sbx/gitlab-kit:20260909-c987434db5b4b10acfd49da864f0e1724689a198

schemaVersion: "2"
kind: mixin
name: gitlab
displayName: GitLab CLI (glab)
description: Installs the GitLab CLI (glab) with proxy-injected personal access token auth for gitlab.com, so agents can work with GitLab projects the way gh works with GitHub.
agentInstructions:
    content: |
        ## GitLab CLI

        `glab` is installed and authenticated against gitlab.com through the
        sandbox proxy — `GITLAB_TOKEN` is a proxy-managed placeholder, never the
        real token. Use `glab api ...` for arbitrary GitLab REST calls and the
        usual `glab mr` / `glab issue` / `glab repo` subcommands. Verify auth
        with `glab auth status`.

        Git-over-HTTPS push/pull auth is NOT wired up by this kit (the sandbox
        proxy cannot rewrite git's Basic auth on gitlab.com without breaking the
        Bearer auth `glab`/the API rely on — same domain, two schemes). For
        `git clone` / `git push` / `git pull` against GitLab, use SSH remotes
        (`[email protected]:group/project.git`) — add the `gitlab-ssh` kit for
        passwordless host-key verification, and load your key with `ssh-add`
        on the host so it forwards into the sandbox.
permissions:
    network:
        allow:
            - gitlab.com:443
credentials:
    - service: gitlab
      description: GitLab personal access token (api scope). Stored on the host; the sandbox only sees a placeholder and the proxy injects the real value on requests to gitlab.com.
      required: true
      apiKey:
        name: GITLAB_TOKEN
        proxyManaged: true
        inject:
            - domain: gitlab.com
              header: Authorization
              format: Bearer %s
setup:
    install:
        - command: |
            set -euo pipefail
            GLAB_VERSION=1.114.0
            ARCH=$(dpkg --print-architecture)
            case "$ARCH" in
              amd64)
                SHA256="00e892a80d586a1e8b8fdc035321923db99dce0caa3b0c4fd72c5337ffdb1c48"
                ;;
              arm64)
                SHA256="d34d7ddb96ce5e5f3423d7e8053cb14c36bd93984e4b96320f7e20a341b83498"
                ;;
              *)
                echo "unsupported sandbox arch: $ARCH (expected amd64 or arm64)" >&2
                exit 1
                ;;
            esac
            TARBALL="glab_${GLAB_VERSION}_linux_${ARCH}.tar.gz"
            URL="https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/${TARBALL}"
            curl --proto '=https' --tlsv1.2 -fsSL -o /tmp/glab.tgz "$URL"
            echo "${SHA256}  /tmp/glab.tgz" | sha256sum -c -
            tar -C /tmp -xzf /tmp/glab.tgz bin/glab
            install -m 0755 /tmp/bin/glab /usr/local/bin/glab
            rm -rf /tmp/glab.tgz /tmp/bin
            glab --version
          user: "0"
          description: Install glab v1.114.0, version+digest pinned