@getmonoceros/workbench 1.23.2 → 1.24.0

package/bundled-components/features/gitlab-cli/component.yml

@@ -0,0 +1,28 @@
+id: gitlab-cli
+name: gitlab
+category: feature
+displayName: GitLab CLI
+description: 'The official GitLab CLI (`glab`) for merge requests, issues, CI/CD pipelines and releases. Targets gitlab.com or a self-managed host. Login persists across container rebuilds.'
+documentationURL: https://gitlab.com/gitlab-org/cli
+options:
+  version:
+    type: string
+    default: latest
+    description: 'glab release to install: `latest` (resolved from the GitLab release API at build) or a pinned version like `1.102.0`.'
+    surface: silent
+  apiToken:
+    type: string
+    default: ''
+    description: 'GitLab personal access token (scopes: `api`, `write_repository`); exported as GITLAB_TOKEN. Empty for `glab auth login` on first run.'
+    surface: env
+  host:
+    type: string
+    default: ''
+    description: 'Self-managed/Dedicated GitLab host (e.g. `gitlab.example.com`); empty targets gitlab.com. Exported as GITLAB_HOST, so every `glab` command uses it without `--hostname`.'
+    surface: yml
+feature:
+  version: 1.0.0
+  persistentHomePaths: [.config/glab-cli]
+  vscodeExtensions: [GitLab.gitlab-workflow]
+briefing:
+  - text: 'GitLab CLI (`glab`) — merge requests, issues, CI/CD pipelines and releases. Targets the configured GitLab host (gitlab.com unless `host` was set). Pre-authenticated when a token was set; `glab auth status` shows the active account.'

package/bundled-components/features/gitlab-cli/install.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Monoceros devcontainer feature: gitlab-cli.
+#
+# Installs the official GitLab CLI (`glab`) from the project's release
+# artifacts on gitlab.com — deliberately NOT the distro apt package,
+# which lags far behind (often ~a year). The version to install is
+# resolved at build time: `latest` asks the GitLab release API for the
+# newest tag; a pinned `version` installs exactly that. `monoceros
+# upgrade` rebuilds and re-fetches, so the tool stays current (ADR 0018).
+#
+# Auth is via the GITLAB_TOKEN / GITLAB_HOST environment variables, which
+# glab reads directly — so when `apiToken` (and optionally `host`) are
+# set, a /etc/profile.d snippet is enough and no `glab auth login` step
+# is needed. Config/login state lives at ~/.config/glab-cli, bind-mounted
+# from the host so it survives apply rebuilds.
+
+set -euo pipefail
+
+VERSION="${VERSION:-latest}"
+APITOKEN="${APITOKEN:-}"
+HOST="${HOST:-}"
+
+ARCH="$(dpkg --print-architecture)"
+case "${ARCH}" in
+  amd64 | arm64) ;;
+  *)
+    echo "[gitlab-cli] unsupported architecture: ${ARCH}" >&2
+    exit 1
+    ;;
+esac
+
+# Resolve the release tag. `latest` → newest tag from the GitLab release
+# API; otherwise normalise the pinned value to a `v`-prefixed tag.
+if [ "${VERSION}" = "latest" ]; then
+  echo "[gitlab-cli] resolving latest release from gitlab.com"
+  TAG="$(curl -fsSL 'https://gitlab.com/api/v4/projects/gitlab-org%2Fcli/releases/permalink/latest' | jq -r '.tag_name')"
+  if [ -z "${TAG}" ] || [ "${TAG}" = "null" ]; then
+    echo "[gitlab-cli] ERROR: could not resolve the latest glab release" >&2
+    exit 1
+  fi
+else
+  TAG="v${VERSION#v}"
+fi
+VER="${TAG#v}"
+
+URL="https://gitlab.com/gitlab-org/cli/-/releases/${TAG}/downloads/glab_${VER}_linux_${ARCH}.tar.gz"
+echo "[gitlab-cli] downloading glab ${VER} for ${ARCH}"
+TMP="$(mktemp -d)"
+curl -fsSL -o "${TMP}/glab.tar.gz" "${URL}"
+tar -xzf "${TMP}/glab.tar.gz" -C "${TMP}"
+
+# Locate the binary in the tarball rather than assuming its layout.
+BIN="$(find "${TMP}" -type f -name glab | head -n1)"
+if [ -z "${BIN}" ]; then
+  echo "[gitlab-cli] ERROR: glab binary not found in the release tarball" >&2
+  exit 1
+fi
+install -o root -g root -m 0755 "${BIN}" /usr/local/bin/glab
+rm -rf "${TMP}"
+
+glab --version >/dev/null 2>&1 || {
+  echo "[gitlab-cli] ERROR: install completed but \`glab\` is not on PATH" >&2
+  exit 1
+}
+
+# Auth/config via environment (glab reads GITLAB_TOKEN / GITLAB_HOST
+# directly). We write the profile.d snippet when there is anything to
+# export: a token, a host, or both.
+if [ -n "${APITOKEN}" ] || [ -n "${HOST}" ]; then
+  {
+    echo "# Auto-generated by the Monoceros gitlab-cli feature."
+    if [ -n "${APITOKEN}" ]; then
+      echo "export GITLAB_TOKEN='${APITOKEN}'"
+    fi
+    if [ -n "${HOST}" ]; then
+      echo "export GITLAB_HOST='${HOST}'"
+    fi
+  } >/etc/profile.d/gitlab-cli.sh
+  chmod 0644 /etc/profile.d/gitlab-cli.sh
+fi
+
+if [ -n "${APITOKEN}" ]; then
+  echo "[gitlab-cli] apiToken wired via /etc/profile.d/ → \`glab\` authenticated in login shells"
+else
+  echo "[gitlab-cli] no apiToken set — run \`glab auth login\` once in the container; auth state persists under ~/.config/glab-cli"
+fi
+
+echo "[gitlab-cli] done"

package/dist/bin.js

@@ -2515,6 +2515,13 @@ async function writeOpencodeConfig(targetDir, containerName2, features) {
     ...managedInstructions,
     ...existingInstructions.filter((i) => !managedInstructions.includes(i))
   ];
+  if (typeof config.permission !== "string") {
+    const permission = typeof config.permission === "object" && config.permission !== null ? config.permission : {};
+    const ext = typeof permission.external_directory === "object" && permission.external_directory !== null ? permission.external_directory : {};
+    ext[`${workspaceRoot}/projects/*`] = "allow";
+    permission.external_directory = ext;
+    config.permission = permission;
+  }
   if (model) {
     config.model = model;
   }
@@ -7220,7 +7227,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.23.2" : "dev";
+    CLI_VERSION = true ? "1.24.0" : "dev";
   }
 });