Skip to content

feat(gitlab): bring GitLab rhiza_validate to parity with GitHub Actions equivalent #952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(gitlab): bring GitLab rhiza_validate to parity with GitHub Actions equivalent #952

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f35f520
Initial plan
Copilot Mar 29, 2026
9b1493c
Add GitLab CI parity for rhiza_validate: security, pip-audit, typeche…
Copilot Mar 29, 2026
bfb554c
Merge branch 'main' into copilot/add-github-and-gitlab-validation
tschm Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .gitlab-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,22 @@ include:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH

# Semgrep - Static analysis with numpy rules
- local: '.gitlab/workflows/rhiza_semgrep.yml'
rules:
- if: $CI_COMMIT_TAG
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH

# License compliance - Check for copyleft dependencies
- local: '.gitlab/workflows/rhiza_license.yml'
rules:
- if: $CI_COMMIT_TAG
when: never
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH
Comment on lines +55 to +69
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These includes will also apply on scheduled and web pipelines because the rules only check $CI_COMMIT_BRANCH / MR events. The GitHub equivalent skips semgrep/license on schedule and workflow_dispatch, and the new .gitlab/README.md trigger descriptions also omit schedule/manual for these workflows. Consider adding explicit schedule (and possibly web) when: never rules here to avoid running Semgrep/license on scheduled/manual pipelines.

Copilot uses AI. Check for mistakes.

# Quality - Dependency checks, pre-commit hooks, docs coverage, link checking
- local: '.gitlab/workflows/rhiza_quality.yml'
rules:
Expand Down
5 changes: 5 additions & 0 deletions .gitlab/COMPARISON.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ This document provides a side-by-side comparison of GitHub Actions and GitLab CI
| Main Config | `.github/workflows/*.yml` | `.gitlab-ci.yml` + `.gitlab/workflows/*.yml` | ✅ Complete |
| CI Testing | `rhiza_ci.yml` | `rhiza_ci.yml` | ✅ Complete |
| Validation | `rhiza_validate.yml` | `rhiza_validate.yml` | ✅ Complete |
| Semgrep | `rhiza_validate.yml` (semgrep job) | `rhiza_semgrep.yml` | ✅ Complete |
| Security | `rhiza_validate.yml` (security job) | `rhiza_validate.yml` (validate:security job) | ✅ Complete |
| Pip-audit | `rhiza_validate.yml` (pip-audit job) | `rhiza_validate.yml` (validate:pip-audit job) | ✅ Complete |
| Type checking | `rhiza_validate.yml` (typecheck job) | `rhiza_validate.yml` (validate:typecheck job) | ✅ Complete |
| License | `rhiza_validate.yml` (license job) | `rhiza_license.yml` | ✅ Complete |
| Dependencies | `rhiza_deptry.yml` | `rhiza_deptry.yml` | ✅ Complete |
| Pre-commit | `rhiza_pre-commit.yml` | `rhiza_pre-commit.yml` | ✅ Complete |
| Documentation | `rhiza_book.yml` | `rhiza_book.yml` | ✅ Complete |
Expand Down
49 changes: 43 additions & 6 deletions .gitlab/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,10 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun
.gitlab/
├── workflows/
│ ├── rhiza_ci.yml # Continuous Integration - Python matrix testing
│ ├── rhiza_validate.yml # Rhiza configuration validation
│ ├── rhiza_validate.yml # Rhiza configuration validation, security and type checking
│ ├── rhiza_quality.yml # Quality checks (deptry, pre-commit, docs coverage, link check)
│ ├── rhiza_semgrep.yml # Semgrep static analysis (numpy rules)
│ ├── rhiza_license.yml # License compliance scan
│ ├── rhiza_marimo.yml # Marimo notebook execution and artefact publishing
│ ├── rhiza_book.yml # Documentation building (GitLab Pages)
│ ├── rhiza_sync.yml # Template synchronization
Expand Down Expand Up @@ -41,15 +43,19 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun
---

### 2. Validate (`rhiza_validate.yml`)
**Purpose:** Validate Rhiza configuration against template.
**Purpose:** Validate Rhiza configuration against template, run security scans and type checking.

