gitlab-triage 1.56.2 → 1.57.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51a92e16690b0c2f5453cc6a63f69afc72664c457e66be02a4c0ea976ceedddd
-  data.tar.gz: 36f7c9d84716e73d5f329a98ab06a8e09093b05e77e77dcb9ef8aa0a7cf62a93
+  metadata.gz: 624c4d1977031933b3f310f7ae5c82778ac62bcda0f86a0c2c4a375504b6e715
+  data.tar.gz: 9545979a57eea0ff733995ac553271ad310c2c2710ac4fe78645daff962449b5
 SHA512:
-  metadata.gz: e3c94b3fc92a0e66df471d4912f6c97527f1bce6de7b872ee01818fa7eae0bb54defb9ec2c64dcb295997a6d755bd6f9932b4fe2436349c6a6c275ab9e6b9462
-  data.tar.gz: 119e10a479dbfbcd9f0e51ffc17e65582ffa058129c0077175f843a2e450dcfb03e49c8b8a963f15b3e08c3ecfc40fe77c3dc22c23fb5ef540d3c04925610957
+  metadata.gz: 1721670e0285a0d0fffd8cb076becb239e859267d1da55f4819526f39128dec62e884251f6ae28e9d1550eeca2eb29f8c5b08c1c8d6e16b480f22254bf20016c
+  data.tar.gz: 7b233404c63d41de48dfadf6e7fdacadb6412c47fe00562d417626534ef21b5dd8c4c14340b1d46f27bad1c5c2e58378d55e80b6aac5c8e0f25f12d2075c3515

data/.gitlab/CODEOWNERS

@@ -1,2 +1 @@
-# The official maintainers
-* @gl-quality/eng-prod
+* @gl-dx

data/.gitlab-ci.yml

@@ -107,7 +107,6 @@ dry-run:custom:
       allow_failure: true
 
 include:
-  - component: gitlab.com/components/code-quality/code-quality@~latest
   - component: gitlab.com/components/sast/sast@~latest
   - component: gitlab.com/components/secret-detection/secret-detection@~latest
   - component: gitlab.com/gitlab-org/components/danger-review/danger-review@~latest
@@ -119,18 +118,6 @@ include:
     - if: '$CI_MERGE_REQUEST_IID'
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
 
-code_quality:
-  # We explicitly set dependencies here as the component sets them to []
-  # This allows us to get the cache from the setup job that includes the Gemfile.lock
-  dependencies: ["setup-test-env"]
-  tags:
-    - gitlab-org-docker
-  # We explicitly override allow_failure here as the component sets it to true
-  # Can be moved to a component input after: https://gitlab.com/components/code-quality/-/merge_requests/8
-  allow_failure: false
-  <<: *ruby-cache
-  <<: *component-general-rules
-
 semgrep-sast:
   <<: *component-general-rules
 

data/.rubocop.yml

@@ -51,3 +51,8 @@ RSpec/IndexedLet:
 # rationale: Maybe we should? For now, let's keep it disabled and revisit at a later point.
 Rails/Output:
   Enabled: false
+
+# rationale: gitlab-triage has no database / ActiveRecord models
+# context: https://gitlab.com/gitlab-org/ruby/gems/gitlab-triage/-/work_items/399
+CodeReuse/ActiveRecord:
+  Enabled: false

data/.rubocop_todo.yml

@@ -6,27 +6,6 @@
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 81
-CodeReuse/ActiveRecord:
-  Exclude:
-    - 'lib/gitlab/triage/action/work_item.rb'
-    - 'lib/gitlab/triage/engine.rb'
-    - 'lib/gitlab/triage/filters/base_conditions_filter.rb'
-    - 'lib/gitlab/triage/filters/member_conditions_filter.rb'
-    - 'lib/gitlab/triage/graphql_network.rb'
-    - 'lib/gitlab/triage/normalizers/work_item_normalizer.rb'
-    - 'lib/gitlab/triage/validators/limiter_validator.rb'
-    - 'spec/gitlab/triage/action_spec.rb'
-    - 'spec/gitlab/triage/engine_spec.rb'
-    - 'spec/gitlab/triage/graphql_network_spec.rb'
-    - 'spec/gitlab/triage/network_adapters/graphql_adapter_spec.rb'
-    - 'spec/gitlab/triage/policies/rule_policy_spec.rb'
-    - 'spec/gitlab/triage/resource/label_spec.rb'
-    - 'spec/gitlab/triage/rest_api_network_spec.rb'
-    - 'spec/support/shared_examples/issuable_shared_examples.rb'
-    - 'spec/support/shared_examples/label_command_shared_examples.rb'
-    - 'spec/support/stub_api.rb'
-
 # Offense count: 1
 Lint/ToEnumArguments:
   Exclude:

