@openhands/extensions 0.29.0 → 0.31.0

package/skills/github-pr-reviewer/scripts/worker.py

@@ -2,11 +2,14 @@
 
 import json
 import os
+import re
 import sys
 from functools import cached_property
+from urllib.error import HTTPError
 from urllib.parse import quote
 
 import main as workflow
+import agent_conversation
 from agent_conversation import AgentConversationDispatcher
 from github_client import GitHubRepository, run_repositories
 from maintainer_handoff import (
@@ -25,6 +28,7 @@ from maintainer_handoff import (
 # approving silently, and a required run that has not completed means waiting,
 # never approval. When the required set cannot be read, the gate falls back to
 # every current-head check and workflow run, so a red head still blocks.
+SCAN_WINDOW = 10
 CHECK_GATE_MARKER = "<!-- openhands-review-gate:"
 NON_BLOCKING_CHECK_CONCLUSIONS = frozenset({"success", "neutral", "skipped"})
 # GitHub parks a fork head's workflow runs at this conclusion until a maintainer
@@ -114,6 +118,57 @@ class ReviewIntake:
 
 
 
+class ScanCursor:
+    """The per-repository position of the rotating unrequested-PR window.
+
+    Classifying one unrequested head costs a review read, a check-run read, and
+    a workflow-run read, so a scan that examined every open PR spent the API
+    budget on the largest repository alone. The scan instead examines a bounded
+    slice of the unrequested backlog and remembers where the slice ended, in the
+    automation service's own KV store - the same facility `main.py` already uses
+    for review state, reached with the same `AUTOMATION_KV_TOKEN` and
+    `AUTOMATION_API_URL`, so no new secret or store is introduced. The next scan
+    resumes past that point, so the whole backlog is covered fairly over several
+    scans.
+
+    When the KV store is unavailable (a local run, or the tests) the position is
+    kept in memory, so the scan still rotates within the run and nothing else
+    about it changes. A KV read or write failure is not fatal: a scan position is
+    not worth aborting reviews over, so the in-memory position is used instead.
+    """
+
+    def __init__(self, repository):
+        self._key = f"review-scan:{workflow._repo_slug(repository)}"
+        self._memory = 0
+
+    def position(self, total):
+        """The stored cursor, reduced to a valid offset into `total` items."""
+        return self._read() % total if total else 0
+
+    def advance(self, cursor):
+        """Record where the next scan's window starts."""
+        self._memory = cursor
+        if not workflow._kv_available():
+            return
+        try:
+            workflow._kv_set(self._key, {"cursor": cursor})
+        except Exception as exc:  # noqa: BLE001 - a cursor is not worth failing a scan
+            print(f"  Warning: scan cursor write failed ({exc})")
+
+    def _read(self):
+        if not workflow._kv_available():
+            return self._memory
+        try:
+            data = workflow._kv_get(self._key) or {}
+        except Exception as exc:  # noqa: BLE001 - fall back to the in-memory cursor
+            print(f"  Warning: scan cursor read failed ({exc})")
+            return self._memory
+        try:
+            return int(data.get("cursor") or 0)
+        except (TypeError, ValueError):
+            return self._memory
+
+
 class PullRequestReviewer(GitHubRepository):
     name = "github-pr-reviewer"
     # The shared intake the shipped entrypoint creates once per scheduled scan,
@@ -122,6 +177,14 @@ class PullRequestReviewer(GitHubRepository):
     # conversations with a private intake instead.
     scan_intake = None
 
+    @cached_property
+    def structured_reviews(self):
+        if not self.config.get("structured_publication", False):
+            return None
+        from publication import StructuredReviews
+
+        return StructuredReviews(self)
+
     @property
     def intake(self):
         """The intake this run registers eligible candidates with.
@@ -193,7 +256,7 @@ class PullRequestReviewer(GitHubRepository):
             return pr if (author or "").lower() == self.trigger_reviewer else None
         return None
 
-    def _prompt(self, pr, trigger, label=None, delivery_key=None):
+    def _prompt(self, pr, trigger, label=None, delivery_key=None, conversation_id=None):
         number = pr["number"]
         sha = pr["head"]["sha"]
         token = self.token_name
@@ -225,6 +288,7 @@ class PullRequestReviewer(GitHubRepository):
             workspace_instructions=workspace,
             github_token_secret=token,
             trigger_description=trigger_description,
+            conversation_id=conversation_id,
         )
         if label:
             moved_head_instruction = (
@@ -289,6 +353,32 @@ class PullRequestReviewer(GitHubRepository):
             f"second result.{self_review_note}"
         )
 
