gitlab-triage 1.54.0 → 1.55.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2e36c5b7ecfbf719e3a7ac2282fc01d0e2f0af214eaeead7d60c913456090f8
-  data.tar.gz: 3da3785a4e850948e45ce922f6169a1dc9faa2d817eb3ebbd5285476c0290aee
+  metadata.gz: 72ed33025703247cca10024af7e8be895ecc03094d5733830b6dcbc73742aae5
+  data.tar.gz: da8fc6fc4932bd8038bf69947533cdcfc5bd0efb75d07c3e25c262d23e822411
 SHA512:
-  metadata.gz: e4b4c9e46c33d13f835e62e3c0638aa0663d4ab5f0ff9d64b0d404fb64cf738895cc1708346c92a8103cba4b41a089f7c746292baab3c46e04518ac09339aac9
-  data.tar.gz: cd9dd8c10b7381c41858c1f0de7a64205c87c79669e2e475e2748c40300536469369e05744545f5b55b2aed89d1384b329abaf733bbe4db837bb0a5f0d9732a5
+  metadata.gz: 0703eb40a6bd259c8931eb2ec71bdd3492e5bee59d0644737b1919b38c414776f547b06344bed54b9dc6d6825a5fca7bc06ea5e98de2cbcd8d0a1adccf936707
+  data.tar.gz: 59768f9c0f1be9f286af3a0e357a3a2be44db55e32b5df7e97381a273a4f397432574c2f65f09854a45eb7e7060ea9fcbad202ee12e076938278dea68df5eda6

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-triage (1.54.0)
+    gitlab-triage (1.55.1)
       activesupport (>= 5.1)
       globalid (~> 1.0, >= 1.0.1)
       graphql (< 2.1.0)

data/README.md

@@ -928,7 +928,9 @@ Available action types:
 
 Adds a number of labels to the resource.
 
-Accepts an array of strings. Each element is the name of a label to add.
+Accepts an array of strings. Each element is the name of a label to add. An
+element may interpolate to a comma-separated list, which is expanded into one
+label per value.
 
 If any of the labels doesn't exist, the automation will stop immediately so
 that if a label is renamed or deleted, you'll have to explicitly update or remove
@@ -957,7 +959,9 @@ actions:
 
 Removes a number of labels from the resource.
 
-Accepts an array of strings. Each element is the name of a label to remove.
+Accepts an array of strings. Each element is the name of a label to remove. An
+element may interpolate to a comma-separated list, which is expanded into one
+label per value.
 
 If any of the labels doesn't exist, the automation will stop immediately so
 that if a label is renamed or deleted, you'll have to explicitly update or remove
@@ -1346,7 +1350,10 @@ Accepts a hash of fields.
 | `destination` | integer or string | The project ID or path to create the generated issue in | no   | no              | no             | source project |
 | `item`        | string | Template representing each triaged resource     | no       | yes          | yes             |                |
 | `summary`     | string | The description of the generated issue          | no       | Only `{{title}}`, `{{items}}`, `{{type}}` | yes | |
+| `labels`      | array of strings | Labels to add to the generated issue. An element may interpolate to a comma-separated list, which is expanded into one label per value | no | yes | yes | |
+| `assignees`   | array of strings | Usernames to assign to the generated issue. An element may interpolate to a comma-separated list, which is expanded into one assignee per value | no | yes | yes | |
 | `redact_confidential_resources` | boolean | Whether redact fields for confidential resources | no | no | no | true |
+| `confidential` | boolean or string | Create the issue confidential. A string is interpolated and counts as true when it evaluates to `true` | no | no | yes | false |
 
 The following placeholders are supported for `summary`:
 