data/Gemfile.lock

@@ -1,31 +1,35 @@
 PATH
   remote: .
   specs:
-    gitlab-triage (1.56.2)
+    gitlab-triage (1.57.0)
       activesupport (>= 5.1)
       globalid (~> 1.0, >= 1.0.1)
-      graphql (< 2.1.0)
-      graphql-client (~> 0.16)
+      graphql (>= 2.4.13, < 2.7.0)
+      graphql-client (~> 0.23)
       httparty (>= 0.21.0, < 1.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.1.3.4)
+    activesupport (7.1.6)
       base64
+      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
       minitest (>= 5.1)
       mutex_m
+      securerandom (>= 0.3)
       tzinfo (~> 2.0)
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.2)
-    base64 (0.2.0)
-    bigdecimal (3.1.8)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.3)
     claide (1.1.0)
     claide-plugins (0.9.2)
       cork
@@ -33,8 +37,8 @@ GEM
       open4 (~> 1.3)
     coderay (1.1.3)
     colored2 (3.1.2)
-    concurrent-ruby (1.3.3)
-    connection_pool (2.4.1)
+    concurrent-ruby (1.3.8)
+    connection_pool (2.5.5)
     cork (0.3.0)
       colored2 (~> 3.1)
     crack (1.0.0)
@@ -59,13 +63,16 @@ GEM
       gitlab (~> 4.2, >= 4.2.0)
     diff-lcs (1.5.1)
     drb (2.2.3)
-    faraday (2.9.1)
-      faraday-net_http (>= 2.0, < 3.2)
+    faraday (2.14.4)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
     faraday-http-cache (2.5.1)
       faraday (>= 0.8)
-    faraday-net_http (3.1.0)
-      net-http
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     ffi (1.17.0)
+    fiber-storage (1.0.0)
     formatador (1.1.0)
     git (1.19.1)
       addressable (~> 2.8)
@@ -85,9 +92,11 @@ GEM
       rubocop-rspec (~> 2.27.1)
     globalid (1.2.1)
       activesupport (>= 6.1)
-    graphql (2.0.31)
+    graphql (2.6.11)
       base64
-    graphql-client (0.22.0)
+      fiber-storage
+      logger
+    graphql-client (0.26.0)
       activesupport (>= 3.0)
       graphql (>= 1.13.0)
     guard (2.18.1)
@@ -109,7 +118,7 @@ GEM
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    i18n (1.14.5)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     json (2.7.2)
     kramdown (2.4.0)
@@ -121,16 +130,20 @@ GEM
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
+    logger (1.7.0)
     lumberjack (1.2.10)
     method_source (1.1.0)
     mini_mime (1.1.5)
     minitest (5.26.1)
     multi_xml (0.6.0)
-    mutex_m (0.2.0)
+    mutex_m (0.3.0)
     nap (1.1.0)
     nenv (0.3.0)
-    net-http (0.4.1)
-      uri
+    net-http (0.10.0)
+      net-protocol (>= 0.3.0)
+      uri (>= 0.11.1)
+    net-protocol (0.4.0)
+      timeout
     no_proxy_fix (0.1.2)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -146,9 +159,9 @@ GEM
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    public_suffix (5.0.5)
+    public_suffix (6.0.2)
     racc (1.8.0)
-    rack (3.1.3)
+    rack (3.2.7)
     rainbow (3.1.1)
     rake (13.2.1)
     rb-fsevent (0.11.2)
@@ -156,8 +169,7 @@ GEM
       ffi (~> 1.0)
     rchardet (1.8.0)
     regexp_parser (2.9.2)
-    rexml (3.3.0)
-      strscan
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -206,15 +218,16 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.3.2)
     shellany (0.0.1)
-    strscan (3.1.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     thor (1.3.1)
+    timeout (0.6.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.5.0)
-    uri (0.13.0)
+    uri (1.1.2)
     webmock (3.23.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)

