sbx/glab-kit:latest

schemaVersion: "2"
kind: mixin
name: glab
displayName: GitLab CLI (glab)
description: Installs the GitLab CLI (glab) with proxy-injected personal access token auth for gitlab.com, so agents can work with GitLab projects the way gh works with GitHub.
agentInstructions:
    content: |
        ## GitLab CLI

        `glab` is installed and authenticated against gitlab.com through the
        sandbox proxy — `GITLAB_TOKEN` is a proxy-managed placeholder, never the
        real token. Use `glab api ...` for arbitrary GitLab REST calls and the
        usual `glab mr` / `glab issue` / `glab repo` subcommands. Verify auth
        with `glab auth status`. Git-over-HTTPS push auth is not wired up by
        this kit; use `glab api` or read-only clones of public repos.
permissions:
    network:
        allow:
            - gitlab.com:443
credentials:
    - service: gitlab
      description: GitLab personal access token (api scope). Stored on the host; the sandbox only sees a placeholder and the proxy injects the real value on requests to gitlab.com.
      required: true
      apiKey:
        name: GITLAB_TOKEN
        proxyManaged: true
        inject:
            - domain: gitlab.com
              header: Authorization
              format: Bearer %s
setup:
    install:
        - command: |
            set -euo pipefail
            GLAB_VERSION=1.114.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64)
                SHA256="00e892a80d586a1e8b8fdc035321923db99dce0caa3b0c4fd72c5337ffdb1c48"
                ;;
              arm64)
                SHA256="d34d7ddb96ce5e5f3423d7e8053cb14c36bd93984e4b96320f7e20a341b83498"
                ;;
              *)
                echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2
                exit 1
                ;;
            esac
            TARBALL="glab_${GLAB_VERSION}_linux_${ARCH}.tar.gz"
            URL="https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/${TARBALL}"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/glab.tgz "$URL"
            echo "${SHA256}  /tmp/glab.tgz" | sha256sum -c -
            tar -C /tmp -xzf /tmp/glab.tgz bin/glab
            install -m 0755 /tmp/bin/glab /usr/local/bin/glab
            rm -rf /tmp/glab.tgz /tmp/bin
            glab --version
          user: "0"
          description: Install glab v1.114.0, version+digest pinned