|
| 1 | +# GitLab CLI Workflows for ZCode |
| 2 | + |
| 3 | +[中文文档](./README_CN.md) |
| 4 | + |
| 5 | +This plugin packages the official GitLab CLI (`glab`) Agent Skills for ZCode |
| 6 | +and adds a guided installation and authentication flow. It works with |
| 7 | +GitLab.com, GitLab Dedicated, and GitLab Self-Managed instances supported by |
| 8 | +the locally installed [`glab`](https://docs.gitlab.com/cli/). |
| 9 | + |
| 10 | +## Setup and authentication |
| 11 | + |
| 12 | +- Run `/gitlab:setup [hostname]` to let the agent check the `glab` binary, |
| 13 | + default to the latest stable install/upgrade when it is missing or outdated, |
| 14 | + and guide browser/OAuth login when authentication is missing. |
| 15 | +- Every GitLab-backed skill verifies the hostname, authentication state, and |
| 16 | + active username before running its workflow. |
| 17 | +- Authentication is rechecked after login. The agent must stop if verification |
| 18 | + still fails or if the active account is not the intended identity. |
| 19 | +- The agent never asks the user to paste a token, password, or device code into |
| 20 | + chat. |
| 21 | + |
| 22 | +The plugin does not bundle `glab` or store credentials. When `/gitlab:setup` is |
| 23 | +explicitly invoked, the agent shows the latest-stable install/upgrade command |
| 24 | +before running it; unrelated GitLab workflows never silently replace the |
| 25 | +binary. Environment credentials such as `GITLAB_TOKEN` can override stored |
| 26 | +`glab` credentials; the preflight verifies the effective identity without |
| 27 | +exposing the secret. |
| 28 | + |
| 29 | +## Skills |
| 30 | + |
| 31 | +| Skill | ZCode command | Description | |
| 32 | +|-------|---------------|-------------| |
| 33 | +| setup | `/gitlab:setup [hostname]` | Verify `glab`, guide login, and confirm the active account | |
| 34 | +| glab | `/gitlab:glab` | Official general GitLab CLI workflow and API guidance | |
| 35 | +| glab-stack | `/gitlab:glab-stack` | Official guidance for experimental stacked merge requests | |
| 36 | + |
| 37 | +Natural-language GitLab tasks can also activate the relevant skill without an |
| 38 | +explicit slash command. |
| 39 | + |
| 40 | +## Examples |
| 41 | + |
| 42 | +```text |
| 43 | +/gitlab:setup gitlab.example.com |
| 44 | +/gitlab:glab show merge requests waiting for my review |
| 45 | +/gitlab:glab inspect the failed pipeline for the current branch |
| 46 | +/gitlab:glab-stack show the current stack without opening an interactive UI |
| 47 | +``` |
| 48 | + |
| 49 | +## Compatibility |
| 50 | + |
| 51 | +The official skill sources are pinned in [`UPSTREAM.md`](./UPSTREAM.md). The |
| 52 | +packaged skills do not depend on the newer `glab skills install` command, so |
| 53 | +they work when ZCode can invoke the underlying commands directly. Setup uses |
| 54 | +`glab check-update` dynamically instead of hardcoding a release number. The |
| 55 | +imported command patterns were smoke-tested against `glab 1.93.0`; experimental |
| 56 | +command families must inspect their installed `--help` before execution. |
| 57 | + |
| 58 | +## Safety boundary |
| 59 | + |
| 60 | +This is a prompt/skill layer over the local `glab` executable, not a policy |
| 61 | +sandbox. It never receives or stores GitLab credentials itself. Agents must |
| 62 | +identify the host, project, account, and target before remote-changing |
| 63 | +operations, and must obtain explicit confirmation for destructive actions such |
| 64 | +as merge, delete, unprotect, secret/variable mutation, or token changes. |
| 65 | + |
| 66 | +## ZCode packaging |
| 67 | + |
| 68 | +The installable manifest is `.zcode-plugin/plugin.json`; |
| 69 | +`.claude-plugin/plugin.json` is kept as a compatibility mirror. The marketplace |
| 70 | +entry is maintained in the repository root at [`marketplace.json`](../../marketplace.json). |
| 71 | + |
| 72 | +## License |
| 73 | + |
| 74 | +The imported GitLab CLI skills are MIT licensed. See [`LICENSE`](./LICENSE) and |
| 75 | +[`UPSTREAM.md`](./UPSTREAM.md). |
0 commit comments