+    def _linked_issue_allows_handoff(self, pr):
+        """Require a successfully fetched closing issue labeled medium or high."""
+        numbers = {
+            int(number)
+            for number in re.findall(
+                r"(?im)\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)",
+                pr.get("body") or "",
+            )
+        }
+        for number in numbers:
+            try:
+                issue = self.gh("GET", f"/issues/{number}")
+            except HTTPError as exc:
+                if exc.code != 404:
+                    raise
+                continue
+            labels = {
+                (item.get("name") or "").casefold()
+                for item in issue.get("labels", [])
+            }
+            if "pull_request" not in issue and labels & {
+                "priority:medium", "priority:high"
+            }:
+                return True
+        return False
+
     def _finish_completed_review(self, pr, trigger, label=None, submitted_review=None):
         """Complete an exact-head review, including an optional human handoff.
 
@@ -340,18 +430,36 @@ class PullRequestReviewer(GitHubRepository):
             ]
         if not completed:
             return False
+        try:
+            self._annotate_llm_provenance(pr, completed)
+        except Exception as exc:  # noqa: BLE001 - provenance never blocks completion
+            print(
+                json.dumps(
+                    {
+                        "repository": self.repository,
+                        "pr": pr["number"],
+                        "llm_provenance_error": f"{type(exc).__name__}: {exc}",
+                    }
+                ),
+                flush=True,
+            )
         approved = None
         maintainer_decision = False
         for review in sorted(
             completed, key=lambda item: item["submitted_at"], reverse=True
         ):
-            body = (review.get("body") or "").rstrip()
+            # The verdict ends the agent's text; the provenance footer the
+            # automation appends after it is not part of the verdict.
+            body = workflow._without_llm_provenance(review.get("body") or "")
             if body.endswith("✅ APPROVED"):
                 approved = True
                 break
             if body.endswith("🔄 CHANGES REQUESTED"):
                 approved = False
                 break
+            if self.structured_reviews and body.endswith("⏸ INCONCLUSIVE"):
+                approved = False
+                break
             if body.endswith(workflow.MAINTAINER_DECISION_VERDICT):
                 maintainer_decision = True
                 break
@@ -359,7 +467,7 @@ class PullRequestReviewer(GitHubRepository):
             return False
         # A scope stop is not an approval: it requests the maintainer decision
         # the change is missing, through the same handoff as an approval.
-        if approved or maintainer_decision:
+        if (approved or maintainer_decision) and self._linked_issue_allows_handoff(pr):
             maintainers = parse_maintainers(self.config.get("maintainers"))
             if maintainers:
                 try:
@@ -401,6 +509,110 @@ class PullRequestReviewer(GitHubRepository):
             )
         return True
 
+    def _annotate_llm_provenance(self, pr, reviews):
+        """Append the LLM profile and model to this automation's own reviews.
+
+        The footer describes the conversation that published the review, read
+        back from that conversation rather than from current settings, so a
+        reused conversation reports the LLM it actually runs. Login, head, and
+        time cannot tell two automations sharing a bot account apart, so a
+        review is annotated only when its single run marker names the
+        conversation this automation records for the pull request. Any other
+        review, including one by an overlapping run, is left as it is. A
+        review keeps the metadata recorded in this automation's KV namespace.
+        Review text alone cannot establish that a footer came from the worker.
+        """
+        reviews = [
+            review
+            for review in reviews
+            if workflow._REVIEW_RUN_MARKER_RE.search(review.get("body") or "")
+        ]
+        if not reviews:
+            return
+        repository_id = self.gh("GET", "")["id"]
+        conversation_id = self.dispatcher.subject_conversation(
+            f"{repository_id}:pr:{pr['number']}"
+        )
+        own = workflow._own_reviews(reviews, conversation_id)
+        if not own:
+            return
+        errors = []
+        for review in own:
+            original = review.get("body") or ""
+            has_footer = workflow._without_llm_provenance(original) != original.strip()
+            try:
+                provenance = self._recorded_review_provenance(conversation_id, review["id"])
+            except Exception as exc:
+                # Keep an unverifiable agent-written line from claiming a model.
+                # Finish the remaining reviews before the outer guard logs errors.
+                errors.append(exc)
+                provenance = None
+            if provenance is None:
+                if not has_footer:
+                    continue
+                try:
+                    # Fallback edits use the same atomically chosen tuple.
+                    # A concurrent metadata collector may already have won.
+                    provenance = self._recorded_review_provenance(
+                        conversation_id, review["id"], unavailable=True
+                    )
+                except Exception as exc:
+                    errors.append(exc)
+                    continue
+            body = workflow._with_llm_provenance(original, *provenance)
+            if body != review.get("body"):
+                try:
+                    self.gh(
+                        "PUT",
+                        f"/pulls/{pr['number']}/reviews/{review['id']}",
+                        {"body": body},
+                    )
+                except Exception as exc:
+                    errors.append(exc)
+        if errors:
+            raise errors[0]
+
+    def _recorded_review_provenance(self, conversation_id, review_id, *, unavailable=False):
+        """Record server metadata or an explicit unknown fallback outside agent text."""
+        key = f"review-provenance-{conversation_id}-{review_id}"
+
+        def recorded(value):
+            if (isinstance(value, dict)
+                and value.get("conversation_id") == conversation_id
+                and all(isinstance(value.get(field), str) and value[field]
+                        for field in ("profile", "model"))):
+                return value["profile"], value["model"]
+            return None
+
+        try:
+            saved = recorded(agent_conversation._kv_request(key, "GET"))
+            if saved is not None:
+                return saved
+            provenance = (
+                ("unknown", "unknown") if unavailable
+                else self.dispatcher.llm_provenance(conversation_id)
+            )
+            if provenance is None:
+                # Another collector may have recorded it during the lookup.
+                return recorded(agent_conversation._kv_request(key, "GET"))
+            value = {"conversation_id": conversation_id,
+                     "profile": provenance[0], "model": provenance[1]}
+            # Every edit, including an unknown fallback, uses the first tuple.
+            agent_conversation._kv_request(key + "?nx=true", "PUT", value)
+        except Exception as exc:
+            # A lookup can fail after another collector records the tuple, or
+            # a write can commit before its response is lost. Reconcile both.
+            try:
+                saved = recorded(agent_conversation._kv_request(key, "GET"))
+            except Exception:
+                raise exc
+            if saved is not None:
+                return saved
+            if isinstance(exc, HTTPError) and exc.code == 409:
+                raise ValueError("Stored review provenance does not match its conversation") from exc
+            raise
+        return provenance
+
     @staticmethod
     def _check_app_identity(run):
         """The app that reported a check run, as a stable grouping key."""
@@ -890,13 +1102,68 @@ class PullRequestReviewer(GitHubRepository):
             candidates.append(pr)
         return candidates
 