data/README.md

@@ -203,6 +203,8 @@ resource_rules:
 - `labels` - add labels by name. If any requested label does not exist, the
   automation stops immediately (matching the `labels` action on the `issues`
   type) rather than applying nothing.
+- `remove_labels` - remove labels by name. Like `labels`, a requested label that
+  does not exist stops the automation rather than applying a partial change.
 - `assignees` - set assignees by username. If any requested username does not
   exist, the automation stops immediately rather than sending an empty
   assignee set (which would unassign everyone).
@@ -215,7 +217,7 @@ resource_rules:
   to comment.
 
 Summaries are also supported (`summarize` and `comment_on_summary`). Any other
-action key (for example `remove_labels`, `mention`, `move`, or `status`) is
+action key (for example `mention`, `move`, or `status`) is
 rejected at load time with an error listing the supported actions. On the
 older policy types these keys are applied through comment quick actions, which
 work items do not support yet - rejecting them up front beats silently doing
@@ -345,7 +347,7 @@ Accepts the name of a milestone to filter upon. Also accepts the following timeb
 - `upcoming`
 - `started`
 
-See the [`milestone_id` API field documentation](https://docs.gitlab.com/ee/api/issues.html) for their meaning.
+See the [`milestone_id` API field documentation](https://docs.gitlab.com/api/issues/) for their meaning.
 
 Example:
 
@@ -362,7 +364,7 @@ timebox values:
 - `none`
 - `any`
 
-See the [`iteration_id` API field documentation](https://docs.gitlab.com/ee/api/issues.html) for their meaning.
+See the [`iteration_id` API field documentation](https://docs.gitlab.com/api/issues/) for their meaning.
 
 Example:
 
@@ -427,7 +429,7 @@ conditions:
 
 ###### Predefined special label names
 
-Basing on the [issues API](https://docs.gitlab.com/ee/api/issues.html), there
+Basing on the [issues API](https://docs.gitlab.com/api/issues/), there
 are two special predefined label names we can use here:
 
 * `None`: This indicates that no labels were present
@@ -694,7 +696,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues).
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues).
 
 | State                  | Type    | Value     |
 | ---------              | ----    | ------    |
@@ -715,7 +717,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues).
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues).
 
 | State           | Type    | Value     |
 | ---------       | ----    | ------    |
@@ -734,7 +736,7 @@ conditions:
 
 **This condition is only applicable for issues.**
 
-Accepts a string per the [API documentation](https://docs.gitlab.com/ee/api/issues.html#list-issues). This condition can only filter by one issue type.
+Accepts a string per the [API documentation](https://docs.gitlab.com/api/issues/#list-all-issues). This condition can only filter by one issue type.
 
 | Issue type      | Type    | Value       |
 | ---------       | ----    | ------      |
@@ -1260,7 +1262,7 @@ The following comment types are supported:
 - `comment` (default): creates a regular comment on the resource
 - `thread`: starts a resolvable thread (discussion) on the resource
 
-For merge requests, if `comment_type` is set to `thread`, we can also configure that [all threads should be resolved before merging](https://docs.gitlab.com/ee/user/discussions/#only-allow-merge-requests-to-be-merged-if-all-threads-are-resolved), therefore this comment can prevent it from merging.
+For merge requests, if `comment_type` is set to `thread`, we can also configure that [all threads should be resolved before merging](https://docs.gitlab.com/user/project/merge_requests/#prevent-merge-unless-all-threads-are-resolved), therefore this comment can prevent it from merging.
 
 Example:
 
@@ -1289,14 +1291,14 @@ actions:
 
 ###### Harnessing Quick Actions
 
-[GitLab's quick actions feature](https://docs.gitlab.com/ce/user/project/quick_actions.html) is available in Core.
+[GitLab's quick actions feature](https://docs.gitlab.com/user/project/quick_actions/) is available in Core.
 All of the operations supported by executing a quick action can be carried out via the comment action.
 
 If GitLab triage does not support an operation natively, it may be possible via a quick action in a comment.
 
