sbx/gitlab-kit:latest

schemaVersion: "2"
kind: mixin
name: gitlab
displayName: GitLab CLI (glab)
description: Installs the GitLab CLI (glab) with proxy-injected personal access token auth, so agents can work with GitLab projects the way gh works with GitHub. Targets gitlab.com by default and any self-managed instance via the host argument.
args:
    host:
        default: gitlab.com
        description: GitLab instance hostname, e.g. gitlab.example.com for a self-managed instance
        pattern: ^[A-Za-z0-9][A-Za-z0-9.-]*$
    service:
        default: gitlab
        description: Credential service name to bind with `sbx secret set`. Give a self-managed sandbox its own name (e.g. gitlab-acme) so it can hold a different PAT from a gitlab.com sandbox.
        pattern: ^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$
agentInstructions:
    content: |
        ## GitLab CLI

        `glab` is installed and authenticated against ${{ kit.args.host }}
        through the sandbox proxy — `GITLAB_TOKEN` is a proxy-managed
        placeholder, never the real token. Use `glab api ...` for arbitrary
        GitLab REST calls and the usual `glab mr` / `glab issue` / `glab repo`
        subcommands. Verify auth with `glab auth status`.

        Only ${{ kit.args.host }} is authenticated. `GITLAB_TOKEN` holds a
        sentinel the proxy rewrites for that host alone, so a request to any
        other GitLab instance sends the literal sentinel and gets a 401 rather
        than falling back to anonymous access. Nothing secret is exposed by
        this; use a separate sandbox for a different instance.

        Git-over-HTTPS push/pull auth is NOT wired up by this kit (the sandbox
        proxy cannot rewrite git's Basic auth without breaking the Bearer auth
        `glab`/the API rely on — same domain, two schemes). For `git clone` /
        `git push` / `git pull`, use SSH remotes
        (`git@${{ kit.args.host }}:group/project.git`) — add the `gitlab-ssh`
        kit for passwordless host-key verification, and load your key with
        `ssh-add` on the host so it forwards into the sandbox.
permissions:
    network:
        allow:
            - ${{ kit.args.host }}:443
            - gitlab.com:443
credentials:
    - service: ${{ kit.args.service }}
      description: GitLab personal access token (api scope) for the target instance. Stored on the host; the sandbox only sees a placeholder and the proxy injects the real value on requests to that instance.
      required: true
      apiKey:
        name: GITLAB_TOKEN
        proxyManaged: true
        inject:
            - domain: ${{ kit.args.host }}
              header: Authorization
              format: Bearer %s
environment:
    variables:
        GITLAB_HOST: ${{ kit.args.host }}
setup:
    install:
        - command: |
            set -euo pipefail
            GLAB_VERSION=1.118.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64)
                SHA256="f3782ddb62b6ab20d0031699ea7b43f345dc6f63e991883660e21343b9524931"
                ;;
              arm64)
                SHA256="0f6171766dd7f8246b7ce85bab18bd99d57ce2538e0ec9121c48fe004308eac4"
                ;;
              *)
                echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2
                exit 1
                ;;
            esac
            TARBALL="glab_${GLAB_VERSION}_linux_${ARCH}.tar.gz"
            URL="https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/${TARBALL}"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/glab.tgz "$URL"
            echo "${SHA256}  /tmp/glab.tgz" | sha256sum -c -
            tar -C /tmp -xzf /tmp/glab.tgz bin/glab
            install -m 0755 /tmp/bin/glab /usr/local/bin/glab
            rm -rf /tmp/glab.tgz /tmp/bin
            glab --version
          user: "0"
          description: Install glab v1.118.0, version+digest pinned
        - command: |
            set -euo pipefail
            CFG=/home/agent/.config/glab-cli/config.yml
            # install re-runs on recreate: never clobber a config the user has
            # since edited (or that `glab auth login` has written into).
            if [ ! -f "$CFG" ]; then
              install -d -m 0700 -o agent -g agent /home/agent/.config/glab-cli
              cat > "$CFG" <<'EOF'
            hosts:
              ${{ kit.args.host }}:
                api_host: ${{ kit.args.host }}
                api_protocol: https
                git_protocol: ssh
            EOF
              chmod 600 "$CFG"
              chown agent:agent "$CFG"
            fi
          user: "0"
          description: Seed glab's host config so `glab auth status` recognizes the instance