bitrab/.bitrab-ci.yml at main · matthewdeanmartin/bitrab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
# Bitrab quality gate — runs the same checks as the GitHub Actions workflows
# but inside a single container, multithreaded (parallel backend).
# All quality jobs run concurrently in the "test" stage; only pytest depends
# on lint passing first (keeps fast feedback on style errors).

image: python:3.11-slim

variables:
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  UV_LINK_MODE: copy
  UV_PROJECT_ENVIRONMENT: .venv
  UV_CACHE_DIR: .uv
  PACKAGE_DIR: bitrab

stages:
  - setup
  - test
  - security
  - docs
  - build

# Each job declares its real source inputs for `bitrab run --changed`. In a
# monorepo these patterns would point at the service/package owned by the job.

# ---------------------------------------------------------------------------
# SETUP
# ---------------------------------------------------------------------------

install:
  stage: setup
  cache:
    key:
      files:
        - pyproject.toml
        - uv.lock
    paths:
      - .venv/
      - .uv/
      - .cache/
  variables:
    BITRAB_FINGERPRINT_PATHS: "pyproject.toml,uv.lock"
  rules:
    - if: "$CI_PIPELINE_SOURCE != 'local'"
  script: >-
    uv sync --all-extras

# ---------------------------------------------------------------------------
# TEST STAGE  (lint, mypy, precommit run in parallel; pytest waits for lint)
# ---------------------------------------------------------------------------

lint:
  stage: test
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*.py,test/**/*.py,scripts/lint.sh,pyproject.toml"
  script: >-
    ./scripts/lint.sh
  allow_failure: false

mypy:
  stage: test
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*.py,scripts/mypy.sh,pyproject.toml"
  script: >-
    ./scripts/mypy.sh
  allow_failure: false

precommit:
  stage: test
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*,test/**/*,scripts/**/*,docs/**/*,*.toml,*.yml,*.yaml,*.md,Makefile,Justfile"
  script: >-
    ./scripts/precommit.sh
  allow_failure: false

pytest:
  stage: test
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*.py,test/**/*.py,pyproject.toml"
  # parallel everywhere.
  needs: []
  script: >-
    ./scripts/pytest.sh
  artifacts:
    when: always
    reports:
      junit: junit.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
    paths:
      - htmlcov/
      - coverage.xml

# ---------------------------------------------------------------------------
# SECURITY STAGE
# ---------------------------------------------------------------------------

bandit:
  stage: security
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*.py,scripts/bandit.sh,pyproject.toml"
  script: >-
    ./scripts/bandit.sh
  allow_failure: false

# ---------------------------------------------------------------------------
# DOCS STAGE
# ---------------------------------------------------------------------------

check_docs:
  stage: docs
  variables:
    BITRAB_FINGERPRINT_PATHS: "docs/**/*.md,README.md,mkdocs.yml,scripts/check_docs.sh,private_dictionary.txt"
  script: >-
    ./scripts/check_docs.sh
  allow_failure: false

build_docs:
  stage: docs
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*.py,docs/**/*,README.md,mkdocs.yml,scripts/build_docs.sh,pyproject.toml"
  script: >-
    ./scripts/build_docs.sh
  artifacts:
    paths:
      - docs/

# ---------------------------------------------------------------------------
# BUILD STAGE
# ---------------------------------------------------------------------------

build_package:
  stage: build
  variables:
    BITRAB_FINGERPRINT_PATHS: "bitrab/**/*,README.md,LICENSE,pyproject.toml,uv.lock,scripts/build_package.sh"
  script: >-
    ./scripts/build_package.sh
  artifacts:
    paths:
      - dist/