 For example:
-- Flagging an issue as [confidential](https://docs.gitlab.com/ce/user/project/issues/confidential_issues.html)
-- [Locking issue discussion](https://docs.gitlab.com/ce/user/discussions/#lock-discussions)
+- Flagging an issue as [confidential](https://docs.gitlab.com/user/project/issues/confidential_issues/)
+- [Locking issue discussion](https://docs.gitlab.com/user/discussions/#prevent-comments-by-locking-the-discussion)
 
 ```yml
 resource_rules:
@@ -1801,6 +1803,8 @@ Usage: gitlab-triage [options]
     -H, --host-url [string]          A valid host url
     -r, --require [string]           Require a file before performing
     -d, --debug                      Print debug information
+        --summary                    Print API call summary at end of execution
+        --quiet                      Suppress pagination dots and section headers
         --cache-dir [string]         Directory containing pre-fetched API responses.
                                      Files must follow the naming convention: <source>_<id>_<resource>.json
                                      (e.g. groups_9970_members.json).

data/gitlab-triage.gemspec

@@ -33,13 +33,10 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'activesupport', '>= 5.1'
   spec.add_dependency 'globalid', '~> 1.0', '>= 1.0.1'
-  spec.add_dependency 'graphql-client', '~> 0.16'
-  # Workaround - pin graphql version
-  # see: https://github.com/github/graphql-client/issues/310
-  # see: https://github.com/rmosolgo/graphql-ruby/pull/4577
-  # see: https://github.com/github/graphql-client/pull/314
-  # We can remove this check once PR 314 is merged and released
-  spec.add_dependency 'graphql', '< 2.1.0'
+  spec.add_dependency 'graphql-client', '~> 0.23'
+  # graphql >= 2.3.5 needs graphql-client >= 0.23 (possible_types keys changed).
+  # 2.4.13 is the patched version on the highest affected minor line.
+  spec.add_dependency 'graphql', '>= 2.4.13', '< 2.7.0'
   spec.add_dependency 'httparty', '>= 0.21.0', '< 1.0'
 
   spec.add_development_dependency 'gitlab-dangerfiles', '~> 2.11.0'

data/lib/gitlab/triage/action/issue.rb

@@ -63,7 +63,7 @@ module Gitlab
 
         def build_post_url(resource, issue)
           # POST /projects/:id/issues
-          # https://docs.gitlab.com/ee/api/issues.html#new-issue
+          # https://docs.gitlab.com/api/issues/#create-an-issue
           post_url = UrlBuilders::UrlBuilder.new(
             network_options: network.options,
             source_id: issue.destination || resource[policy.source_id_sym],

data/lib/gitlab/triage/action/summarize.rb

@@ -79,7 +79,7 @@ module Gitlab
 
         def post_issue_url
           # POST /projects/:id/issues
-          # https://docs.gitlab.com/ee/api/issues.html#new-issue
+          # https://docs.gitlab.com/api/issues/#create-an-issue
           post_url = UrlBuilders::UrlBuilder.new(
             network_options: network.options,
             source_id: destination,

data/lib/gitlab/triage/action/work_item.rb

@@ -11,8 +11,9 @@ module Gitlab
       # Applies work_items actions through the Work Items REST API update
       # endpoint (PATCH) rather than the issues note/quick-action path.
       #
-      #   - labels    -> features.labels.add_label_ids  (resolved from names)
-      #   - assignees -> features.assignees.assignee_ids (resolved from usernames)
+      #   - labels        -> features.labels.add_label_ids     (resolved from names)
+      #   - remove_labels -> features.labels.remove_label_ids  (resolved from names)
+      #   - assignees     -> features.assignees.assignee_ids   (resolved from usernames)
       #
       # Missing labels or usernames stop the automation immediately (matching
       # the labels action behaviour on the issues type) rather than silently
@@ -36,13 +37,14 @@ module Gitlab
           def perform(resource)
             puts "# #{resource[:web_url]}"
             puts "Would add labels: #{requested_labels.join(', ')}" if requested_labels.any?
+            puts "Would remove labels: #{requested_removed_labels.join(', ')}" if requested_removed_labels.any?
             puts "Would assign: #{requested_assignees.join(', ')}" if requested_assignees.any?
             puts "\n"
           end
         end
 
         def act
-          return unless requested_labels.any? || requested_assignees.any?
+          return unless requested_labels.any? || requested_removed_labels.any? || requested_assignees.any?
 
           policy.resources.each do |resource|
