gitlab-triage 1.56.1 → 1.57.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9420b956227ae89432c05b78279b5c8267bf98e721c4feb2cde5fee21a7d611a
-  data.tar.gz: ffde105e64820dca1e873e4c368bbe65d4039080aba864e114e67e7c6d3efaa3
+  metadata.gz: 624c4d1977031933b3f310f7ae5c82778ac62bcda0f86a0c2c4a375504b6e715
+  data.tar.gz: 9545979a57eea0ff733995ac553271ad310c2c2710ac4fe78645daff962449b5
 SHA512:
-  metadata.gz: 4475319216eee8897599eef75260c58e3d677043d3a8b86cbe1ef44b6146faafb967786d3004731879b8a9c4996a21620a50956196f978aa94c704f9e2c2ef96
-  data.tar.gz: 42b71bf2233e9daeeec8834b2bb3d651f620f758f83cb3e4e17701208aa40fbf55473532d5eff574dde327afc4c3d97029c370ee5c34198d22bf784a51af932d
+  metadata.gz: 1721670e0285a0d0fffd8cb076becb239e859267d1da55f4819526f39128dec62e884251f6ae28e9d1550eeca2eb29f8c5b08c1c8d6e16b480f22254bf20016c
+  data.tar.gz: 7b233404c63d41de48dfadf6e7fdacadb6412c47fe00562d417626534ef21b5dd8c4c14340b1d46f27bad1c5c2e58378d55e80b6aac5c8e0f25f12d2075c3515

data/.gitlab/CODEOWNERS

@@ -1,2 +1 @@
-# The official maintainers
-* @gl-quality/eng-prod
+* @gl-dx

data/.gitlab-ci.yml

@@ -107,7 +107,6 @@ dry-run:custom:
       allow_failure: true
 
 include:
-  - component: gitlab.com/components/code-quality/code-quality@~latest
   - component: gitlab.com/components/sast/sast@~latest
   - component: gitlab.com/components/secret-detection/secret-detection@~latest
   - component: gitlab.com/gitlab-org/components/danger-review/danger-review@~latest
@@ -119,18 +118,6 @@ include:
     - if: '$CI_MERGE_REQUEST_IID'
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
 
-code_quality:
-  # We explicitly set dependencies here as the component sets them to []
-  # This allows us to get the cache from the setup job that includes the Gemfile.lock
-  dependencies: ["setup-test-env"]
-  tags:
-    - gitlab-org-docker
-  # We explicitly override allow_failure here as the component sets it to true
-  # Can be moved to a component input after: https://gitlab.com/components/code-quality/-/merge_requests/8
-  allow_failure: false
-  <<: *ruby-cache
-  <<: *component-general-rules
-
 semgrep-sast:
   <<: *component-general-rules
 

data/.rubocop.yml

@@ -51,3 +51,8 @@ RSpec/IndexedLet:
 # rationale: Maybe we should? For now, let's keep it disabled and revisit at a later point.
 Rails/Output:
   Enabled: false
+
+# rationale: gitlab-triage has no database / ActiveRecord models
+# context: https://gitlab.com/gitlab-org/ruby/gems/gitlab-triage/-/work_items/399
+CodeReuse/ActiveRecord:
+  Enabled: false

data/.rubocop_todo.yml

@@ -6,27 +6,6 @@
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 81
-CodeReuse/ActiveRecord:
-  Exclude:
-    - 'lib/gitlab/triage/action/work_item.rb'
-    - 'lib/gitlab/triage/engine.rb'
-    - 'lib/gitlab/triage/filters/base_conditions_filter.rb'
-    - 'lib/gitlab/triage/filters/member_conditions_filter.rb'
-    - 'lib/gitlab/triage/graphql_network.rb'
-    - 'lib/gitlab/triage/normalizers/work_item_normalizer.rb'
-    - 'lib/gitlab/triage/validators/limiter_validator.rb'
-    - 'spec/gitlab/triage/action_spec.rb'
-    - 'spec/gitlab/triage/engine_spec.rb'
-    - 'spec/gitlab/triage/graphql_network_spec.rb'
-    - 'spec/gitlab/triage/network_adapters/graphql_adapter_spec.rb'
-    - 'spec/gitlab/triage/policies/rule_policy_spec.rb'
-    - 'spec/gitlab/triage/resource/label_spec.rb'
-    - 'spec/gitlab/triage/rest_api_network_spec.rb'
-    - 'spec/support/shared_examples/issuable_shared_examples.rb'
-    - 'spec/support/shared_examples/label_command_shared_examples.rb'
-    - 'spec/support/stub_api.rb'
-
 # Offense count: 1
 Lint/ToEnumArguments:
   Exclude:

data/Gemfile.lock

@@ -1,31 +1,35 @@
 PATH
   remote: .
   specs:
-    gitlab-triage (1.56.1)
+    gitlab-triage (1.57.0)
       activesupport (>= 5.1)
       globalid (~> 1.0, >= 1.0.1)
-      graphql (< 2.1.0)
-      graphql-client (~> 0.16)
+      graphql (>= 2.4.13, < 2.7.0)
+      graphql-client (~> 0.23)
       httparty (>= 0.21.0, < 1.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.1.3.4)
+    activesupport (7.1.6)
       base64
+      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
       mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.2)
-    base64 (0.2.0)
-    bigdecimal (3.1.8)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.3)
     claide (1.1.0)
     claide-plugins (0.9.2)
       cork
@@ -33,8 +37,8 @@ GEM
       open4 (~> 1.3)
     coderay (1.1.3)
     colored2 (3.1.2)
-    concurrent-ruby (1.3.3)
-    connection_pool (2.4.1)
+    concurrent-ruby (1.3.8)
+    connection_pool (2.5.5)
     cork (0.3.0)
       colored2 (~> 3.1)
     crack (1.0.0)
@@ -59,13 +63,16 @@ GEM
       gitlab (~> 4.2, >= 4.2.0)
     diff-lcs (1.5.1)
     drb (2.2.3)
-    faraday (2.9.1)
-      faraday-net_http (>= 2.0, < 3.2)
+    faraday (2.14.4)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
     faraday-http-cache (2.5.1)
       faraday (>= 0.8)
-    faraday-net_http (3.1.0)
-      net-http
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     ffi (1.17.0)
+    fiber-storage (1.0.0)
     formatador (1.1.0)
     git (1.19.1)
       addressable (~> 2.8)
@@ -85,9 +92,11 @@ GEM
       rubocop-rspec (~> 2.27.1)
     globalid (1.2.1)
       activesupport (>= 6.1)
-    graphql (2.0.31)
+    graphql (2.6.11)
       base64
-    graphql-client (0.22.0)
+      fiber-storage
+      logger
+    graphql-client (0.26.0)
       activesupport (>= 3.0)
       graphql (>= 1.13.0)
     guard (2.18.1)
@@ -109,7 +118,7 @@ GEM
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (1.14.5)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     json (2.7.2)
     kramdown (2.4.0)
@@ -121,16 +130,20 @@ GEM
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     lumberjack (1.2.10)
     method_source (1.1.0)
     mini_mime (1.1.5)
     minitest (5.26.1)
     multi_xml (0.6.0)
-    mutex_m (0.2.0)
+    mutex_m (0.3.0)
     nap (1.1.0)
     nenv (0.3.0)
-    net-http (0.4.1)
-      uri
+    net-http (0.10.0)
+      net-protocol (>= 0.3.0)
+      uri (>= 0.11.1)
+    net-protocol (0.4.0)
+      timeout
     no_proxy_fix (0.1.2)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -146,9 +159,9 @@ GEM
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (5.0.5)
+    public_suffix (6.0.2)
     racc (1.8.0)
-    rack (3.1.3)
+    rack (3.2.7)
     rainbow (3.1.1)
     rake (13.2.1)
     rb-fsevent (0.11.2)
@@ -156,8 +169,7 @@ GEM
       ffi (~> 1.0)
     rchardet (1.8.0)
     regexp_parser (2.9.2)
-    rexml (3.3.0)
-      strscan
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -206,15 +218,16 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.3.2)
     shellany (0.0.1)
-    strscan (3.1.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     thor (1.3.1)
+    timeout (0.6.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
-    uri (0.13.0)
+    uri (1.1.2)
     webmock (3.23.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)

data/README.md

@@ -203,6 +203,8 @@ resource_rules:
 - `labels` - add labels by name. If any requested label does not exist, the
   automation stops immediately (matching the `labels` action on the `issues`
   type) rather than applying nothing.
+- `remove_labels` - remove labels by name. Like `labels`, a requested label that
+  does not exist stops the automation rather than applying a partial change.
 - `assignees` - set assignees by username. If any requested username does not
   exist, the automation stops immediately rather than sending an empty
   assignee set (which would unassign everyone).
@@ -215,7 +217,7 @@ resource_rules:
   to comment.
 
 Summaries are also supported (`summarize` and `comment_on_summary`). Any other
-action key (for example `remove_labels`, `mention`, `move`, or `status`) is
+action key (for example `mention`, `move`, or `status`) is
 rejected at load time with an error listing the supported actions. On the
 older policy types these keys are applied through comment quick actions, which
 work items do not support yet - rejecting them up front beats silently doing
@@ -345,7 +347,7 @@ Accepts the name of a milestone to filter upon. Also accepts the following timeb
 - `upcoming`
 - `started`
 
-See the [`milestone_id` API field documentation](https://docs.gitlab.com/ee/api/issues.html) for their meaning.
+See the [`milestone_id` API field documentation](https://docs.gitlab.com/api/issues/) for their meaning.
 
 Example:
 
@@ -362,7 +364,7 @@ timebox values:
 - `none`
 - `any`
 
-See the [`iteration_id` API field documentation](https://docs.gitlab.com/ee/api/issues.html) for their meaning.
+See the [`iteration_id` API field documentation](https://docs.gitlab.com/api/issues/) for their meaning.
 
 Example:
 
@@ -427,7 +429,7 @@ conditions:
 
 ###### Predefined special label names
 
-Basing on the [issues API](https://docs.gitlab.com/ee/api/issues.html), there
+Basing on the [issues API](https://docs.gitlab.com/api/issues/), there
 are two special predefined label names we can use here:
 
 * `None`: This indicates that no labels were present
@@ -694,7 +696,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues).
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues).
 
 | State                  | Type    | Value     |
 | ---------              | ----    | ------    |
@@ -715,7 +717,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues).
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues).
 
 | State           | Type    | Value     |
 | ---------       | ----    | ------    |
@@ -734,7 +736,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues). This condition can only filter by one issue type.
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues). This condition can only filter by one issue type.
 
 | Issue type      | Type    | Value       |
 | ---------       | ----    | ------      |
@@ -1260,7 +1262,7 @@ The following comment types are supported:
 - `comment` (default): creates a regular comment on the resource
 - `thread`: starts a resolvable thread (discussion) on the resource
 
-For merge requests, if `comment_type` is set to `thread`, we can also configure that [all threads should be resolved before merging](https://docs.gitlab.com/ee/user/discussions/#only-allow-merge-requests-to-be-merged-if-all-threads-are-resolved), therefore this comment can prevent it from merging.
+For merge requests, if `comment_type` is set to `thread`, we can also configure that [all threads should be resolved before merging](https://docs.gitlab.com/user/project/merge_requests/#prevent-merge-unless-all-threads-are-resolved), therefore this comment can prevent it from merging.
 
 Example:
 
@@ -1289,14 +1291,14 @@ actions:
 
 ###### Harnessing Quick Actions
 
-[GitLab's quick actions feature](https://docs.gitlab.com/ce/user/project/quick_actions.html) is available in Core.
+[GitLab's quick actions feature](https://docs.gitlab.com/user/project/quick_actions/) is available in Core.
 All of the operations supported by executing a quick action can be carried out via the comment action.
 
 If GitLab triage does not support an operation natively, it may be possible via a quick action in a comment.
 
 For example:
-- Flagging an issue as [confidential](https://docs.gitlab.com/ce/user/project/issues/confidential_issues.html)
-- [Locking issue discussion](https://docs.gitlab.com/ce/user/discussions/#lock-discussions)
+- Flagging an issue as [confidential](https://docs.gitlab.com/user/project/issues/confidential_issues/)
+- [Locking issue discussion](https://docs.gitlab.com/user/discussions/#prevent-comments-by-locking-the-discussion)
 
 ```yml
 resource_rules:
@@ -1801,6 +1803,8 @@ Usage: gitlab-triage [options]
     -H, --host-url [string]          A valid host url
     -r, --require [string]           Require a file before performing
     -d, --debug                      Print debug information
+        --summary                    Print API call summary at end of execution
+        --quiet                      Suppress pagination dots and section headers
         --cache-dir [string]         Directory containing pre-fetched API responses.
                                      Files must follow the naming convention: <source>_<id>_<resource>.json
                                      (e.g. groups_9970_members.json).

data/gitlab-triage.gemspec

@@ -33,13 +33,10 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'activesupport', '>= 5.1'
   spec.add_dependency 'globalid', '~> 1.0', '>= 1.0.1'
-  spec.add_dependency 'graphql-client', '~> 0.16'
-  # Workaround - pin graphql version
-  # see: https://github.com/github/graphql-client/issues/310
-  # see: https://github.com/rmosolgo/graphql-ruby/pull/4577
-  # see: https://github.com/github/graphql-client/pull/314
-  # We can remove this check once PR 314 is merged and released
-  spec.add_dependency 'graphql', '< 2.1.0'
+  spec.add_dependency 'graphql-client', '~> 0.23'
+  # graphql >= 2.3.5 needs graphql-client >= 0.23 (possible_types keys changed).
+  # 2.4.13 is the patched version on the highest affected minor line.
+  spec.add_dependency 'graphql', '>= 2.4.13', '< 2.7.0'
   spec.add_dependency 'httparty', '>= 0.21.0', '< 1.0'
 
   spec.add_development_dependency 'gitlab-dangerfiles', '~> 2.11.0'

data/lib/gitlab/triage/action/issue.rb

@@ -63,7 +63,7 @@ module Gitlab
 
         def build_post_url(resource, issue)
           # POST /projects/:id/issues
-          # https://docs.gitlab.com/ee/api/issues.html#new-issue
+          # https://docs.gitlab.com/api/issues/#create-an-issue
           post_url = UrlBuilders::UrlBuilder.new(
             network_options: network.options,
             source_id: issue.destination || resource[policy.source_id_sym],

data/lib/gitlab/triage/action/summarize.rb

@@ -79,7 +79,7 @@ module Gitlab
 
         def post_issue_url
           # POST /projects/:id/issues
-          # https://docs.gitlab.com/ee/api/issues.html#new-issue
+          # https://docs.gitlab.com/api/issues/#create-an-issue
           post_url = UrlBuilders::UrlBuilder.new(
             network_options: network.options,
             source_id: destination,

data/lib/gitlab/triage/action/work_item.rb

@@ -11,8 +11,9 @@ module Gitlab
       # Applies work_items actions through the Work Items REST API update
       # endpoint (PATCH) rather than the issues note/quick-action path.
       #
-      #   - labels    -> features.labels.add_label_ids  (resolved from names)
-      #   - assignees -> features.assignees.assignee_ids (resolved from usernames)
+      #   - labels        -> features.labels.add_label_ids     (resolved from names)
+      #   - remove_labels -> features.labels.remove_label_ids  (resolved from names)
+      #   - assignees     -> features.assignees.assignee_ids   (resolved from usernames)
       #
       # Missing labels or usernames stop the automation immediately (matching
       # the labels action behaviour on the issues type) rather than silently
@@ -36,13 +37,14 @@ module Gitlab
           def perform(resource)
             puts "# #{resource[:web_url]}"
             puts "Would add labels: #{requested_labels.join(', ')}" if requested_labels.any?
+            puts "Would remove labels: #{requested_removed_labels.join(', ')}" if requested_removed_labels.any?
             puts "Would assign: #{requested_assignees.join(', ')}" if requested_assignees.any?
             puts "\n"
           end
         end
 
         def act
-          return unless requested_labels.any? || requested_assignees.any?
+          return unless requested_labels.any? || requested_removed_labels.any? || requested_assignees.any?
 
           policy.resources.each do |resource|
             perform(resource)
@@ -63,7 +65,11 @@ module Gitlab
         def build_features(resource)
           features = {}
 
-          features[:labels] = { add_label_ids: label_ids_to_add(resource) } if requested_labels.any?
+          label_changes = {}
+          label_changes[:add_label_ids] = label_ids_to_add(resource) if requested_labels.any?
+          label_changes[:remove_label_ids] = label_ids_to_remove(resource) if requested_removed_labels.any?
+          features[:labels] = label_changes if label_changes.any?
+
           features[:assignees] = { assignee_ids: assignee_ids } if requested_assignees.any?
 
           features
@@ -73,6 +79,10 @@ module Gitlab
           @requested_labels ||= Array(policy.actions[:labels])
         end
 
+        def requested_removed_labels
+          @requested_removed_labels ||= Array(policy.actions[:remove_labels])
+        end
+
         def requested_assignees
           @requested_assignees ||= Array(policy.actions[:assignees])
         end
@@ -82,14 +92,16 @@ module Gitlab
             network: network, options: network.options)
         end
 
-        # Label ids are namespace-specific, so resolve them against the
-        # resource's own namespace and cache per scope - a group-spanning run
-        # then makes one label lookup per distinct project/group.
+        # Label ids are namespace-specific, so resolve against the resource's
+        # own namespace. The fetched label list is cached per scope, so a rule
+        # that both adds and removes labels - or a group-spanning run - makes
+        # one lookup per distinct project/group.
         def label_ids_to_add(resource)
-          scope = source.scope_for(resource)
+          resolve_label_ids(requested_labels, source.scope_for(resource))
+        end
 
-          @label_ids_by_scope ||= {}
-          @label_ids_by_scope[scope] ||= resolve_label_ids(requested_labels, scope)
+        def label_ids_to_remove(resource)
+          resolve_label_ids(requested_removed_labels, source.scope_for(resource))
         end
 
         def assignee_ids
@@ -102,7 +114,7 @@ module Gitlab
         def resolve_label_ids(names, scope)
           return [] if names.empty?
 
-          by_name = network.query_api(labels_url(scope)).index_by { |label| label[:name] }
+          by_name = labels_by_name(scope)
 
           names.map do |name|
             label = by_name[name]
@@ -112,24 +124,41 @@ module Gitlab
           end
         end
 
+        def labels_by_name(scope)
+          @labels_by_name_by_scope ||= {}
+          @labels_by_name_by_scope[scope] ||= network.query_api(labels_url(scope)).index_by { |label| label[:name] }
+        end
+
         # The Work Items REST update endpoint can return success without
         # persisting a change when the token lacks permission. The response
         # echoes the resulting widgets, so confirm the requested ids landed and
         # raise otherwise rather than reporting a silent no-op as success.
         def verify_applied!(resource, response)
           verify_labels_applied!(resource, response) if requested_labels.any?
+          verify_labels_removed!(resource, response) if requested_removed_labels.any?
           verify_assignees_applied!(resource, response) if requested_assignees.any?
         end
 
         def verify_labels_applied!(resource, response)
-          applied_ids = [*response.dig(:features, :labels, :labels)].pluck(:id)
-          missing = label_ids_to_add(resource) - applied_ids
+          missing = label_ids_to_add(resource) - applied_label_ids(response)
           return if missing.empty?
 
           raise UpdateNotAppliedError,
             "Labels were not applied to #{resource[:web_url]}; the token may lack permission."
         end
 
+        def verify_labels_removed!(resource, response)
+          still_present = label_ids_to_remove(resource) & applied_label_ids(response)
+          return if still_present.empty?
+
+          raise UpdateNotAppliedError,
+            "Labels were not removed from #{resource[:web_url]}; the token may lack permission."
+        end
+
+        def applied_label_ids(response)
+          [*response.dig(:features, :labels, :labels)].pluck(:id)
+        end
+
         def verify_assignees_applied!(resource, response)
           applied_ids = [*response.dig(:features, :assignees)].pluck(:id)
           missing = assignee_ids - applied_ids

data/lib/gitlab/triage/engine.rb

@@ -2,6 +2,7 @@
 
 require 'active_support/all'
 require 'active_support/inflector'
+require 'globalid'
 
 require_relative 'expand_condition'
 require_relative 'filters/issue_date_conditions_filter'
@@ -409,14 +410,14 @@ module Gitlab
         end
 
         ExpandCondition.perform(rule_conditions(rule_definition)) do |expanded_conditions|
-          status_pre_filtered = pre_filter_by_work_item_status!(resource_type, expanded_conditions)
+          status_by_id = pre_filter_by_work_item_status!(resource_type, expanded_conditions)
 
           # retrieving the resources for every rule is inefficient
           # however, previous rules may affect those upcoming
           resources = options.resources ||
             fetch_resources(resource_type, expanded_conditions, rule_definition)
 
-          apply_work_item_status!(resource_type, expanded_conditions, rule_definition, resources, status_pre_filtered)
+          apply_work_item_status!(resource_type, expanded_conditions, rule_definition, resources, status_by_id)
 
           # In some filters/actions we want to know which resource type it is
           attach_resource_type(resources, resource_type)
@@ -452,6 +453,7 @@ module Gitlab
 
         if rule_definition[:api] == 'graphql'
           graphql_query_options = { source: source_full_path }
+          pre_filter_status_ids = expanded_conditions.delete(:work_item_status_ids)
 
           if options.resource_reference
             expanded_conditions[:iids] = options.resource_reference[1..]
@@ -463,25 +465,16 @@ module Gitlab
           graphql_query = build_graphql_query(resource_type, expanded_conditions, rule_definition, true)
 
           resources = graphql_network.query(graphql_query, **graphql_query_options)
+          resources = narrow_to_pre_filtered(resources, nil, pre_filter_status_ids)
         else
           # FIXME: Epics listing endpoint doesn't support filtering by `iids`, so instead we
           # get a single epic when `--resource-reference` is given for epics.
           # Because of that, the query could return a single epic, so we make sure we get an array.
           pre_filter_iids = expanded_conditions.delete(:iids)
+          pre_filter_status_ids = expanded_conditions.delete(:work_item_status_ids)
 
           resources = Array(network.query_api(build_get_url(resource_type, expanded_conditions)))
-
-          # Narrow the REST results to the pre-filtered IID set, when a pre-filter
-          # ran. The contract is carried by the value itself: `nil` means no
-          # pre-filter ran (keep all resources), while any array - including `[]` -
-          # means "narrow to exactly these IIDs". An empty array therefore yields
-          # zero resources, which is correct when a pre-filter (e.g. work_item_status)
-          # ran and matched nothing. `present?` cannot express this because it is
-          # false for `[]`.
-          unless pre_filter_iids.nil?
-            filtered_iids = pre_filter_iids.map(&:to_s)
-            resources = resources.select { |r| filtered_iids.include?(r['iid'].to_s) }
-          end
+          resources = narrow_to_pre_filtered(resources, pre_filter_iids, pre_filter_status_ids)
 
           iids = resources.pluck('iid').map(&:to_s)
           expanded_conditions[:iids] = iids
@@ -495,6 +488,29 @@ module Gitlab
         resources
       end
 
+      # Narrow the fetched results to a pre-filtered set, when a pre-filter ran.
+      # The contract is carried by each value: `nil` means that pre-filter did not
+      # run (keep all resources), while any array - including `[]` - means "narrow
+      # to exactly these". An empty array therefore yields zero resources, which is
+      # correct when a pre-filter (e.g. work_item_status) ran and matched nothing;
+      # `present?` cannot express this because it is false for `[]`.
+      #
+      # The work_item_status pre-filter narrows by the globally-unique id, so it
+      # cannot conflate same-iid issues from different projects of a group.
+      def narrow_to_pre_filtered(resources, pre_filter_iids, pre_filter_status_ids)
+        unless pre_filter_status_ids.nil?
+          filtered_ids = pre_filter_status_ids.map(&:to_s)
+          resources = resources.select { |r| filtered_ids.include?(r[:id].to_s) }
+        end
+
+        unless pre_filter_iids.nil?
+          filtered_iids = pre_filter_iids.map(&:to_s)
+          resources = resources.select { |r| filtered_iids.include?(r[:iid].to_s) }
+        end
+
+        resources
+      end
+
       def fetch_work_items(expanded_conditions)
         conditions = expanded_conditions.dup
         conditions[:iids] = options.resource_reference[1..] if options.resource_reference
@@ -714,7 +730,7 @@ module Gitlab
       end
 
       def draft_condition_builder(draft_condittion)
-        # Issues API only accepts 'yes' and 'no' as strings: https://docs.gitlab.com/ee/api/merge_requests.html
+        # Issues API only accepts 'yes' and 'no' as strings: https://docs.gitlab.com/api/merge_requests/
         wip =
           case draft_condittion
           when true
@@ -729,32 +745,33 @@ module Gitlab
       end
 
       # When filtering by work_item_status, query workItems with server-side
-      # status filtering first to narrow the IID set before the main fetch.
+      # status filtering first to narrow the resource set before the main fetch.
       # This avoids fetching all resources just to discard most of them.
+      #
+      # We narrow by the globally-unique work item id, not the iid: a group
+      # source flattens work items from every descendant project into one list,
+      # and iids are unique only within a project, so two projects can share an
+      # iid. The id side-steps that collision.
       def pre_filter_by_work_item_status!(resource_type, expanded_conditions)
-        return false unless resource_type == 'issues' && expanded_conditions.key?(:work_item_status)
-
-        pre_filter_iids = fetch_work_item_iids_by_status(expanded_conditions[:work_item_status])
+        return unless resource_type == 'issues' && expanded_conditions.key?(:work_item_status)
 
-        expanded_conditions[:iids] =
-          if expanded_conditions[:iids].present?
-            Array(expanded_conditions[:iids]).map(&:to_s) & pre_filter_iids
-          else
-            pre_filter_iids
-          end
+        status_by_id = fetch_work_item_status_by_id(expanded_conditions[:work_item_status])
+        expanded_conditions[:work_item_status_ids] = status_by_id.keys
 
-        true
+        status_by_id
       end
 
-      def apply_work_item_status!(resource_type, expanded_conditions, rule_definition, resources, status_pre_filtered)
+      # The pre-filter (pre_filter_by_work_item_status!) always runs before this
+      # for an issues rule that filters by work_item_status, and returns a map of
+      # id to matched status name. We stamp each resource from that map instead of
+      # a second, iid-keyed status query: the pre-filter already knows the answer,
+      # and keying by the globally-unique id avoids the group iid collision that a
+      # flattened `iids:` query would reintroduce.
+      def apply_work_item_status!(resource_type, expanded_conditions, rule_definition, resources, status_by_id)
         return unless resource_type == 'issues' && needs_work_item_status?(expanded_conditions, rule_definition)
 
-        status_values = Array(expanded_conditions[:work_item_status])
-
-        if status_pre_filtered && status_values.size == 1
-          resources.each { |r| r[:work_item_status] = status_values.first }
-        else
-          decorate_resources_with_work_item_status(resources)
+        resources.each do |resource|
+          resource[:work_item_status] = status_by_id[resource[:id].to_s]
         end
       end
 
@@ -762,24 +779,40 @@ module Gitlab
         conditions.key?(:work_item_status)
       end
 
+      # A group's `workItems` connection returns only the group's own work items
+      # (epics), whose IIDs do not match the project-scoped issue IIDs the issues
+      # fetch returns. `includeDescendants: true` pulls in the descendant project
+      # issues so the status IIDs line up. The argument does not exist on
+      # `project.workItems`, so it is only emitted for a group source.
+      def work_item_descendants_argument
+        options.source == 'groups' ? 'includeDescendants: true, ' : ''
+      end
+
       # Pre-filter: query workItems with server-side status filtering to get only
-      # the IIDs that match, avoiding fetching the full resource set when most
-      # items won't pass the status filter.
-      def fetch_work_item_iids_by_status(status_condition)
+      # the items that match, avoiding fetching the full resource set when most
+      # items won't pass the status filter. Because it queries one status at a
+      # time, it also learns which status each id matched, and returns that as a
+      # map of globally-unique id (from the work item GID) to status name. The id
+      # keys stay correct across a group's descendant projects where iids can
+      # collide, and the map lets the caller stamp statuses without a second
+      # iid-keyed query. When several statuses match the same id, the last one
+      # queried wins; a work item has a single status, so this does not happen in
+      # practice.
+      def fetch_work_item_status_by_id(status_condition)
         status_names = Array(status_condition)
-        all_iids = []
+        status_by_id = {}
 
         status_names.each do |status_name|
           query = <<~GRAPHQL
             query($source: ID!, $after: String, $statusName: String!) {
               #{options.source.singularize}(fullPath: $source) {
-                workItems(status: { name: $statusName }, after: $after, first: 100) {
+                workItems(status: { name: $statusName }, #{work_item_descendants_argument}after: $after, first: 100) {
                   pageInfo {
                     hasNextPage
                     endCursor
                   }
                   nodes {
-                    iid
+                    id
                   }
                 }
               }
@@ -797,8 +830,9 @@ module Gitlab
 
             work_items = Array.wrap(response[:results])
             work_items.each do |wi|
-              iid = wi.is_a?(Hash) ? (wi['iid'] || wi[:iid]) : wi.try(:iid)
-              all_iids << iid.to_s if iid
+              gid = wi.is_a?(Hash) ? (wi['id'] || wi[:id]) : wi.try(:id)
+              id = numeric_id_from_gid(gid)
+              status_by_id[id.to_s] = status_name if id
             end
 
             break unless response[:more_pages]
@@ -807,80 +841,16 @@ module Gitlab
           end
         end
 
-        all_iids.uniq
-      end
-
-      # Status is a work item capability not available on the IssueType GraphQL type
-      # or the REST API. We fetch it via a separate workItems query and merge it back
-      # by IID, similar to how decorate_resources_with_graphql_data works for other fields.
-      # We use widgets (not features) for backward compatibility with GitLab versions
-      # before the features field was introduced in 18.9.
-      def decorate_resources_with_work_item_status(resources)
-        return if resources.empty?
-
-        iids = resources.filter_map { |r| (r['iid'] || r[:iid])&.to_s }
-        return if iids.empty?
-
-        status_by_iid = fetch_work_item_statuses_by_iid(iids)
-
-        resources.each do |resource|
-          iid = (resource['iid'] || resource[:iid]).to_s
-          resource[:work_item_status] = status_by_iid[iid]
-        end
+        status_by_id
       end
 
-      # The workItems connection caps `first` at 100, so we request the status
-      # for the given IIDs in batches and paginate within each batch.
-      def fetch_work_item_statuses_by_iid(iids)
-        query = <<~GRAPHQL
-          query($source: ID!, $iids: [String!], $after: String) {
-            #{options.source.singularize}(fullPath: $source) {
-              workItems(iids: $iids, after: $after, first: 100) {
-                pageInfo {
-                  hasNextPage
-                  endCursor
-                }
-                nodes {
-                  iid
-                  widgets(onlyTypes: [STATUS]) {
-                    ... on WorkItemWidgetStatus {
-                      status {
-                        id
-                        name
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        GRAPHQL
-
-        status_by_iid = {}
-
-        iids.each_slice(100) do |iids_batch|
-          after_cursor = nil
-
-          loop do
-            response = graphql_network.adapter.query_raw(
-              query,
-              resource_path: [options.source.singularize, 'workItems'],
-              variables: { source: source_full_path, iids: iids_batch, after: after_cursor }
-            )
-
-            Array.wrap(response[:results]).each do |wi|
-              wi = wi.deep_transform_keys(&:underscore).with_indifferent_access
-              status_widget = Array.wrap(wi[:widgets]).find { |w| w[:status].present? }
-              status_by_iid[wi[:iid].to_s] = status_widget.dig(:status, :name) if status_widget
-            end
-
-            break unless response[:more_pages]
-
-            after_cursor = response[:end_cursor]
-          end
-        end
+      # A work item GID (`gid://gitlab/WorkItem/1234`) carries the same model id
+      # the REST issues endpoint returns as `id`. Parsed with GlobalID, matching
+      # GraphqlNetwork#extract_id_from_global_id.
+      def numeric_id_from_gid(gid)
+        return if gid.blank?
 
-        status_by_iid
+        GlobalID.parse(gid).model_id
       end
 
       def build_graphql_query(resource_type, conditions, rule_definition, graphql_only = false)

data/lib/gitlab/triage/network_adapters/base_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'active_support/core_ext/object/blank'
+
 require_relative '../version'
 
 module Gitlab
@@ -14,6 +16,21 @@ module Gitlab
           @options = options
           @tracker = tracker
         end
+
+        private
+
+        # When the rate-limit headers are absent (e.g. a server that doesn't send
+        # them), treat the limit as not-a-concern rather than coercing a missing
+        # header to 0/1970, which would otherwise trip rate_limit_wait.
+        def rate_limit_remaining(headers)
+          value = headers['ratelimit-remaining']
+          value.present? ? value.to_i : Float::INFINITY
+        end
+
+        def rate_limit_reset_at(headers)
+          value = headers['ratelimit-reset']
+          Time.at(value.to_i) if value.present?
+        end
       end
     end
   end

data/lib/gitlab/triage/network_adapters/graphql_adapter.rb

@@ -58,14 +58,9 @@ module Gitlab
 
           raise_on_error!(response)
 
-          parsed_response = response.data
           headers = response.extensions.fetch('headers', {})
 
-          {
-            ratelimit_remaining: headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(headers['ratelimit-reset'].to_i),
-            results: parsed_response.to_h
-          }
+          build_graphql_response(response.data.to_h, headers)
         end
 
         delegate :parse, to: :client
@@ -96,19 +91,6 @@ module Gitlab
           end
         end
 
-        # When the rate-limit headers are absent (e.g. a server that doesn't send
-        # them), treat the limit as not-a-concern rather than coercing a missing
-        # header to 0/1970, which would otherwise trip rate_limit_wait.
-        def rate_limit_remaining(headers)
-          value = headers['ratelimit-remaining']
-          value.present? ? value.to_i : Float::INFINITY
-        end
-
-        def rate_limit_reset_at(headers)
-          value = headers['ratelimit-reset']
-          Time.at(value.to_i) if value.present?
-        end
-
         # Converts a parsed GraphQL::Client response node into plain Ruby so the
         # shared builder only ever deals with Hash/Array, never client objects.
         def plain_node(parsed_response)

data/lib/gitlab/triage/network_adapters/httparty_adapter.rb

@@ -28,8 +28,8 @@ module Gitlab
             more_pages: (response.headers["x-next-page"].to_s != ""),
             next_page_url: next_page_url(url, response),
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
 
           resource_count = result[:results].is_a?(Array) ? result[:results].size : 0
@@ -57,8 +57,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -81,8 +81,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(response.headers['ratelimit-reset'].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -105,8 +105,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(response.headers['ratelimit-reset'].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -127,8 +127,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 

data/lib/gitlab/triage/option_parser.rb

@@ -74,10 +74,10 @@ module Gitlab
             end
 
             opts.on('--cache-dir [string]', String,
-              'Directory containing pre-fetched API responses. ' \
-                'Files must follow the naming convention: <source>_<id>_<resource>.json ' \
-                '(e.g. groups_9970_members.json). ' \
-                'Can also be set via the GITLAB_TRIAGE_CACHE_DIR environment variable.') do |value|
+              'Directory containing pre-fetched API responses.',
+              'Files must follow the naming convention: <source>_<id>_<resource>.json',
+              '(e.g. groups_9970_members.json).',
+              'Can also be set via the GITLAB_TRIAGE_CACHE_DIR environment variable.') do |value|
               options.cache_dir = value
             end
 

data/lib/gitlab/triage/policies/base_policy.rb

@@ -80,7 +80,7 @@ module Gitlab
         end
 
         def work_item?
-          (actions.keys.map(&:to_sym) & %i[labels assignees]).any?
+          (actions.keys.map(&:to_sym) & %i[labels remove_labels assignees]).any?
         end
 
         def build_issue

data/lib/gitlab/triage/rest_api_network.rb

@@ -210,9 +210,12 @@ module Gitlab
       def rate_limit_wait(response)
         return unless response.delete(:ratelimit_remaining) < MINIMUM_RATE_LIMIT
 
-        puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{response[:ratelimit_reset_at] - Time.now} seconds" if options.debug
+        reset_at = response[:ratelimit_reset_at]
+        return unless reset_at
+
+        puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{reset_at - Time.now} seconds" if options.debug
         @adapter.tracker&.record_rate_limit_wait
-        sleep(1) until Time.now >= response[:ratelimit_reset_at]
+        sleep(1) until Time.now >= reset_at
       end
 
       def raise_unexpected_response(results)

data/lib/gitlab/triage/validators/policy_validator.rb

@@ -10,6 +10,7 @@ module Gitlab
       # where nobody sees it).
       class PolicyValidator
         UnsupportedActionError = Class.new(StandardError)
+        ConflictingActionError = Class.new(StandardError)
 
         COMMENT_NOT_SUPPORTED_MESSAGE =
           'Commenting on work_items is not yet supported by the Work Items REST API ' \
@@ -18,7 +19,7 @@ module Gitlab
 
         # Action keys Action.actions_for dispatches for work_items policies.
         # Anything outside this list would silently do nothing, so reject it up front.
-        SUPPORTED_WORK_ITEM_ACTIONS = %i[labels assignees summarize comment_on_summary].freeze
+        SUPPORTED_WORK_ITEM_ACTIONS = %i[labels remove_labels assignees summarize comment_on_summary].freeze
 
         def initialize(resource_rules)
           @resource_rules = resource_rules || {}
@@ -38,6 +39,16 @@ module Gitlab
           action_sets_from(policy_definition).each do |actions|
             raise UnsupportedActionError, COMMENT_NOT_SUPPORTED_MESSAGE if actions.key?(:comment)
 
+            # GitLab applies remove_label_ids after add_label_ids, so a label in
+            # both lists is always removed. Catch the typo here rather than let the
+            # run fail later with a misleading "token may lack permission" error.
+            conflicting = Array(actions[:labels]).map(&:to_s) & Array(actions[:remove_labels]).map(&:to_s)
+            unless conflicting.none?
+              raise ConflictingActionError,
+                "Label(s) in both labels and remove_labels for a work_items rule: #{conflicting.join(', ')}. " \
+                  "A label cannot be added and removed in the same rule."
+            end
+
             unsupported = actions.keys.map(&:to_sym) - SUPPORTED_WORK_ITEM_ACTIONS
             next if unsupported.none?
 

data/lib/gitlab/triage/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Triage
-    VERSION = '1.56.1'
+    VERSION = '1.57.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-triage
 version: !ruby/object:Gem::Version
-  version: 1.56.1
+  version: 1.57.0
 platform: ruby
 authors:
 - GitLab
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -50,28 +50,34 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.23'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.23'
 - !ruby/object:Gem::Dependency
   name: graphql
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.13
     - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.7.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.13
     - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.7.0
 - !ruby/object:Gem::Dependency
   name: httparty
   requirement: !ruby/object:Gem::Requirement
@@ -212,7 +218,6 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".codeclimate.yml"
 - ".git-blame-ignore-revs"
 - ".gitignore"
 - ".gitlab-ci.yml"

data/.codeclimate.yml

@@ -1,19 +0,0 @@
----
-engines:
-  bundler-audit:
-    enabled: true
-  duplication:
-    enabled: true
-    config:
-      languages:
-        - ruby
-  rubocop-gitlab:
-    enabled: true
-ratings:
-  paths:
-    - Gemfile.lock
-    - "**.rb"
-exclude_paths:
-  - spec/
-  - vendor/
-  - tmp/