+    @property
+    def _scan_cursor(self):
+        """This repository's scan position, created lazily like the intake."""
+        cursor = self.__dict__.get("_cursor")
+        if cursor is None:
+            cursor = self.__dict__["_cursor"] = ScanCursor(self.repository)
+        return cursor
+
+    def _explicit_candidate(self, pr, label):
+        """Whether a PR was explicitly requested by a caller.
+
+        An explicit `all-hands-bot` review request or a trigger label is a
+        caller's decision, so it is never subject to the rotating window: every
+        explicit candidate is examined on every scan, whatever the stored scan
+        position is.
+        """
+        if label in {item["name"] for item in pr.get("labels", [])}:
+            return True
+        return self._outstanding_review_request(pr)
+
+    def _rotating_window(self, prs, label):
+        """The explicit candidates plus a bounded slice of the unrequested ones.
+
+        Classifying an unrequested head costs a review read and the exact-head
+        check/workflow reads, so examining every open PR in one scan is what let
+        a single run exhaust the API budget and post a managed gate comment for
+        every red or pending head. The unrequested backlog is therefore examined
+        a bounded `SCAN_WINDOW` at a time, starting where the previous scan
+        stopped (the per-repository position in the Automation KV store), so
+        successive scans rotate through the whole backlog. Explicit candidates
+        are always included, so a request is never delayed behind the window.
+        """
+        explicit, unrequested = [], []
+        for pr in prs:
+            if pr.get("draft") and label not in {
+                item["name"] for item in pr.get("labels", [])
+            } and not self._outstanding_review_request(pr):
+                # A draft that is neither labeled nor requested is not reviewable
+                # by the unrequested path either, so drop it before the full read.
+                continue
+            if self._explicit_candidate(pr, label):
+                explicit.append(pr)
+            else:
+                unrequested.append(pr)
+        if not unrequested:
+            return explicit
+        start = self._scan_cursor.position(len(unrequested))
+        window = unrequested[start : start + SCAN_WINDOW]
+        self._scan_cursor.advance(start + len(window))
+        return explicit + window
+
     def run(self):
         repository_id = self.gh("GET", "")["id"]
         label = self.config.get("trigger_label", workflow.TRIGGER_LABEL)
+        if self.structured_reviews:
+            for pending in self.gh_pages("/pulls?state=open"):
+                self.structured_reviews.advance(pending)
         payload = self._event_payload()
         event_mode = payload is not None
         if not event_mode:
-            prs = self._scan_candidates(
+            selector = self._rotating_window if self.config.get("scan_window", False) else self._scan_candidates
+            prs = selector(
                 self.gh_pages("/pulls?state=open&sort=updated&direction=asc"), label
             )
         else:
@@ -945,7 +1212,7 @@ class PullRequestReviewer(GitHubRepository):
                     # conversation or review is created.
                     if pr.get("draft"):
                         continue
-                    if self._has_current_head_review(pr["number"], pr["head"]["sha"]):
+                    if not self.structured_reviews and self._has_current_head_review(pr["number"], pr["head"]["sha"]):
                         self._finish_completed_review(pr, None)
                         continue
                     trigger = None
@@ -967,7 +1234,7 @@ class PullRequestReviewer(GitHubRepository):
                 already = self._reviewed_current_head_without_clarification(
                     pr["number"], pr["head"]["sha"]
                 )
-                if already:
+                if already and not self.structured_reviews:
                     print(
                         json.dumps(
                             {
@@ -997,7 +1264,7 @@ class PullRequestReviewer(GitHubRepository):
                                 f"{quote(trigger_label, safe='')}",
                             )
                     continue
-                if delivery_key is None and self._finish_completed_review(
+                if not self.structured_reviews and delivery_key is None and self._finish_completed_review(
                     pr, trigger, trigger_label, submitted_review
                 ):
                     continue
@@ -1085,13 +1352,35 @@ class PullRequestReviewer(GitHubRepository):
                 + ", ".join(f"#{number}" for number in failures)
             )
 
+    def latest_label_event(self, number):
+        return workflow._latest_trigger_label_event(self.token, self.repository, number)
+
     def _start_review(
         self, repository_id, pr, trigger, sha, trigger_label, delivery_key=None
     ):
+        if self.structured_reviews:
+            latest = self._latest_reviewer_request(pr["number"])
+            generation = f"request:{latest['id']}" if latest else "initial"
+            label_event = self.latest_label_event(pr["number"])
+            if label_event:
+                generation += f":label:{label_event['id']}"
+            comments = self.gh_pages(f"/issues/{pr['number']}/comments")
+            human = [item for item in comments if (item.get("user") or {}).get("type") != "Bot"
+                     and (item.get("user") or {}).get("login", "").lower() != self.github_login.lower()]
+            if human:
+                generation += f":clarification:{max(int(item['id']) for item in human)}"
+            return self.structured_reviews.advance(
+                pr, generation, start=True,
+                explicit=bool(trigger), label=trigger_label, trigger=trigger,
+            )
         result = self.dispatcher.deliver(
             subject=f"{repository_id}:pr:{pr['number']}",
             delivery=delivery_key or f"{trigger['id']}:{sha}",
-            prompt=self._prompt(pr, trigger, trigger_label, delivery_key),
+            # The dispatcher names the conversation it delivers to, so the
+            # prompt can carry that conversation's review marker.
+            prompt=lambda conversation_id: self._prompt(
+                pr, trigger, trigger_label, delivery_key, conversation_id
+            ),
             head=sha,
         )
         print(

package/skills/github-pr-reviewer/tests/test_main.py

@@ -255,7 +255,7 @@ class TestState(_CheckoutTestCase):
 # ── Review verification ────────────────────────────────────────────────────────
 
 
-class TestMatchingReviewExists(unittest.TestCase):
+class TestPublishedReviews(unittest.TestCase):
     def setUp(self):
         self._login = main._AUTH_LOGIN
         main._AUTH_LOGIN = "review-bot"
@@ -265,10 +265,10 @@ class TestMatchingReviewExists(unittest.TestCase):
 
     def _exists(self, reviews):
         with patch.object(main, "_github_paginate", return_value=reviews):
-            return main._matching_review_exists("token", "owner/repo", 7, "abc123")
+            return bool(main._published_reviews("token", "owner/repo", 7, "abc123"))
 
     def test_true_for_our_review_at_this_commit(self):
-        self.assertTrue(self._exists([{"user": {"login": "Review-Bot"}, "commit_id": "abc123"}]))
+        self.assertTrue(self._exists([{"user": {"login": "Review-Bot"}, "commit_id": "abc123", "state": "COMMENTED"}]))
 
     def test_false_for_someone_elses_review(self):
         self.assertFalse(self._exists([{"user": {"login": "human"}, "commit_id": "abc123"}]))
@@ -276,9 +276,10 @@ class TestMatchingReviewExists(unittest.TestCase):
     def test_false_for_our_review_at_another_commit(self):
         self.assertFalse(self._exists([{"user": {"login": "review-bot"}, "commit_id": "older"}]))
 
-    def test_false_when_the_listing_fails(self):
+    def test_listing_failure_is_reported_to_the_caller(self):
         with patch.object(main, "_github_paginate", side_effect=RuntimeError("boom")):
-            self.assertFalse(main._matching_review_exists("token", "owner/repo", 7, "abc123"))
+            with self.assertRaises(RuntimeError):
+                main._published_reviews("token", "owner/repo", 7, "abc123")
 
 
 # ── Claiming a label event before the review starts ────────────────────────────
@@ -304,6 +305,11 @@ class TestClaimBeforeReview(_CheckoutTestCase):
         create = create or (lambda *a, **k: "conv-1")
         with (
             patch.object(main, "_prepare_repository", side_effect=prepare),
+            patch.object(
+                main,
+                "_get_agent_dict",
+                return_value={"kind": "Agent", "llm": {"model": "review-model"}},
+            ),
             patch.object(main, "create_conversation", side_effect=create),
             patch.object(main, "_post_github_comment"),
         ):
@@ -332,6 +338,8 @@ class TestClaimBeforeReview(_CheckoutTestCase):
         rec = self.reviews[main._review_key(7, 4242)]
         self.assertEqual(rec["status"], "active")
         self.assertEqual(rec["conversation_id"], "conv-1")
+        self.assertEqual(rec["llm_profile"], "default")
+        self.assertEqual(rec["llm_model"], "review-model")
         self.assertEqual(self.snapshots[-1][main._review_key(7, 4242)]["status"], "active")
 
     def test_a_failed_start_releases_the_claim_so_the_next_poll_retries(self):
@@ -521,6 +529,9 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("AGENTS.md", prompt)
         self.assertIn("CONTRIBUTING.md", prompt)
         self.assertIn("nested `AGENTS.md`", prompt)
+        self.assertIn("supported dependency version", prompt)
+        self.assertIn("custom-codereview-guide.md", prompt)
+        self.assertIn("Never end with APPROVED", prompt)
 
     def test_prompt_uses_native_approval_for_a_clean_review(self):
         prompt = main._build_review_prompt(
@@ -631,6 +642,63 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("move repositories, close, or receive a maintainer decision", prompt)
 
 
+class TestLlmProvenance(unittest.TestCase):
+    def test_review_prompt_names_its_conversation_marker(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            TestRepoReviewGuide()._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+            workspace_instructions="Check out the exact PR head before reviewing.",
+            github_token_secret="FACTORY_GITHUB_REVIEWER_TOKEN",
+            conversation_id="conv-1",
+        )
+
+        # The agent copies the marker; the script, not the agent, appends the
+        # provenance footer to the review that carries it.
+        self.assertIn("`<!-- openhands-review-run: conv-1 -->`", prompt)
+        self.assertIn("do not write that footer yourself", prompt)
+        self.assertNotIn("LLM profile:", prompt)
+        self.assertIn("Check out the exact PR head before reviewing.", prompt)
+        self.assertIn("FACTORY_GITHUB_REVIEWER_TOKEN", prompt)
+        self.assertNotIn("The workspace is already the repository root", prompt)
+
+    def test_fallback_comment_includes_llm_provenance(self):
+        rec = {
+            "conversation_id": "conv-1",
+            "pr_number": 42,
+            "head_sha": "0123456789abcdef",
+            "last_activity": 0.0,
+            "llm_profile": "review-profile",
+            "llm_model": "anthropic/claude-sonnet-4-6",
+        }
+        current_pr = {42: {"head": {"sha": "0123456789abcdef"}}}
+
+        with (
+            patch.object(main.time, "time", return_value=100.0),
+            patch.object(main, "conversation_status", return_value="finished"),
+            patch.object(main, "conversation_final_response", return_value="Review body"),
+            patch.object(main, "_published_reviews", return_value=[]),
+            patch.object(main, "_post_github_comment") as post_comment,
+        ):
+            main._check_conversation_completion(
+                rec,
+                current_pr,
+                "token",
+                "http://agent",
+                "key",
+                "owner/repo",
+            )
+
+        body = post_comment.call_args.args[3]
+        self.assertIn("Review body", body)
+        self.assertIn(
+            "LLM profile: `review-profile` · Model: `anthropic/claude-sonnet-4-6`",
+            body,
+        )
+
+
+
 class TestNormalizeRepo(unittest.TestCase):
     """A repository is written down in more than one way, and every API path in
     this script is built from owner/repo."""

package/skills/github-stale-ci-pr-closer/scripts/worker.py

@@ -79,7 +79,7 @@ def _state_path(repo):
 def _kv_request(key, method, value=None):
     if not KV_TOKEN or not KV_BASE:
         return None
-    data = json.dumps({"value": value}).encode() if value is not None else None
+    data = json.dumps(value).encode() if value is not None else None
     request = Request(
         f"{KV_BASE}/v1/kv/{quote(key, safe='')}",
         data=data,
@@ -101,7 +101,13 @@ def _kv_request(key, method, value=None):
 
 def load_state(repo):
     if KV_TOKEN and KV_BASE:
-        return _kv_request(_state_key(repo), "GET") or {"version": 1, "prs": {}}
+        state = _kv_request(_state_key(repo), "GET") or {"version": 1, "prs": {}}
+        if "prs" not in state and "value" in state:
+            # Earlier versions saved {"value": state}, and the store keeps the
+            # whole body, so each save nested the last one a level deeper.
+            state = state["value"]
+            state.pop("value", None)
+        return state
     path = _state_path(repo)
     if not path.exists():
         return {"version": 1, "prs": {}}

package/skills/gitlab-issue-to-mr/README.md

@@ -62,8 +62,11 @@ OpenHands API in a sandbox of its own, which changes three things:
 - A conversation that ends without a merge request is reported on the issue. The
   script cannot finish the work, because it has no copy of it.
 
-A user with no `GITLAB_TOKEN` secret is served the token of their connected
-GitLab integration instead.
+A GitLab token is used whenever there is one: a `GITLAB_TOKEN` secret, or else the
+token of the user's GitLab sign-in or connected integration. Without a token, a
+connected GitLab MCP server is used directly, by the script and by the
+conversation. Calling GitLab MCP directly needs GitLab 19.4 or later, because the
+tools it uses arrived in 19.3 and 19.4, while a token works with any GitLab.
 
 ## Two setup paths
 
@@ -76,7 +79,11 @@ tarball the automation service runs on a cron, not a prompt handed to an agent.
 
 ## Prerequisites
 
-Set `GITLAB_TOKEN` in OpenHands Settings -> Secrets. It needs the `api` scope and
+On OpenHands Cloud and Enterprise, connect GitLab under Settings - its MCP server
+or the built-in integration, which signing in with GitLab connects - and no secret
+is needed. Calling GitLab MCP directly needs GitLab 19.4 or later, so on an older
+GitLab use the integration. Otherwise set
+`GITLAB_TOKEN` in OpenHands Settings -> Secrets. It needs the `api` scope and
 at least the **Developer** role on every watched project - Developer is the
 lowest role that can push a branch and open a merge request. Leave the configured
 branch prefix out of any protected-branch rule, or the push is rejected.