             perform(resource)
@@ -63,7 +65,11 @@ module Gitlab
         def build_features(resource)
           features = {}
 
-          features[:labels] = { add_label_ids: label_ids_to_add(resource) } if requested_labels.any?
+          label_changes = {}
+          label_changes[:add_label_ids] = label_ids_to_add(resource) if requested_labels.any?
+          label_changes[:remove_label_ids] = label_ids_to_remove(resource) if requested_removed_labels.any?
+          features[:labels] = label_changes if label_changes.any?
+
           features[:assignees] = { assignee_ids: assignee_ids } if requested_assignees.any?
 
           features
@@ -73,6 +79,10 @@ module Gitlab
           @requested_labels ||= Array(policy.actions[:labels])
         end
 
+        def requested_removed_labels
+          @requested_removed_labels ||= Array(policy.actions[:remove_labels])
+        end
+
         def requested_assignees
           @requested_assignees ||= Array(policy.actions[:assignees])
         end
@@ -82,14 +92,16 @@ module Gitlab
             network: network, options: network.options)
         end
 
-        # Label ids are namespace-specific, so resolve them against the
-        # resource's own namespace and cache per scope - a group-spanning run
-        # then makes one label lookup per distinct project/group.
+        # Label ids are namespace-specific, so resolve against the resource's
+        # own namespace. The fetched label list is cached per scope, so a rule
+        # that both adds and removes labels - or a group-spanning run - makes
+        # one lookup per distinct project/group.
         def label_ids_to_add(resource)
-          scope = source.scope_for(resource)
+          resolve_label_ids(requested_labels, source.scope_for(resource))
+        end
 
-          @label_ids_by_scope ||= {}
-          @label_ids_by_scope[scope] ||= resolve_label_ids(requested_labels, scope)
+        def label_ids_to_remove(resource)
+          resolve_label_ids(requested_removed_labels, source.scope_for(resource))
         end
 
         def assignee_ids
@@ -102,7 +114,7 @@ module Gitlab
         def resolve_label_ids(names, scope)
           return [] if names.empty?
 
-          by_name = network.query_api(labels_url(scope)).index_by { |label| label[:name] }
+          by_name = labels_by_name(scope)
 
           names.map do |name|
             label = by_name[name]
@@ -112,24 +124,41 @@ module Gitlab
           end
         end
 
+        def labels_by_name(scope)
+          @labels_by_name_by_scope ||= {}
+          @labels_by_name_by_scope[scope] ||= network.query_api(labels_url(scope)).index_by { |label| label[:name] }
+        end
+
         # The Work Items REST update endpoint can return success without
         # persisting a change when the token lacks permission. The response
         # echoes the resulting widgets, so confirm the requested ids landed and
         # raise otherwise rather than reporting a silent no-op as success.
         def verify_applied!(resource, response)
           verify_labels_applied!(resource, response) if requested_labels.any?
+          verify_labels_removed!(resource, response) if requested_removed_labels.any?
           verify_assignees_applied!(resource, response) if requested_assignees.any?
         end
 
         def verify_labels_applied!(resource, response)
-          applied_ids = [*response.dig(:features, :labels, :labels)].pluck(:id)
-          missing = label_ids_to_add(resource) - applied_ids
+          missing = label_ids_to_add(resource) - applied_label_ids(response)
           return if missing.empty?
 
           raise UpdateNotAppliedError,
             "Labels were not applied to #{resource[:web_url]}; the token may lack permission."
         end
 
+        def verify_labels_removed!(resource, response)
+          still_present = label_ids_to_remove(resource) & applied_label_ids(response)
+          return if still_present.empty?
+
+          raise UpdateNotAppliedError,
+            "Labels were not removed from #{resource[:web_url]}; the token may lack permission."
+        end
+
+        def applied_label_ids(response)
+          [*response.dig(:features, :labels, :labels)].pluck(:id)
+        end
+
         def verify_assignees_applied!(resource, response)
           applied_ids = [*response.dig(:features, :assignees)].pluck(:id)
           missing = assignee_ids - applied_ids

data/lib/gitlab/triage/engine.rb

@@ -730,7 +730,7 @@ module Gitlab
       end
 
       def draft_condition_builder(draft_condittion)
-        # Issues API only accepts 'yes' and 'no' as strings: https://docs.gitlab.com/ee/api/merge_requests.html
+        # Issues API only accepts 'yes' and 'no' as strings: https://docs.gitlab.com/api/merge_requests/
         wip =
           case draft_condittion
           when true

data/lib/gitlab/triage/network_adapters/base_adapter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'active_support/core_ext/object/blank'
+
 require_relative '../version'
 
 module Gitlab
@@ -14,6 +16,21 @@ module Gitlab
           @options = options
           @tracker = tracker
         end
+
+        private
+
+        # When the rate-limit headers are absent (e.g. a server that doesn't send
+        # them), treat the limit as not-a-concern rather than coercing a missing
+        # header to 0/1970, which would otherwise trip rate_limit_wait.
+        def rate_limit_remaining(headers)
+          value = headers['ratelimit-remaining']
+          value.present? ? value.to_i : Float::INFINITY
+        end
+
+        def rate_limit_reset_at(headers)
+          value = headers['ratelimit-reset']
+          Time.at(value.to_i) if value.present?
+        end
       end
     end
   end

data/lib/gitlab/triage/network_adapters/graphql_adapter.rb

@@ -58,14 +58,9 @@ module Gitlab
 
           raise_on_error!(response)
 
-          parsed_response = response.data
           headers = response.extensions.fetch('headers', {})
 
-          {
-            ratelimit_remaining: headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(headers['ratelimit-reset'].to_i),
-            results: parsed_response.to_h
-          }
+          build_graphql_response(response.data.to_h, headers)
         end
 
         delegate :parse, to: :client
@@ -96,19 +91,6 @@ module Gitlab
           end
         end
 
-        # When the rate-limit headers are absent (e.g. a server that doesn't send
-        # them), treat the limit as not-a-concern rather than coercing a missing
-        # header to 0/1970, which would otherwise trip rate_limit_wait.
-        def rate_limit_remaining(headers)
-          value = headers['ratelimit-remaining']
-          value.present? ? value.to_i : Float::INFINITY
-        end
-
-        def rate_limit_reset_at(headers)
-          value = headers['ratelimit-reset']
-          Time.at(value.to_i) if value.present?
-        end
-
         # Converts a parsed GraphQL::Client response node into plain Ruby so the
         # shared builder only ever deals with Hash/Array, never client objects.
         def plain_node(parsed_response)

data/lib/gitlab/triage/network_adapters/httparty_adapter.rb

@@ -28,8 +28,8 @@ module Gitlab
             more_pages: (response.headers["x-next-page"].to_s != ""),
             next_page_url: next_page_url(url, response),
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
 
           resource_count = result[:results].is_a?(Array) ? result[:results].size : 0
@@ -57,8 +57,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -81,8 +81,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(response.headers['ratelimit-reset'].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -105,8 +105,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers['ratelimit-remaining'].to_i,
-            ratelimit_reset_at: Time.at(response.headers['ratelimit-reset'].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 
@@ -127,8 +127,8 @@ module Gitlab
 
           {
             results: response.parsed_response,
-            ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
-            ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
+            ratelimit_remaining: rate_limit_remaining(response.headers),
+            ratelimit_reset_at: rate_limit_reset_at(response.headers)
           }
         end
 

data/lib/gitlab/triage/option_parser.rb

@@ -74,10 +74,10 @@ module Gitlab
             end
 
             opts.on('--cache-dir [string]', String,
-              'Directory containing pre-fetched API responses. ' \
-                'Files must follow the naming convention: <source>_<id>_<resource>.json ' \
-                '(e.g. groups_9970_members.json). ' \
-                'Can also be set via the GITLAB_TRIAGE_CACHE_DIR environment variable.') do |value|
+              'Directory containing pre-fetched API responses.',
+              'Files must follow the naming convention: <source>_<id>_<resource>.json',
+              '(e.g. groups_9970_members.json).',
+              'Can also be set via the GITLAB_TRIAGE_CACHE_DIR environment variable.') do |value|
               options.cache_dir = value
             end
 

data/lib/gitlab/triage/policies/base_policy.rb

@@ -80,7 +80,7 @@ module Gitlab
         end
 
         def work_item?
-          (actions.keys.map(&:to_sym) & %i[labels assignees]).any?
+          (actions.keys.map(&:to_sym) & %i[labels remove_labels assignees]).any?
         end
 
         def build_issue

data/lib/gitlab/triage/rest_api_network.rb

@@ -210,9 +210,12 @@ module Gitlab
       def rate_limit_wait(response)
         return unless response.delete(:ratelimit_remaining) < MINIMUM_RATE_LIMIT
 
-        puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{response[:ratelimit_reset_at] - Time.now} seconds" if options.debug
+        reset_at = response[:ratelimit_reset_at]
+        return unless reset_at
+
+        puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{reset_at - Time.now} seconds" if options.debug
         @adapter.tracker&.record_rate_limit_wait
-        sleep(1) until Time.now >= response[:ratelimit_reset_at]
+        sleep(1) until Time.now >= reset_at
       end
 
       def raise_unexpected_response(results)

data/lib/gitlab/triage/validators/policy_validator.rb

@@ -10,6 +10,7 @@ module Gitlab
       # where nobody sees it).
       class PolicyValidator
         UnsupportedActionError = Class.new(StandardError)
+        ConflictingActionError = Class.new(StandardError)
 
         COMMENT_NOT_SUPPORTED_MESSAGE =
           'Commenting on work_items is not yet supported by the Work Items REST API ' \
@@ -18,7 +19,7 @@ module Gitlab
 
         # Action keys Action.actions_for dispatches for work_items policies.
         # Anything outside this list would silently do nothing, so reject it up front.
-        SUPPORTED_WORK_ITEM_ACTIONS = %i[labels assignees summarize comment_on_summary].freeze
+        SUPPORTED_WORK_ITEM_ACTIONS = %i[labels remove_labels assignees summarize comment_on_summary].freeze
 
         def initialize(resource_rules)
           @resource_rules = resource_rules || {}
@@ -38,6 +39,16 @@ module Gitlab
           action_sets_from(policy_definition).each do |actions|
             raise UnsupportedActionError, COMMENT_NOT_SUPPORTED_MESSAGE if actions.key?(:comment)
 
+            # GitLab applies remove_label_ids after add_label_ids, so a label in
+            # both lists is always removed. Catch the typo here rather than let the
+            # run fail later with a misleading "token may lack permission" error.
+            conflicting = Array(actions[:labels]).map(&:to_s) & Array(actions[:remove_labels]).map(&:to_s)
+            unless conflicting.none?
+              raise ConflictingActionError,
+                "Label(s) in both labels and remove_labels for a work_items rule: #{conflicting.join(', ')}. " \
+                  "A label cannot be added and removed in the same rule."
+            end
+
             unsupported = actions.keys.map(&:to_sym) - SUPPORTED_WORK_ITEM_ACTIONS
             next if unsupported.none?
 

data/lib/gitlab/triage/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Triage
-    VERSION = '1.56.2'
+    VERSION = '1.57.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-triage
 version: !ruby/object:Gem::Version
-  version: 1.56.2
+  version: 1.57.0
 platform: ruby
 authors:
 - GitLab
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -50,28 +50,34 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.23'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '0.23'
 - !ruby/object:Gem::Dependency
   name: graphql
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.13
     - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.7.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.4.13
     - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.7.0
 - !ruby/object:Gem::Dependency
   name: httparty
   requirement: !ruby/object:Gem::Requirement
@@ -212,7 +218,6 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".codeclimate.yml"
 - ".git-blame-ignore-revs"
 - ".gitignore"
 - ".gitlab-ci.yml"

data/.codeclimate.yml

@@ -1,19 +0,0 @@
----
-engines:
-  bundler-audit:
-    enabled: true
-  duplication:
-    enabled: true
-    config:
-      languages:
-        - ruby
-  rubocop-gitlab:
-    enabled: true
-ratings:
-  paths:
-    - Gemfile.lock
-    - "**.rb"
-exclude_paths:
-  - spec/
-  - vendor/
-  - tmp/