CI-Only Gates

Gates 12–14 run exclusively in the GitLab CI pipeline. They handle deployment, security scanning, and package publishing — operations that require CI infrastructure and credentials.

Gate 12: Docs Deploy

Deploys documentation to GitLab Pages.

What it does:

• Builds Sphinx documentation
• Deploys to GitLab Pages
• Makes docs available at https://plesty.gitlab.io//

Requirements:

• CI_BOT_TOKEN — a group-level CI/CD variable with read_repository and write_repository scopes
• Maintainer role on the project (the token inherits group Maintainer role)

Why it matters:

Automated documentation deployment ensures users always have access to the latest docs.

Token management:

CI_BOT_TOKEN is configured at the group level (not per-project). Group tokens expire on a schedule tracked in the governance repository:

Never create a per-project CI_BOT_TOKEN — it would shadow the group token and expire separately.

Gate 13: SAST Secret Detection

Runs GitLab's Static Application Security Testing (SAST) secret detection.

What it does:

• Scans the repository for accidentally committed secrets
• Checks for API keys, tokens, passwords, and credentials
• Fails the pipeline if secrets are detected

Why it matters:

Prevents credential leaks that could compromise the project or infrastructure.

Gate 14: Build & Release

Builds the package and publishes to PyPI when a version tag is pushed.

What it does:

• Builds the Python package (sdist + wheel)
• Publishes to PyPI when a v* tag is pushed
• Creates a GitLab release

Trigger:

# Push a version tag to trigger a release
git tag v0.3.0
git push origin v0.3.0

Why it matters:

Automated publishing ensures consistent releases and reduces manual effort.

CI pipeline stages

The CI pipeline is organized into four stages:

stages:
  - check
  - security
  - deploy
  - release

CI template

The CI pipeline is defined using the plesty-standard-ci component:

include:
  - component: $CI_SERVER_FQDN/plesty/plesty-ci/plesty-standard-ci@exp
    inputs:
      standard: quantum
      extra_branch: exp
      access_token: $CI_BOT_TOKEN

Next steps

• Set up the CI pipeline for your module
• Learn about branch discipline
• Publish your module