gitlab-labkit 5.6.1 → 5.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1ef319c707c40ea0cca46358bbacdf18d1068b8f2b778ebc1a1486c33cea1ef
-  data.tar.gz: 5cbead469ab098d29afb9dcf2dd97576976a703db93eda7ea337a54bc94fcde9
+  metadata.gz: f2d9d587afe49d99a2ada5a8757230d69024a1085009f1e65c29ac97aa005e98
+  data.tar.gz: 35e55c1e1f9aef6836736e6917cffe4813aa37655eebf5534893f9b7b232fb89
 SHA512:
-  metadata.gz: 1488c581703cab14db63d485aa2ef3159d8a0cd8449cc34b4aeeb522d97ad2207edb57096f388240cff213ef44aaa925a8219a2464b3ab4054a81b0e8569129a
-  data.tar.gz: 4c65d98b9b29084a3c5bdc7e0d9dc166a4708f203840a08180421172f21c0356005641557e46dc14f48fb277570f4bdae041d61072c454dbdfa252e4e8baf5fd
+  metadata.gz: 83a9378e749aa4c04cf05cca872fffabe8945802b169c996aba579b43b73e582d98dca6c37b31c82098fe3edda41932ddc81813010ab278e2df7569812c7926e
+  data.tar.gz: 5b00ebd19184fbfaec05c1cdf40de93b74a70c0a7aa2b167213425debada2ea6708b61874d4ad23a9de40c950724b47da599d37daf0116d323ed8b4db76a6d23

data/.claude/hooks/precommit-validate.sh

@@ -5,6 +5,7 @@
 # touched. On failure it prints the output to stderr and exits 2, which feeds the
 # result back to Claude so it can fix the issue. A clean run exits 0 silently.
 set -euo pipefail
+IFS=$'\n\t'
 
 # no-commit-to-branch guards the branch, not file content, and would fire
 # spuriously (e.g. on jj's detached HEAD). It is irrelevant to file validation.

data/.copier-answers.yml

@@ -3,7 +3,7 @@
 # See the project for instructions on how to update the project
 #
 # Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_commit: v1.85.0
+_commit: v1.87.1
 _src_path: https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git
 ee_licensed: false
 gitlab_namespace: gitlab-org/ruby/gems

data/.gitlab/CODEOWNERS

@@ -1 +1 @@
-* @reprazent @mkaeppler @ayufan @hmerscher @sankalp_gl @hardikgala @nindurkar @ashs2
+* @mkaeppler @ayufan @hmerscher @sankalp_gl @hardikgala @nindurkar @ashs2

data/.gitlab-ci.yml

@@ -19,13 +19,27 @@ include:
   # It includes standard checks, gitlab-scanners, validations and release processes
   # common to all projects using this template library.
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/standard.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v5.24
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v5.46
 
   # Runs rspec tests and rubocop on the project
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/ruby.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v5.24
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v5.46
 
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v5.24
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v5.46
+
+# danger-review reads its token from Vault, which the community fork has no
+# access to, so it fails on merge requests from the fork. Let it fail for those;
+# the second rule is the component's own. See
+# https://gitlab.com/gitlab-org/labkit/-/work_items/171
+danger-review:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_PATH == "gitlab-community/gitlab-org/ruby/gems/labkit-ruby"
+      exists:
+        - Dangerfile
+      allow_failure: true
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      exists:
+        - Dangerfile
 
 # Attach a redis service to the rspec job from common-ci-tasks/ruby-build.
 # GitLab merges keys when a local job has the same name as an included one,

data/.opencode/plugins/precommit-validate.ts

@@ -1,4 +1,6 @@
-import type { Plugin, Hooks } from "@opencode-ai/plugin";
+import type { Hooks, PluginModule } from "@opencode-ai/plugin";
+import type { Plugin } from "@opencode/plugin";
+import { execFile, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 
@@ -22,80 +24,203 @@ import { isAbsolute, join, resolve } from "node:path";
  *
  * The script is reused verbatim: it reads Claude Code's PostToolUse payload on
  * stdin (`{ "tool_input": { "file_path": "..." } }`), so we synthesize that same
- * shape here from OpenCode's tool arguments.
+ * shape here from OpenCode's tool input.
+ *
+ * Supports both plugin APIs from one default export, as described in
+ * https://opencode.ai/v2/docs/build/plugins/migrate-v1:
+ *   - OpenCode 2 reads `id` and `setup()` (the `@opencode/plugin` API).
+ *   - OpenCode 1 (>= 1.18.29) calls `server()` (the `@opencode-ai/plugin` API).
+ * Both imports are type-only, so neither OpenCode version needs the other's
+ * plugin package installed at runtime. Remove `server()` once V1 is gone.
  *
  * Auto-loaded from `.opencode/plugins/`.
  */
 
-// OpenCode file-mutating tools, analogous to Claude Code's `Edit|Write|MultiEdit`
-// matcher. Current OpenCode may use `apply_patch` for file edits.
-const FILE_TOOLS = new Set(["apply_patch", "edit", "write"]);
+const ID = "precommit-validate";
 
 const HOOK_SCRIPT = ".claude/hooks/precommit-validate.sh";
 
-export const PrecommitValidatePlugin: Plugin = async ({ $, client, directory, worktree }) => {
-  const root = worktree || directory;
-  const script = join(root, HOOK_SCRIPT);
+// OpenCode file-mutating tools, analogous to Claude Code's `Edit|Write|MultiEdit`
+// matcher. V1 and V2 both have `edit` and `write`; patches go through
+// `apply_patch` in V1 and `patch` in V2.
+const FILE_TOOLS = new Set(["apply_patch", "edit", "patch", "write"]);
 
-  const hooks: Hooks = {
-    "tool.execute.after": async (input, output) => {
-      if (!FILE_TOOLS.has(input.tool)) return;
-      // Inert when the shared script is absent (e.g. loaded in another repo).
-      if (!existsSync(script)) return;
+interface HookResult {
+  /** Exit code 2: pre-commit findings to feed back to the model. */
+  readonly reports: string[];
+  /** Any other failure: environment problems to log for the user. */
+  readonly warnings: string[];
+}
 
-      const filePaths = new Set<string>();
-      const filePath: string | undefined = input.args?.filePath;
-      if (filePath) filePaths.add(filePath);
+const asRecord = (value: unknown): Record<string, unknown> =>
+  value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : {};
 
-      for (const file of output.metadata?.files ?? []) {
-        if (typeof file.filePath === "string") filePaths.add(file.filePath);
-      }
+const asString = (value: unknown): string | undefined => (typeof value === "string" && value ? value : undefined);
 
+/**
+ * Collect the files a tool call touched from its input and result metadata.
+ *
+ * Input: V2 `edit`/`write` take `path`; V1 takes `filePath`.
+ * Metadata: `files` entries carry `file` in V2 and `filePath` in V1. This is
+ * the only source for patch tools, whose input is a single `patchText` blob.
+ */
+function touchedFiles(input: unknown, metadata: unknown): Set<string> {
+  const args = asRecord(input);
+  const files = new Set<string>();
+
+  const direct = asString(args.path) ?? asString(args.filePath);
+  if (direct) files.add(direct);
+
+  const entries = asRecord(metadata).files;
+  for (const entry of Array.isArray(entries) ? entries : []) {
+    const file = asRecord(entry);
+    // A deleted file has nothing left to validate.
+    if (file.status === "deleted" || file.type === "delete") continue;
+    const path = asString(file.file) ?? asString(file.filePath);
+    if (path) files.add(path);
+  }
+
+  return files;
+}
+
+/** Run the shared hook script for one file, feeding the payload on stdin. */
+function runHookScript(
+  script: string,
+  root: string,
+  payload: string,
+  signal?: AbortSignal,
+): Promise<{ code: number | null; stdout: string; stderr: string }> {
+  return new Promise((done, fail) => {
+    const child = spawn(script, [], { cwd: root, signal, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8").on("data", (chunk: string) => (stdout += chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk: string) => (stderr += chunk));
+    // The script exits early (e.g. mise missing) without reading stdin.
+    child.stdin.on("error", () => {});
+    child.on("error", fail);
+    child.on("close", (code) => done({ code, stdout, stderr }));
+    child.stdin.end(payload);
+  });
+}
+
+/** Validate every touched file and sort the outcomes into reports and warnings. */
+async function validate(root: string, filePaths: Iterable<string>, signal?: AbortSignal): Promise<HookResult> {
+  const result: HookResult = { reports: [], warnings: [] };
+  const script = join(root, HOOK_SCRIPT);
+  // Inert when the shared script is absent (e.g. loaded in another repo).
+  if (!existsSync(script)) return result;
+
+  for (const filePath of filePaths) {
+    if (signal?.aborted) break;
+    const absolute = isAbsolute(filePath) ? filePath : resolve(root, filePath);
+
+    // Same JSON shape Claude Code's PostToolUse hook delivers on stdin. The
+    // script itself decides whether the file lives inside the repo.
+    const payload = JSON.stringify({ tool_input: { file_path: absolute } });
+
+    let run: Awaited<ReturnType<typeof runHookScript>>;
+    try {
+      run = await runHookScript(script, root, payload, signal);
+    } catch (error) {
+      if (signal?.aborted) break; // plugin unloaded mid-run
+      result.warnings.push(`pre-commit validation hook failed to start: ${String(error)}`);
+      continue;
+    }
+
+    if (run.code === 0) continue; // clean / no-op
+
+    const report = run.stderr.trim() || run.stdout.trim();
+
+    if (run.code === 2) {
+      // Blocking: pre-commit reported issues. Surface them to the model, the
+      // OpenCode equivalent of feeding the hook's stderr back to Claude Code.
+      if (report) result.reports.push(report);
+      continue;
+    }
+
+    // Non-blocking error (e.g. exit 1 = mise not on PATH). Not something the
+    // model can act on, so log it for the user instead of polluting the turn.
+    result.warnings.push(report || `pre-commit validation hook exited ${run.code}`);
+  }
+
+  return result;
+}
+
+const formatReports = (reports: string[]): string =>
+  `<pre-commit-validation>\n${reports.join("\n\n")}\n</pre-commit-validation>`;
+
+/** The repository root, so the hook script is found from any subdirectory. */
+function gitToplevel(directory: string): Promise<string> {
+  return new Promise((done) => {
+    execFile("git", ["rev-parse", "--show-toplevel"], { cwd: directory }, (error, stdout) => {
+      done(error ? directory : stdout.trim() || directory);
+    });
+  });
+}
+
+/** OpenCode 2 implementation (`@opencode/plugin`). */
+const v2: Plugin.Plugin = {
+  id: ID,
+  async setup(ctx) {
+    const root = await gitToplevel(ctx.location.directory);
+    // Hook events carry no abort signal; stop in-flight runs on unload instead.
+    const controller = new AbortController();
+
+    await ctx.tool.hook("execute.after", async (event) => {
+      if (event.status !== "completed") return;
+      if (!FILE_TOOLS.has(event.tool)) return;
+
+      const filePaths = touchedFiles(event.input, event.result.metadata);
       if (filePaths.size === 0) return;
 
-      const reports: string[] = [];
+      const { reports, warnings } = await validate(root, filePaths, controller.signal);
+
+      for (const warning of warnings) console.warn(`[${ID}] ${warning}`);
 
-      for (const filePath of filePaths) {
-        const absolute = isAbsolute(filePath) ? filePath : resolve(root, filePath);
+      if (reports.length === 0) return;
 
-        // Same JSON shape Claude Code's PostToolUse hook delivers on stdin. The
-        // script itself decides whether the file lives inside the repo.
-        const payload = JSON.stringify({ tool_input: { file_path: absolute } });
+      // Results are read-only: replace the result, appending to its content.
+      const text = formatReports(reports);
+      const content = event.result.content;
+      event.result = {
+        ...event.result,
+        content:
+          typeof content === "string" || content === undefined
+            ? content ? `${content}\n\n${text}` : text
+            : [...content, { type: "text", text }],
+      };
+    });
+
+    return () => controller.abort();
+  },
+};
 
-        const result = await $`printf '%s' ${payload} | ${script}`
-          .cwd(root)
-          .nothrow()
-          .quiet();
+/** OpenCode 1 implementation (`@opencode-ai/plugin`, >= 1.18.29). */
+const v1: PluginModule = {
+  id: ID,
+  async server({ client, directory, worktree }) {
+    const root = worktree || directory;
 
-        if (result.exitCode === 0) continue; // clean / no-op
+    const hooks: Hooks = {
+      "tool.execute.after": async (input, output) => {
+        if (!FILE_TOOLS.has(input.tool)) return;
 
-        const report =
-          result.stderr.toString().trim() || result.stdout.toString().trim();
+        const filePaths = touchedFiles(input.args, output.metadata);
+        if (filePaths.size === 0) return;
 
-        if (result.exitCode === 2) {
-          // Blocking: pre-commit reported issues. Surface them to the model by
-          // appending to the tool output, the OpenCode equivalent of feeding the
-          // hook's stderr back to Claude Code on exit 2.
-          if (report) reports.push(report);
-          continue;
+        const { reports, warnings } = await validate(root, filePaths);
+
+        for (const warning of warnings) {
+          await client.app.log({ body: { service: ID, level: "warn", message: warning } });
         }
 