@@ -1360,14 +1367,16 @@ The following placeholders are supported for `summary`:
 > - Placeholders work regularly for `item`, but for `summary` only `{{title}}`,
 >   `{{items}}`, `{{type}}` are supported because it's not tied to a particular
 >   resource like the comment action.
+> - `labels`, `assignees`, `due_date`, `milestone`, and `confidential` can read
+>   `{{type}}`, `{{items}}`, and `resource[:items]`.
 > - No issues will be created if:
 >    - the specific policy doesn't yield any resources; or
 >    - the source type is a group and `destination` is not set.
 > - `redact_confidential_resources` defaults to `true`, so fields on
 > confidential resources will be converted to `(confidential)` except for
 > `{{web_url}}`. Setting it to `false` will reveal the confidential fields.
-> This will be useful if the summary is confidential itself (not implemented
-> yet), or if we're posting to another private project (not implemented yet).
+> This is useful when the summary is itself `confidential`, or if we're
+> posting to another private project (not implemented yet).
 
 Example:
 
@@ -1480,7 +1489,10 @@ Accepts a hash of fields.
 | `title`       | string | The title of the generated issue                | yes      | yes          | yes             |                |
 | `destination` | integer or string | The project ID or path to create the generated issue in | no   | no              | no             | source project |
 | `description`     | string | The description of the generated issue          | no       | yes | yes | |
+| `labels`      | array of strings | Labels to add to the generated issue. An element may interpolate to a comma-separated list, which is expanded into one label per value | no | yes | yes | |
+| `assignees`   | array of strings | Usernames to assign to the generated issue. An element may interpolate to a comma-separated list, which is expanded into one assignee per value | no | yes | yes | |
 | `redact_confidential_resources` | boolean | Whether redact fields for confidential resources | no | no | no | true |
+| `confidential` | boolean or string | Create the issue confidential. A string is interpolated and counts as true when it evaluates to `true` | no | no | yes | false |
 
 The placeholders available in `title` and `destination` are the properties of the resource being used to generate the issue.
 

data/lib/gitlab/triage/action/issue.rb

@@ -23,6 +23,7 @@ module Gitlab
             puts "* Assignees: #{issue.assignee_usernames.join(', ')}" if issue.assignee_usernames&.any?
             puts "* Due date: #{issue.due_date}" if issue.due_date
             puts "* Milestone: #{issue.milestone_title}" if issue.milestone_title
+            puts "* Confidential: true" if issue.confidential?
             puts "* Description: #{issue.description}"
             puts ">>>"
           end
@@ -40,6 +41,9 @@ module Gitlab
             ensure_labels_exist!(issue.labels, destination_id)
             resolve_assignee_ids(issue.assignee_usernames) if issue.assignee_usernames.any?
             resolve_milestone_id(destination_id, issue.milestone_title) if issue.milestone_title
+            # Evaluated here too, so a bad confidential: template raises before
+            # any action writes rather than mid-way through post_issue_body.
+            issue.confidential?
           end
         end
 
@@ -83,6 +87,7 @@ module Gitlab
           body[:assignee_ids] = resolve_assignee_ids(issue.assignee_usernames) if issue.assignee_usernames.any?
           body[:due_date] = issue.due_date if issue.due_date
           body[:milestone_id] = resolve_milestone_id(destination_id, issue.milestone_title) if issue.milestone_title
+          body[:confidential] = true if issue.confidential?
 
           body
         end

data/lib/gitlab/triage/action/summarize.rb

@@ -31,6 +31,7 @@ module Gitlab
             puts "* Assignees: #{issue.assignee_usernames.join(', ')}" if issue.assignee_usernames&.any?
             puts "* Due date: #{issue.due_date}" if issue.due_date
             puts "* Milestone: #{issue.milestone_title}" if issue.milestone_title
+            puts "* Confidential: true" if issue.confidential?
             puts "* Description: #{issue.description}"
             puts ">>>"
           end
@@ -43,6 +44,9 @@ module Gitlab
           ensure_labels_exist!(issue.labels, destination)
           resolve_assignee_ids(issue.assignee_usernames) if issue.assignee_usernames.any?
           resolve_milestone_id(destination, issue.milestone_title) if issue.milestone_title
+          # Evaluated here too, so a bad confidential: template raises before
+          # any action writes rather than mid-way through post_issue_body.
+          issue.confidential?
         end
 
         def act
@@ -97,6 +101,7 @@ module Gitlab
           body[:assignee_ids] = resolve_assignee_ids(issue.assignee_usernames)  if issue.assignee_usernames.any?
           body[:due_date]     = issue.due_date                                  if issue.due_date
           body[:milestone_id] = resolve_milestone_id(destination, issue.milestone_title) if issue.milestone_title
+          body[:confidential] = true if issue.confidential?
 
           body
         end

data/lib/gitlab/triage/action/update.rb

@@ -314,10 +314,13 @@ module Gitlab
               "Supported: #{VALID_STATUS_VALUES.join(', ')}."
         end
 
-        # An entry may interpolate to an empty string, so a policy can make a
-        # label conditional on the resource.
+        # An entry may interpolate to a comma-separated list, or to nothing so a
+        # policy can make a label conditional on the resource.
         def eval_labels(labels, resource)
-          Array(labels).map { |label| eval_value(label, resource) }.reject(&:empty?)
+          Array(labels)
+            .flat_map { |label| eval_value(label, resource).split(',') }
+            .map(&:strip)
+            .reject(&:empty?)
         end
 
         def join_labels(labels)
@@ -393,6 +396,7 @@ module Gitlab
           verify_state!(resource, response) if actions[:status]
           verify_labels_applied!(resource, response) if actions[:labels]
           verify_assignees_applied!(resource, response) if actions[:assignees]
+          verify_reviewers_applied!(resource, response) if actions[:reviewers]
         end
 
         def verify_labels_applied!(resource, response)
@@ -409,7 +413,7 @@ module Gitlab
         def verify_assignees_applied!(resource, response)
           return if response[:assignees].nil?
 
-          missing = eval_usernames(actions[:assignees], resource) - response[:assignees].map { |user| user.fetch(:username) }
+          missing = missing_usernames(actions[:assignees], resource, response[:assignees])
           return if missing.empty?
 
           raise UpdateNotAppliedError,
@@ -417,6 +421,24 @@ module Gitlab
               "the token may lack permission."
         end
 
+        def verify_reviewers_applied!(resource, response)
+          return if response[:reviewers].nil?
+
+          missing = missing_usernames(actions[:reviewers], resource, response[:reviewers])
+          return if missing.empty?
+
+          raise UpdateNotAppliedError,
+            "Reviewers #{missing.join(', ')} were not requested on #{resource[:web_url]}; " \
+              "the token may lack permission, or the users may not have access to it."
+        end
+
+        # The users lookup ignores case, so the response can spell a username
+        # differently from the rule.
+        def missing_usernames(requested, resource, returned_users)
+          returned = returned_users.map { |user| user.fetch(:username).downcase }
+          eval_usernames(requested, resource).reject { |username| returned.include?(username.downcase) }
+        end
+
         def verify_state!(resource, response)
           expected = actions[:status] == 'close' ? 'closed' : 'opened'
           actual = response[:state]

data/lib/gitlab/triage/engine.rb

@@ -240,6 +240,10 @@ module Gitlab
         rule.fetch(:conditions) { {} }
       end
 
+      def rule_actions(rule)
+        rule.fetch(:actions) { {} }
+      end
+
       def rule_limits(rule)
         rule.fetch(:limits) { {} }
       end
@@ -456,7 +460,7 @@ module Gitlab
             graphql_query_options[:iids] = expanded_conditions[:iids]
           end
 
-          graphql_query = build_graphql_query(resource_type, expanded_conditions, true)
+          graphql_query = build_graphql_query(resource_type, expanded_conditions, rule_definition, true)
 
           resources = graphql_network.query(graphql_query, **graphql_query_options)
         else
@@ -482,7 +486,7 @@ module Gitlab
           iids = resources.pluck('iid').map(&:to_s)
           expanded_conditions[:iids] = iids
 
-          graphql_query = build_graphql_query(resource_type, expanded_conditions)
+          graphql_query = build_graphql_query(resource_type, expanded_conditions, rule_definition)
           graphql_resources = graphql_network.query(graphql_query, source: source_full_path, iids: iids) if graphql_query.any?
 
           decorate_resources_with_graphql_data(resources, graphql_resources)
@@ -879,9 +883,14 @@ module Gitlab
         status_by_iid
       end
 
-      def build_graphql_query(resource_type, conditions, graphql_only = false)
+      def build_graphql_query(resource_type, conditions, rule_definition, graphql_only = false)
         Gitlab::Triage::GraphqlQueries::QueryBuilder
-          .new(options.source, resource_type, conditions, graphql_only: graphql_only)
+          .new(
+            options.source,
+            resource_type,
+            conditions,
+            graphql_only: graphql_only,
+            actions: rule_actions(rule_definition))
       end
 
       def source_full_path

data/lib/gitlab/triage/entity_builders/issue_fields.rb

@@ -20,14 +20,26 @@ module Gitlab
           evaluate_present(@milestone_title)
         end
 
+        def confidential?
+          return @confidential if @confidential == true || @confidential == false
+          return false unless @confidential
+
+          evaluate(@confidential.to_s).strip == 'true'
+        end
+
         private
 
-        # Returns the entries the policy author wrote with their templates
-        # interpolated, dropping any that came out empty. The caller treats an
-        # empty result as "the policy named nothing here", so a conditional entry
-        # leaves the field off the request rather than clearing it.
+        # Returns one value per label or username. An entry may interpolate to
+        # a comma-separated list so a policy can compute a list whose length
+        # varies, and an entry that comes out empty is dropped. The caller
+        # treats an empty result as "the policy named nothing here", so a
+        # conditional entry leaves the field off the request rather than
+        # clearing it.
         def evaluate_entries(templates)
-          Array(templates).map { |template| evaluate(template) }.reject(&:empty?)
+          Array(templates)
+            .flat_map { |template| evaluate(template).split(',') }
+            .map(&:strip)
+            .reject(&:empty?)
         end
 
         def init_issue_fields(action)
@@ -35,6 +47,7 @@ module Gitlab
           @assignee_usernames = action[:assignees]
           @due_date           = action[:due_date]
           @milestone_title    = action[:milestone]
+          @confidential       = action[:confidential]
         end
 
         # An empty string is truthy, so a template that interpolates to nothing

data/lib/gitlab/triage/entity_builders/summary_builder.rb

@@ -58,7 +58,7 @@ module Gitlab
         private
 
         def evaluate(template)
-          build_text(title_resource, template)
+          build_text(title_resource.merge(items: items), template)
         end
 
         def title_present?

data/lib/gitlab/triage/graphql_network.rb

@@ -71,24 +71,31 @@ module Gitlab
 
       private
 
+      # Builds a resource from one GraphQL node, holding only the fields the response
+      # actually carried. The query asks for a field only when the rule's conditions
+      # or actions need it, and the caller merges this over the REST resource, so a
+      # key written for a field nobody asked for would wipe what REST returned.
       def normalize(resource)
         resource
           .slice(:iid, :title, :state, :author, :merged_at, :user_notes_count, :user_discussions_count, :upvotes, :downvotes, :project_id, :web_url)
-          .merge(
-            id: extract_id_from_global_id(resource[:id]),
-            labels: [*resource.dig(:labels, :nodes)].pluck(:title)
-          )
-          .merge(normalize_assignees(resource))
+          .merge(id: extract_id_from_global_id(resource[:id]))
+          .merge(normalize_labels(resource))
+          .merge(normalize_users(resource, :assignees))
+          .merge(normalize_users(resource, :reviewers))
+      end
+
+      def normalize_labels(resource)
+        nodes = resource.dig(:labels, :nodes)
+        return {} unless nodes
+
+        { labels: nodes.pluck(:title) }
       end
 
-      # The assignees are only queried for an assignee_member condition, and the
-      # caller merges what comes back over the REST resource. An empty list here
-      # would wipe the assignees REST already returned.
-      def normalize_assignees(resource)
-        nodes = resource.dig(:assignees, :nodes)
+      def normalize_users(resource, key)
+        nodes = resource.dig(key, :nodes)
         return {} unless nodes
 
