configured_rules: Dict) -> Dict[str, int]:
+        branch_names = {
+            branch_name
+            for rule_config in configured_rules.values()
+            if not rule_config.get("delete", False)
+            for branch_name in rule_config.get("protected_branches", [])
+        }
+        if not branch_names:
+            return {}
+
+        existing = {branch.name: branch.id for branch in project.protectedbranches.list(get_all=True)}
+        missing = branch_names - existing.keys()
+        if missing:
+            raise GitlabGetError(
+                f"Protected branches {sorted(missing)} not found in this project",
+                response_code=404,
+            )
+        return {branch_name: existing[branch_name] for branch_name in branch_names}
+
+    @staticmethod
+    def _payload_for_create(rule_config: Dict, protected_branch_ids: Dict[str, int]) -> Dict:
+        # "delete" is a gitlabform control key and should not be sent to the API
+        payload = {k: v for k, v in rule_config.items() if k != "delete"}
+        if "protected_branches" in payload:
+            # the API expects protected_branch_ids, while the config has branch names
+            branch_names = payload.pop("protected_branches")
+            payload["protected_branch_ids"] = [protected_branch_ids[branch_name] for branch_name in branch_names]
+        return payload
+
+    def _payload_for_update(self, rule_config: Dict, protected_branch_ids: Dict[str, int]) -> Dict:
+        payload = self._payload_for_create(rule_config, protected_branch_ids)
+        # GitLab interprets omitted user_ids/group_ids/protected_branch_ids as "no change",
+        # but the old code sent them as empty lists, clearing them. That behavior is kept
+        # for now; changing it is a breaking change, tracked in #1468.
+        payload.setdefault("user_ids", [])
+        payload.setdefault("group_ids", [])
+        payload.setdefault("protected_branch_ids", [])
+        return payload

gitlabform-6.3.1/gitlabform/processors/project/protected_environments_processor.py

@@ -0,0 +1,68 @@
+from logging import info
+from typing import Dict, List
+
+from gitlab.v4.objects import Project, ProjectProtectedEnvironment
+
+from gitlabform.gitlab import GitLab
+from gitlabform.processors.abstract_processor import AbstractProcessor
+
+
+class ProtectedEnvironmentsProcessor(AbstractProcessor):
+    def __init__(self, gitlab: GitLab):
+        super().__init__("protected_environments", gitlab)
+        # deploy_access_levels is a list of dicts; compare positionally, ignoring keys
+        # that GitLab adds (id, description) but the config doesn't set.
+        self.custom_diff_analyzers["deploy_access_levels"] = self.recursive_diff_analyzer
+
+    def _process_configuration(self, project_and_group: str, configuration: Dict):
+        # copy, so that popping "enforce" does not mutate the shared configuration,
+        # which is reused when this method is retried
+        configured_envs: Dict = dict(configuration.get("protected_environments", {}))
+        enforce = configured_envs.pop("enforce", False)
+
+        project: Project = self.gl.get_project_by_path_cached(project_and_group)
+        existing_envs: List[ProjectProtectedEnvironment] = project.protected_environments.list(get_all=True)
+
+        processed_names: set = set()
+
+        for entity_name, env_config in configured_envs.items():
+            name = env_config["name"]
+            matching = next((env for env in existing_envs if env.name == name), None)
+
+            if env_config.get("delete", False):
+                if matching:
+                    info(f"Deleting {entity_name} of {self.configuration_name} in {project_and_group}")
+                    matching.delete()
+                else:
+                    info(
+                        f"Not deleting {entity_name} of {self.configuration_name} in {project_and_group},"
+                        f" because it doesn't exist"
+                    )
+                processed_names.add(name)
+                continue
+
+            if matching:
+                if self._needs_update(matching.asdict(), env_config):
+                    # The API has an update endpoint (https://docs.gitlab.com/api/protected_environments/),
+                    # but python-gitlab's ProjectProtectedEnvironmentManager doesn't support it, so we recreate.
+                    info(f" * Recreating {entity_name} of {self.configuration_name} in {project_and_group}")
+                    matching.delete()
+                    project.protected_environments.create(env_config)
+                else:
+                    info(
+                        f" * {entity_name} of {self.configuration_name} in {project_and_group}"
+                        f" doesn't need an update."
+                    )
+            else:
+                info(f" * Adding {entity_name} of {self.configuration_name} in {project_and_group}")
+                project.protected_environments.create(env_config)
+            processed_names.add(name)
+
+        if enforce:
+            for existing in existing_envs:
+                if existing.name not in processed_names:
+                    info(
+                        f"Deleting protected environment '{existing.name}' of {self.configuration_name}"
+                        f" in {project_and_group} as it's not in config and enforce is set to true."
+                    )
+                    existing.delete()

{gitlabform-6.2.4 → gitlabform-6.3.1}/gitlabform/util.py

@@ -1,4 +1,5 @@
 import json
+import sys
 from datetime import date
 from io import StringIO
 
@@ -46,6 +47,8 @@ def configure_ruamel_yaml_loader(typ=None, pure=False, output=None, plug_ins=Non
     yaml_loader.indent(mapping=3, sequence=2, offset=0)
     yaml_loader.allow_duplicate_keys = True
     yaml_loader.explicit_start = False
+    # never wrap long scalars: a wrapped double-quoted string that is reloaded can gain spaces after backslash escapes
+    yaml_loader.width = sys.maxsize
     # show null
     yaml_loader.representer.add_representer(
         type(None),

{gitlabform-6.2.4 → gitlabform-6.3.1}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["gitlabform"]
 
 [project]
 name = "gitlabform"
-version = "6.2.4"
+version = "6.3.1"
 requires-python = ">=3.12.0"
 authors = [{ name = "Greg Dubicki and Contributors" }]
 description = "🏗 Specialized configuration as a code tool for GitLab projects, groups and more using hierarchical configuration written in YAML"
@@ -31,14 +31,14 @@ classifiers = [
 
 # Main runtime dependencies. Pinned strictly to ensure production stability.
 dependencies = [
-    "certifi==2026.7.22",
+    "certifi==2026.10.23",
     "cli-ui==0.19.0",
     "jinja2==3.1.6",
     "luddite==1.0.4",
-    "markupsafe==3.0.3",
+    "markupsafe==3.0.4",
     "mergedeep==1.3.4",
     "packaging==26.3",
-    "python-gitlab[graphql]==8.5.0",
+    "python-gitlab[graphql]==8.6.0",
     "requests==2.34.2",
     "rich==15.0.0",
     "ruamel.yaml==0.19.1",
@@ -53,34 +53,34 @@ dev = [
     { include-group = "lint" },
     { include-group = "docs" },
     { include-group = "release" },
-    "commitizen==4.18.0",
-    "prek==0.5.2",
+    "commitizen==4.19.0",
+    "prek==0.5.3",
 ]
 # Minimum set of dependencies required to execute the test suite.
 test = [
-    "coverage==7.16.0",
+    "coverage==7.16.1",
     "cryptography==50.0.1",
     "pytest==9.1.1",
     "pytest-cov==7.1.0",
-    "pytest-rerunfailures==16.6.1",
+    "pytest-rerunfailures==16.7",
     "xkcdpass==1.30.0",
 ]
 # Static analysis and formatting tools.
 lint = [
     "bandit==1.9.4",
-    "black==26.5.1",
+    "black==26.10.1",
     "codespell==2.4.3",
     "mypy==2.3.1",
     "mypy-extensions==1.1.0",
-    "ruff==0.16.5",
-    "types-requests==2.33.0.20260712",
+    "ruff==0.16.9",
+    "types-requests==2.33.0.20260906",
 ]
 # Documentation generation stack.
 docs = [
     "markdown==3.10.3",
-    "zensical==0.0.58",
+    "zensical==0.0.65",
     "pygments==2.21.0",
-    "pymdown-extensions==11.0.2",
+    "pymdown-extensions==12.1",
 ]
 # Tools required for building and verifying releases.
 release = [

{gitlabform-6.2.4 → gitlabform-6.3.1}/tbump.toml

@@ -2,7 +2,7 @@
 github_url = "https://github.com/gitlabform/gitlabform/"
 
 [version]
-current = "6.2.4"
+current = "6.3.1"
 
 # Example of a semver regexp.
 # Make sure this matches current_version before

{gitlabform-6.2.4 → gitlabform-6.3.1}/tests/acceptance/__init__.py

@@ -338,6 +338,7 @@ def run_gitlabform(
     noop: bool = False,
     output_file: Optional[str] = None,
     recurse_subgroups: bool = True,
+    strict: bool = True,
 ) -> None:
     """
     Runs GitLabForm with the given configuration and target.
@@ -362,5 +363,6 @@ def run_gitlabform(
         noop=noop,
         output_file=output_file,
         recurse_subgroups=recurse_subgroups,
+        strict=strict,
     )
     gf.run()