**Trigger:**
- On push to any branch
- On merge requests to main/master
- `pip-audit` job only runs on scheduled pipelines

**Key Features:**
- Runs `make validate`, which fires the full hook chain (`pre-validate`, `rhiza-test`, `uvx rhiza validate .`, `post-validate`)
- Skips validation in the rhiza repository itself (handled internally by `make validate`)
- Runs `make security` (pip-audit + bandit) on push/MR
- Runs `uvx pip-audit` on scheduled pipelines for dependency vulnerability scanning
Comment on lines +51 to +57
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section says the pip-audit job only runs on scheduled pipelines, but .gitlab/workflows/rhiza_validate.yml also enables it on CI_PIPELINE_SOURCE == "web". Either document the manual trigger path here or remove the web rule so the docs match behavior.

Suggested change
- `pip-audit` job only runs on scheduled pipelines
**Key Features:**
- Runs `make validate`, which fires the full hook chain (`pre-validate`, `rhiza-test`, `uvx rhiza validate .`, `post-validate`)
- Skips validation in the rhiza repository itself (handled internally by `make validate`)
- Runs `make security` (pip-audit + bandit) on push/MR
- Runs `uvx pip-audit` on scheduled pipelines for dependency vulnerability scanning
- Dedicated `pip-audit` job runs on scheduled pipelines and manually triggered (`web`) pipelines
**Key Features:**
- Runs `make validate`, which fires the full hook chain (`pre-validate`, `rhiza-test`, `uvx rhiza validate .`, `post-validate`)
- Skips validation in the rhiza repository itself (handled internally by `make validate`)
- Runs `make security` (pip-audit + bandit) on push/MR
- Runs `uvx pip-audit` on scheduled and manually triggered (`web`) pipelines for dependency vulnerability scanning

Copilot uses AI. Check for mistakes.
- Runs `make typecheck` (ty type checker) on push/MR

**Equivalent GitHub Action:** `.github/workflows/rhiza_validate.yml`

Expand All @@ -72,7 +78,38 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun

---

### 4. Marimo (`rhiza_marimo.yml`)
### 4. Semgrep (`rhiza_semgrep.yml`)
**Purpose:** Run static analysis using Semgrep with local numpy rules to detect common NumPy-related bugs and security issues.

**Trigger:**
- On push to any branch
- On merge requests to main/master

**Key Features:**
- Runs `make semgrep` using `.rhiza/semgrep.yml` local rules
- Skips if `SOURCE_FOLDER` is not found

**Equivalent GitHub Action:** `.github/workflows/rhiza_validate.yml` (semgrep job)

---

### 5. License (`rhiza_license.yml`)
**Purpose:** Check that no copyleft-licensed dependencies (GPL, LGPL, AGPL) have been introduced via transitive updates.

**Trigger:**
- On push to any branch
- On merge requests to main/master

**Key Features:**
- Runs `make license` to fail on forbidden licenses
- Generates `LICENSES.md` markdown report of all dependency licenses
- Publishes `LICENSES.md` as a GitLab CI artifact (retained 30 days)

**Equivalent GitHub Action:** `.github/workflows/rhiza_validate.yml` (license job)

---

### 6. Marimo (`rhiza_marimo.yml`)
**Purpose:** Discover and execute all Marimo notebooks in the repository, publishing results as artefacts.

**Trigger:**
Expand All @@ -90,7 +127,7 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun

---

### 5. Book (`rhiza_book.yml`)
### 7. Book (`rhiza_book.yml`)
**Purpose:** Build and deploy documentation to GitLab Pages.

**Trigger:**
Expand All @@ -107,7 +144,7 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun

---

### 6. Sync (`rhiza_sync.yml`)
### 8. Sync (`rhiza_sync.yml`)
**Purpose:** Synchronize repository with its template.

**Trigger:**
Expand All @@ -126,7 +163,7 @@ This directory contains GitLab CI/CD workflow configurations that mirror the fun

---

### 7. Release (`rhiza_release.yml`)
### 9. Release (`rhiza_release.yml`)
**Purpose:** Create releases and publish packages to PyPI.

**Trigger:**
Expand Down
9 changes: 9 additions & 0 deletions .gitlab/workflows/rhiza_license.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,17 @@ license:check:
stage: test
needs: []
image: ghcr.io/astral-sh/uv:0.9.30-bookworm
variables:
UV_EXTRA_INDEX_URL: "${UV_EXTRA_INDEX_URL}"
script:
- make license
- uv run --with pip-licenses pip-licenses --format markdown --output-file LICENSES.md
artifacts:
name: LICENSES.md
paths:
- LICENSES.md
when: always
expire_in: 30 days
rules:
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow's rules allow it to run on scheduled (and web) pipelines via $CI_COMMIT_BRANCH. The GitHub license job is skipped on schedule and workflow_dispatch; if parity is desired, add explicit skip rules for CI_PIPELINE_SOURCE == "schedule" (and likely "web") here, or update the documentation/parity claims accordingly.

Suggested change
rules:
rules:
- if: '$CI_PIPELINE_SOURCE == "schedule"'
when: never
- if: '$CI_PIPELINE_SOURCE == "web"'
when: never

Copilot uses AI. Check for mistakes.
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH
46 changes: 44 additions & 2 deletions .gitlab/workflows/rhiza_validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,13 @@
#
# Workflow: Rhiza Validate (GitLab CI)
#
# Purpose: Validates Rhiza configuration
# Purpose: Validates Rhiza configuration, runs security scans, type checking,
# and scheduled dependency vulnerability audits.
#
# Trigger: This workflow runs on every push and on merge requests to main/master
# Trigger: This workflow runs on every push and on merge requests to main/master.
# pip-audit runs only on scheduled pipelines.
#
Comment on lines +10 to +11
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The header comment says pip-audit runs only on scheduled pipelines, but the job rules also allow running on CI_PIPELINE_SOURCE == "web". Either remove the web rule or update the comment to reflect that pip-audit can be run from manually-triggered (web) pipelines too.

Suggested change
# pip-audit runs only on scheduled pipelines.
#
# pip-audit runs on scheduled pipelines and on manually-triggered
# (web) pipelines.

Copilot uses AI. Check for mistakes.
# Equivalent GitHub Action: .github/workflows/rhiza_validate.yml

validate:rhiza:
stage: test
Expand All @@ -16,3 +20,41 @@ validate:rhiza:
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH

validate:security:
stage: test
needs: []
image: ghcr.io/astral-sh/uv:0.9.30-bookworm
variables:
UV_EXTRA_INDEX_URL: "${UV_EXTRA_INDEX_URL}"
script:
- make security
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"
when: never
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For parity with the GitHub Actions workflow, validate:security currently skips scheduled pipelines but still runs on CI_PIPELINE_SOURCE == "web" (manual runs). In GitHub, the security job is explicitly skipped on workflow_dispatch. If parity is the goal, add a web skip rule here (or update the parity/docs statement accordingly).

Suggested change
when: never
when: never
- if: $CI_PIPELINE_SOURCE == "web"
when: never

Copilot uses AI. Check for mistakes.
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH

validate:pip-audit:
stage: test
needs: []
image: ghcr.io/astral-sh/uv:0.9.30-bookworm
script:
- uvx pip-audit
Comment on lines +42 to +43
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validate:pip-audit runs uvx pip-audit without the CVE ignore that make security applies (Makefile security target passes --ignore-vuln CVE-2026-4539). This will make the scheduled/manual audit behave differently from the security job and may cause the audit job to fail when the security job passes. Consider invoking the same shared configuration (e.g., a make target or the same ignore flags) here.

Suggested change
script:
- uvx pip-audit
variables:
UV_EXTRA_INDEX_URL: "${UV_EXTRA_INDEX_URL}"
script:
- make security

Copilot uses AI. Check for mistakes.
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"
- if: $CI_PIPELINE_SOURCE == "web"

validate:typecheck:
stage: test
needs: []
image: ghcr.io/astral-sh/uv:0.9.30-bookworm
variables:
UV_EXTRA_INDEX_URL: "${UV_EXTRA_INDEX_URL}"
script:
- make typecheck
rules:
- if: $CI_PIPELINE_SOURCE == "schedule"
when: never
Copy link

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For parity with the GitHub Actions workflow, validate:typecheck currently skips scheduled pipelines but still runs on CI_PIPELINE_SOURCE == "web" (manual runs). In GitHub, the typecheck job is skipped on workflow_dispatch. If parity is the goal, add a web skip rule here (or update the parity/docs statement accordingly).

Suggested change
when: never
when: never
- if: $CI_PIPELINE_SOURCE == "web"
when: never

Copilot uses AI. Check for mistakes.
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH
Loading