-        { assignees: nodes.map { |node| node.merge(id: extract_id_from_global_id(node[:id])) } }
+        { key => nodes.map { |node| node.merge(id: extract_id_from_global_id(node[:id])) } }
       end
 
       def extract_id_from_global_id(global_id)

data/lib/gitlab/triage/graphql_queries/query_builder.rb

@@ -25,10 +25,17 @@ module Gitlab
           }
         GRAPHQL
 
-        def initialize(source_type, resource_type, conditions, graphql_only: false)
+        # Neither user field exists on every type in GitLab's GraphQL schema: Epic
+        # carries no assignees, and reviewers belong to MergeRequest alone.
+        # Selecting a field the type lacks makes the whole query fail to parse.
+        ASSIGNEES_RESOURCE_TYPES = %w[issues merge_requests].freeze
+        REVIEWERS_RESOURCE_TYPES = %w[merge_requests].freeze
+
+        def initialize(source_type, resource_type, conditions, graphql_only: false, actions: {})
           @source_type = source_type.to_s.singularize
           @resource_type = resource_type
           @conditions = conditions
+          @actions = actions || {}
           @graphql_only = graphql_only
           @resource_declarations = [
             '$source: ID!',
@@ -60,7 +67,7 @@ module Gitlab
 
         private
 
-        attr_reader :source_type, :resource_type, :conditions, :graphql_only, :resource_declarations
+        attr_reader :source_type, :resource_type, :conditions, :actions, :graphql_only, :resource_declarations
 
         def vote_attribute
           @vote_attribute ||= (conditions.dig(:votes, :attribute) || conditions.dig(:upvotes, :attribute)).to_s
@@ -75,7 +82,8 @@ module Gitlab
           if graphql_only
             fields << 'labels { nodes { title } }'
             fields << 'author { id name username }'
-            fields << 'assignees { nodes { id name username } }' if conditions.key?(:assignee_member)
+            fields << 'assignees { nodes { id name username } }' if query_assignees?
+            fields << 'reviewers { nodes { id name username } }' if query_reviewers?
             fields << 'upvotes' if vote_attribute == 'upvotes'
             fields << 'downvotes' if vote_attribute == 'downvotes'
             fields.push('draft', 'mergedAt') if resource_type == 'merge_requests'
@@ -84,6 +92,41 @@ module Gitlab
           fields
         end
 
+        def query_assignees?
+          return false unless ASSIGNEES_RESOURCE_TYPES.include?(resource_type)
+
+          conditions.key?(:assignee_member) || actions_need?(:assignees)
+        end
+
+        def query_reviewers?
+          return false unless REVIEWERS_RESOURCE_TYPES.include?(resource_type)
+
+          actions_need?(:reviewers)
+        end
+
+        # An action needs a user field when it removes from that field, or when its
+        # text carries the field's placeholder. Either way the users have to be on
+        # the resource before the action runs, so the rule's actions decide these
+        # fields as much as its conditions do. The placeholder test matches the one
+        # in TextContentBuilder#replace_placeholders, so a policy that reaches for
+        # the users through Ruby interpolation instead is not covered.
+        def actions_need?(field)
+          actions[:"remove_#{field}"].present? || action_text.include?("{{#{field}}}")
+        end
+
+        def action_text
+          @action_text ||= collect_strings(actions).join("\n")
+        end
+
+        def collect_strings(value)
+          case value
+          when String then [value]
+          when Hash then value.values.flat_map { |nested| collect_strings(nested) }
+          when Array then value.flat_map { |nested| collect_strings(nested) }
+          else []
+          end
+        end
+
         def resource_query
           condition_queries = []
 

data/lib/gitlab/triage/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Triage
-    VERSION = '1.54.0'
+    VERSION = '1.55.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-triage
 version: !ruby/object:Gem::Version
-  version: 1.54.0
+  version: 1.55.1
 platform: ruby
 authors:
 - GitLab
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-24 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport