Every PLESTY module uses a standardized CI pipeline defined by the plesty-standard-ci template. This ensures consistent quality checks, security scanning, documentation deployment, and package publishing across all modules.
Pipeline template
The CI pipeline is configured in .gitlab-ci.yml using a single include:
stages:
- check
- security
- deploy
- release
include:
- component: $CI_SERVER_FQDN/plesty/plesty-ci/plesty-standard-ci@exp
inputs:
standard: quantum
extra_branch: exp
access_token: $CI_BOT_TOKENPipeline stages
The pipeline has four stages, each with a distinct color:
| Stage | Color | Jobs |
|---|---|---|
| check | #67e8f9 (cyan) |
Gates 1–11 (except 11, skipped in CI) |
| security | #f59e0b (amber) |
Gate 13 — SAST secret detection |
| deploy | #3b82f6 (blue) |
Gate 12 — docs deploy |
| release | #8b5cf6 (violet) |
Gate 14 — build and publish |
Stage details
Check stage
Runs all quality gates that can execute in CI. Gate 11 (docs build) is skipped because it requires local Sphinx installation.
Security stage
Runs GitLab's SAST secret detection to scan for accidentally committed credentials.
Deploy stage
Deploys Sphinx documentation to GitLab Pages. Requires CI_BOT_TOKEN with read_repository and write_repository scopes.
Release stage
Builds the Python package (sdist + wheel) and publishes to PyPI. This stage only runs when a v* tag is pushed.
Template inputs
| Input | Description |
|---|---|
standard |
Quality standard to enforce (default: quantum) |
extra_branch |
Branch for the CI component (default: exp) |
access_token |
Token for accessing the CI component |
CI_BOT_TOKEN
The CI_BOT_TOKEN is a group-level CI/CD variable. It is:
- Configured at the group level (not per-project)
- Masked and hidden in CI logs
- Protected (only available on protected branches)
- Set with Maintainer role and
read_repository+write_repositoryscopes
Never create a per-project CI_BOT_TOKEN — it would shadow the group token.
Runner image
The pipeline uses PLESTY's own runner image:
registry.gitlab.com/plesty/core/plesty-ci/runner:quantumThis image includes all tools needed to run the quality gates.
Pipeline behavior
- Every push to
exptriggers the full pipeline - Tags (
v*) trigger the release stage - Merge requests trigger the check and security stages
- Schedules can be configured for periodic runs
Next steps
- Publish your module to PyPI
- Review the quality gates in detail