-        // Non-blocking error (e.g. exit 1 = mise not on PATH). Not something the
-        // model can act on, so log it for the user instead of polluting the turn.
-        await client.app.log({
-          body: {
-            service: "precommit-validate",
-            level: "warn",
-            message: report || `pre-commit validation hook exited ${result.exitCode}`,
-          },
-        });
-      }
-
-      if (reports.length > 0) {
-        output.output += `\n\n<pre-commit-validation>\n${reports.join("\n\n")}\n</pre-commit-validation>`;
-      }
-    },
-  };
-
-  return hooks;
+        if (reports.length > 0) output.output += `\n\n${formatReports(reports)}`;
+      },
+    };
+
+    return hooks;
+  },
 };
+
+export default { ...v2, server: v1.server };

data/.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
   # Documentation available at
   # https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/docs/pre-commit.md
   - repo: https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks
-    rev: v5.24  # renovate:managed
+    rev: v5.46  # renovate:managed
 
     hooks:
       - id: shellcheck  # Run shellcheck for changed Shell files

data/CODEOWNERS

@@ -1,4 +1,4 @@
 # CODEOWNERS is used to lookup assignees for
 # Renovate Bot dependency change Merge Requests.
 # https://docs.renovatebot.com/configuration-options/#assigneesfromcodeowners
-* @reprazent @ayufan @hmerscher @e_forbes @M_Alvarez @mwoolf @sankalp_gl @hardikgala @nindurkar @ashs2
+* @ayufan @hmerscher @e_forbes @M_Alvarez @mwoolf @sankalp_gl @hardikgala @nindurkar @ashs2

data/CONTRIBUTING.md

@@ -6,7 +6,7 @@ Except for the license granted herein to GitLab Inc. and recipients of software
 distributed by GitLab Inc., you reserve all right, title, and interest in and to
 your Contributions.
 
-All contributions are subject to the Developer Certificate of Origin and license set out at [docs.gitlab.com/ce/legal/developer_certificate_of_origin](https://docs.gitlab.com/ce/legal/developer_certificate_of_origin).
+All contributions are subject to the Developer Certificate of Origin and license set out at [docs.gitlab.com/legal/developer_certificate_of_origin](https://docs.gitlab.com/legal/developer_certificate_of_origin/).
 
 _This notice should stay as the first item in the CONTRIBUTING.md file._
 

data/lib/labkit/fields.rb

@@ -16,6 +16,12 @@ module Labkit
     # GitLab username.
     GL_USER_NAME = "gl_user_name"
 
+    # Type of key used for authentication (e.g. "deploy_key", "key").
+    GL_KEY_TYPE = "gl_key_type"
+
+    # Numeric ID of the key used for authentication.
+    GL_KEY_ID = "gl_key_id"
+
     # Duo Workflow definition identifier (e.g. "analytics_agent/v1"). Identifies
     # which Duo Workflow agent originated a request, enabling per-agent
     # filtering in Kibana and Grafana.
@@ -149,12 +155,19 @@ module Labkit
     # connection field.
     GRAPHQL_CONNECTION_NODES = "graphql_connection_nodes"
 
+    # Protocol or subsystem that produced an access log line (e.g. "http",
+    # "grpc"). Emitted by the LabKit access-logging middleware so a single
+    # service's HTTP and gRPC access logs can be told apart.
+    SYSTEM = "system"
+
     # Maps each field constant to its logging field variant version.
     # A version of 0 means the field is not yet assigned to any variant.
     VARIANT_VERSION = {
       CORRELATION_ID => 1,
       GL_USER_ID => 1,
       GL_USER_NAME => 1,
+      GL_KEY_TYPE => 0,
+      GL_KEY_ID => 0,
       DUO_WORKFLOW_DEFINITION => 0,
       DUO_WORKFLOW_ID => 0,
       ERROR_TYPE => 0,
@@ -192,6 +205,7 @@ module Labkit
       ADDITIONAL_DETAILS => 0,
       GRAPHQL_COMPLEXITY_RAW => 0,
       GRAPHQL_CONNECTION_NODES => 0,
+      SYSTEM => 0,
     }.freeze
 
     # Get the constant name for a field value

data/scripts/prepare-dev-env.sh

@@ -3,6 +3,7 @@
 # Consider contributing upstream when updating this file
 
 set -euo pipefail
+IFS=$'\n\t'
 
 # ---------------------------------------------------------
 # This script will prepare your development environment

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 5.6.1
+  version: 5.7.0
 platform: ruby
 authors:
 - Andrew Newdigate