CI-Only Gates (12–14)

These gates run only in GitLab CI. They are never triggered by plesty check locally. They require project-level secrets (CI_BOT_TOKEN, PYPI_TOKEN) that are not available in a local development environment.

Gate 12 — Docs Deploy

Builds the Sphinx documentation and pushes the output to the docs-build branch. GitLab Pages serves this branch automatically.

Requirements:

• CI_BOT_TOKEN — a group-level CI/CD variable, already inherited by every project in the group. You do not create one per module.
• The docs-build branch is created automatically on first push.

Setup: none. A new module inherits CI_BOT_TOKEN from the group, so the docs-deploy job works out of the box. Do not add a project-level CI_BOT_TOKEN variable — it shadows the group token and expires on its own schedule, which breaks the docs-deploy job (a 403) while every other gate stays green.

Gate 13 — Secret Detection

Runs GitLab SAST (Static Application Security Testing) secret detection to scan for accidentally committed credentials, API keys, and tokens.

This gate runs automatically on every pipeline. It produces no action other than failing the pipeline if a secret pattern is detected. No setup required — it is included in the plesty-standard-ci component.

Tip: If you accidentally commit a secret, rotate it immediately and then rewrite git history to remove the committed value. The pipeline will not pass until the secret is gone from the diff.

Gate 14 — Build & Release

Builds the Python wheel and uploads it to PyPI. This gate is conditional — it only runs when a tag matching v* is pushed.

Requirements:

• PYPI_TOKEN must be set as a masked + protected CI/CD variable
• The tag must match the pattern v* (e.g., v0.2.1)
• plesty check --standard quantum must pass before tagging

Trigger:

git tag v0.2.1
git push origin v0.2.1

The pipeline runs all gates in sequence. Gate 14 only executes if all earlier gates pass. After Gate 14 succeeds, the package appears on PyPI under plesty-==.

The full CI pipeline

stages:
  - check
  - security
  - deploy
  - release

include:
  - component: $CI_SERVER_FQDN/plesty/plesty-ci/plesty-standard-ci@main
    inputs:
      standard: quantum
      extra_branch: exp
      access_token: $CI_BOT_TOKEN