From 2b2a7274cad04c3925ddd404bafbf1d3e4e40a5d Mon Sep 17 00:00:00 2001
From: Deeman <hendriknote@gmail.com>
Date: Fri, 27 Feb 2026 07:47:02 +0100
Subject: [PATCH] fix(ci): always run tests, remove needs:[] so tag waits for
 passing tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two bugs in the previous CI:
- needs: [] on the tag job bypassed stage ordering — tags were created before
  tests finished, defeating the entire pull-based deploy safety guarantee
- changes: rules meant a push to infra/ or docs would skip all tests but still
  create a tag

Now matches the padelnomics pattern: all three test jobs always run on master
and MRs, tag job runs after the test stage completes (stage ordering, no needs).
Also use uv sync --all-packages consistently across all jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitlab/.gitlab-ci.yml | 36 ++++++++++--------------------------
 1 file changed, 10 insertions(+), 26 deletions(-)

diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml
index d7303d0..132028a 100644
--- a/.gitlab/.gitlab-ci.yml
+++ b/.gitlab/.gitlab-ci.yml
@@ -13,68 +13,52 @@ cache:
 
 .uv_setup: &uv_setup
   - curl -LsSf https://astral.sh/uv/install.sh | sh
-  - export PATH="$HOME/.cargo/bin:$PATH"
   - source $HOME/.local/bin/env
 
 workflow:
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    - if: $CI_COMMIT_TAG
 
-# --- Data platform ---
+# ── Tests ─────────────────────────────────────────────────────────────────────
 
 test:cli:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
-    - uv run pytest tests
-  rules:
-    - changes:
-        - src/**/*
-        - tests/**/*
-        - pyproject.toml
+    - uv sync --all-packages
+    - uv run pytest tests/
 
 test:sqlmesh:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
+    - uv sync --all-packages
     - cd transform/sqlmesh_materia && uv run sqlmesh test
-  rules:
-    - changes:
-        - transform/**/*
-
-# --- Web app ---
 
 test:web:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
+    - uv sync --all-packages
     - cd web && uv run pytest tests/ -x -q
     - cd web && uv run ruff check src/ tests/
-  rules:
-    - changes:
-        - web/**/*
 
-# --- Deploy (pull-based via supervisor) ---
-# The on-server supervisor (src/materia/supervisor.py) polls for new tags
-# every 60s and deploys automatically when a new v<N> tag appears.
-# No SSH keys, no deploy credentials needed in CI.
+# ── Tag (pull-based deploy) ───────────────────────────────────────────────────
+# Creates v<N> tag after all tests pass. The on-server supervisor polls for new
+# tags every 60s and deploys automatically. No SSH keys or deploy credentials
+# needed in CI — only the built-in CI_JOB_TOKEN.
 
 tag:
   stage: tag
   image: alpine:latest
-  needs: []
   before_script:
     - apk add --no-cache git
   script:
     - git tag "v${CI_PIPELINE_IID}"
     - git push "https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git" "v${CI_PIPELINE_IID}"
   rules:
-    - if: $CI_COMMIT_BRANCH == "master"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH