gitlab-api 27.3.0__py3-none-any.whl → 27.3.2__py3-none-any.whl

gitlab_api/connector_manifest.yml

@@ -0,0 +1,439 @@
+connector: gitlab-api
+ontology_source: gitlab
+schema_version: '1'
+resources:
+- name: Branch
+  label: Branch
+  id_prefix: branch
+  relations: []
+- name: CheckRun
+  label: Check Run
+  id_prefix: checkrun
+  relations: []
+- name: Commit
+  label: Commit
+  id_prefix: commit
+  relations: []
+- name: Epic
+  label: Epic
+  id_prefix: epic
+  relations: []
+- name: GitLabGroup
+  label: GitLab Group
+  id_prefix: gitlabgroup
+  relations: []
+- name: Issue
+  label: Issue
+  id_prefix: issue
+  relations: []
+- name: Job
+  label: Job
+  id_prefix: job
+  relations:
+  - name: ranOnRunner
+    label: ran on runner
+    target: Runner
+    lpg_rel_type: ''
+- name: MergeRequest
+  label: Merge Request
+  id_prefix: mergerequest
+  relations:
+  - name: closesIssue
+    label: closes issue
+    target: Issue
+    lpg_rel_type: ''
+  - name: targetsBranch
+    label: targets branch
+    target: Branch
+    lpg_rel_type: ''
+- name: Milestone
+  label: Milestone
+  id_prefix: milestone
+  relations: []
+- name: Pipeline
+  label: Pipeline
+  id_prefix: pipeline
+  relations:
+  - name: hasJob
+    label: has job
+    target: Job
+    lpg_rel_type: ''
+- name: PipelineRun
+  label: Pipeline Run
+  id_prefix: pipelinerun
+  relations:
+  - name: ranFor
+    label: ran for
+    target: owl:Thing
+    lpg_rel_type: ''
+- name: Project
+  label: Project
+  id_prefix: project
+  relations:
+  - name: partOfGroup
+    label: part of group
+    target: GitLabGroup
+    lpg_rel_type: ''
+- name: Release
+  label: Release
+  id_prefix: release
+  relations: []
+- name: Runner
+  label: Runner
+  id_prefix: runner
+  relations: []
+actions:
+- id: epistemic-answer
+  name: Epistemic Answer
+  description: 'Answers epistemic_status/why/what_changed queries over the shared knowledge graph: calibrated
+    confidence, evidence/source citations, belief justification trees, bitemporal valid/tx history, and
+    policy-redaction-aware provenance.'
+  label: ''
+  parameters: []
+  target_resource: null
+  conflict_policy: null
+  requires_approval: true
+  approval_class: unclassified
+  effects: []
+- id: run_graph_flow
+  name: Graph Flow Execution
+  description: Execute a workflow through the agent's graph orchestration engine
+  label: ''
+  parameters: []
+  target_resource: null
+  conflict_policy: null
+  requires_approval: true
+  approval_class: unclassified
+  effects: []
+events:
+- name: gitlab-projects.updated
+  resource: repository
+  description: "Watermark event for 'gitlab-projects' \u2014 advances on last_activity_at (mcp_source_presets.json)."
+identity:
+  id_field:
+    repository: id
+  title_field:
+    repository: path_with_namespace
+  text_field:
+    repository: description
+  updated_field:
+    repository: last_activity_at
+permissions:
+  acl_fields: []
+  tenant_field: null
+  read_roles: []
+schema_mappings:
+  Branch:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  CheckRun:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Commit:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Epic:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  GitLabGroup:
+    ontology_class: Organization
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Issue:
+    ontology_class: Incident
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Job:
+    ontology_class: Action
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  MergeRequest:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Milestone:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Pipeline:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  PipelineRun:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Project:
+    ontology_class: SoftwareProject
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Release:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+  Runner:
+    ontology_class: null
+    fields:
+      createdAt: xsd:dateTime
+      duration: xsd:decimal
+      failureReason: xsd:string
+      finishedAt: xsd:dateTime
+      iid: xsd:string
+      logUrl: xsd:string
+      pipelineStatus: xsd:string
+      ref: xsd:string
+      sha: xsd:string
+      startedAt: xsd:dateTime
+      state: xsd:string
+      triggerSource: xsd:string
+      webUrl: xsd:string
+sync:
+- preset: gitlab-projects
+  server: gitlab-mcp
+  tool: gitlab_get_projects
+  action: null
+  records_path: data
+  id_field: id
+  title_field: path_with_namespace
+  text_field: description
+  updated_field: last_activity_at
+  pagination: page
+  doc_type: repository
+  tool_schema_sha256: 18b7c440b1165616ba8455535985becf3c14d643a22f40c34d4f321c736c9e06
+  raw:
+    server: gitlab-mcp
+    tool: gitlab_get_projects
+    records_path: data
+    id_field: id
+    title_field: path_with_namespace
+    text_field: description
+    updated_field: last_activity_at
+    pagination: page
+    page_kind: number
+    page_param: page
+    page_size_param: per_page
+    doc_type: repository
+    params_style: args
+provenance:
+  generated_by: scripts/generate_connector_manifests.py
+  generated_at: '2026-10-18T00:00:00Z'
+  source_artifacts:
+  - gitlab_api/connectors/mcp_source_presets.json
+  - gitlab_api/connectors/tool_schema_fingerprints.json
+  - gitlab_api/ontology/gitlab.ttl
+  integrity:
+    algorithm: urdna2015-sha256
+    hash: 832bf7f47b008ce2c318e1d89f2a2a306992994ec0f44d2ee102919eac7bedb4
+    triple_count: 113
+  signer: UNSIGNED-PREVIEW
+  signature_algorithm: none
+  signing_public_key: ''
+  signature: null
+  source_commit: 868761312fcdc217b3f596fcf4cfcc8a173752e6
+policy:
+  pii_fields: {}
+  tenant_boundary: null
+  rls: []
+review_todos:
+- "policy.rls / policy.tenant_boundary are unset \u2014 no row-level-security predicate has been reviewed\
+  \ for this connector."
+- "relation 'authoredBy' has no declared rdfs:domain resolving to a known resource in this connector's\
+  \ ontology \u2014 not attached to any resource; verify its true domain manually."
+- "relation 'belongsToProject' has no declared rdfs:domain resolving to a known resource in this connector's\
+  \ ontology \u2014 not attached to any resource; verify its true domain manually."
+- "relation 'hasMilestone' has no declared rdfs:domain resolving to a known resource in this connector's\
+  \ ontology \u2014 not attached to any resource; verify its true domain manually."
+- "relation 'triggeredPipeline' has no declared rdfs:domain resolving to a known resource in this connector's\
+  \ ontology \u2014 not attached to any resource; verify its true domain manually."
+- "schema_mappings.Branch.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.CheckRun.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Commit.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Epic.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.GitLabGroup.ontology_class = 'Organization' [DRAFT \u2014 nearest hub-canonical-class-by-name\
+  \ heuristic (D16 residue; human sign-off required before use)] \u2014 verify manually before relying\
+  \ on this crosswalk for reasoning/joins."
+- "schema_mappings.Issue.ontology_class = 'Incident' [DRAFT \u2014 nearest hub-canonical-class-by-name\
+  \ heuristic (D16 residue; human sign-off required before use)] \u2014 verify manually before relying\
+  \ on this crosswalk for reasoning/joins."
+- "schema_mappings.Job.ontology_class = 'Action' [DRAFT \u2014 nearest hub-canonical-class-by-name heuristic\
+  \ (D16 residue; human sign-off required before use)] \u2014 verify manually before relying on this crosswalk\
+  \ for reasoning/joins."
+- "schema_mappings.MergeRequest.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Milestone.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Pipeline.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.PipelineRun.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Project.ontology_class = 'SoftwareProject' [DRAFT \u2014 nearest hub-canonical-class-by-name\
+  \ heuristic (D16 residue; human sign-off required before use)] \u2014 verify manually before relying\
+  \ on this crosswalk for reasoning/joins."
+- "schema_mappings.Release.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."
+- "schema_mappings.Runner.ontology_class = None [UNRESOLVED \u2014 no crosswalk found by any heuristic]\
+  \ \u2014 verify manually before relying on this crosswalk for reasoning/joins."

gitlab_api/connector_prep.py

@@ -40,9 +40,14 @@ from pydantic import (
     model_validator,
 )
 
-PREP_CONTRACT_VERSION = "1"
-ARROW_IPC = "arrow_ipc"
-SOURCE = "gitlab-api"
+# A typing.Literal takes literal values, not variable names: each constant
+# has its own literal type, and the fields annotate with that type.
+PrepContractVersion = Literal["1"]
+ArrowIpc = Literal["arrow_ipc"]
+SourceName = Literal["gitlab-api"]
+PREP_CONTRACT_VERSION: PrepContractVersion = "1"
+ARROW_IPC: ArrowIpc = "arrow_ipc"
+SOURCE: SourceName = "gitlab-api"
 DOMAIN = "gitlab"
 
 MAX_PAGE_RECORDS = 100
@@ -76,7 +81,7 @@ class PrepErrorCode(StrEnum):
     FIELD_LIMIT = "field_limit"
     PAGE_LIMIT = "page_too_large"
     RECORD_LIMIT = "record_limit"
-    SECRET = "sensitive_payload"
+    SECRET = "sensitive_payload"  # nosec B105  # sanitizer:ignore - enum value naming a refusal reason, not a credential
     TEXT_LIMIT = "text_limit"
     DUPLICATE_ID = "duplicate_id"
     PATH_ABUSE = "path_or_url_abuse"
@@ -276,7 +281,7 @@ class NamespacePayload(_PrepModel):
 class GitLabProjectPayload(_PrepModel):
     """Versioned strict projection of the GitLab project response."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     id: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
     name: StrictStr
     path_with_namespace: StrictStr
@@ -332,7 +337,7 @@ class GitLabProjectPayload(_PrepModel):
 class GitLabIssuePayload(_PrepModel):
     """Versioned strict projection of the GitLab issue response."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     id: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
     iid: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
     project_id: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
@@ -390,7 +395,7 @@ class GitLabIssuePayload(_PrepModel):
 class GitLabMergeRequestPayload(_PrepModel):
     """Versioned strict projection of the GitLab merge-request response."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     id: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
     iid: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
     project_id: StrictInt = Field(gt=0, le=MAX_IDENTIFIER)
@@ -515,9 +520,9 @@ class ArrowField(_PrepModel):
 class ArrowPrepPlan(_PrepModel):
     """A versioned declaration of the Arrow boundary, not an Arrow runtime."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     record_kind: RecordKind
-    handoff_format: Literal[ARROW_IPC] = ARROW_IPC
+    handoff_format: ArrowIpc = ARROW_IPC
     operations: tuple[StrictStr, ...]
     arrow_schema: tuple[ArrowField, ...]
     engine_dependencies: tuple[StrictStr, ...] = ()
@@ -577,8 +582,8 @@ def arrow_prep_plan(record_kind: RecordKind) -> ArrowPrepPlan:
 class PrepEvidence(_PrepModel):
     """Safe lineage and validation evidence; never stores a source row."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
-    source: Literal[SOURCE] = SOURCE
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
+    source: SourceName = SOURCE
     record_kind: RecordKind
     record_ref: StrictStr
     disposition: PrepDisposition
@@ -754,7 +759,7 @@ class CheckpointOutcome(_PrepModel):
 class Checkpoint(_PrepModel):
     """A page digest plus safe terminal outcomes, suitable for CAS storage."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     stream: StrictStr
     page: StrictInt = Field(ge=1, le=MAX_PAGES)
     cursor_digest: StrictStr | None = None
@@ -833,7 +838,7 @@ class MemoryCheckpointStore:
 class PrepResult(_PrepModel):
     """Page-level result with bounded evidence and checkpoint state."""
 
-    schema_version: Literal[PREP_CONTRACT_VERSION] = PREP_CONTRACT_VERSION
+    schema_version: PrepContractVersion = PREP_CONTRACT_VERSION
     record_kind: RecordKind
     stream: StrictStr
     page: StrictInt = Field(ge=1, le=MAX_PAGES)
@@ -1181,7 +1186,9 @@ def _record_identity(model: BaseModel) -> tuple[object, ...]:
         return ("project", model.id)
     if isinstance(model, GitLabIssuePayload):
         return ("issue", model.project_id, model.iid)
-    return ("merge_request", model.project_id, model.iid)
+    if isinstance(model, GitLabMergeRequestPayload):
+        return ("merge_request", model.project_id, model.iid)
+    raise TypeError(f"no record identity for {type(model).__name__}")
 
 
 class _PageRecordContext(NamedTuple):
@@ -1450,8 +1457,10 @@ class ConnectorPrep:
             if outcome is not None:
                 outcomes.append(outcome)
                 continue
+            if item is None or identity is None:
+                raise RuntimeError("an accepted record has no item or identity")
             seen.setdefault(identity, []).append(ordinal)
-            accepted.append(item)  # type: ignore[arg-type]
+            accepted.append(item)
         return outcomes, accepted, seen
 
     def _drop_duplicate_records(

gitlab_api/gitlab_gql.py

@@ -817,7 +817,7 @@ class GraphQL:
         author_email: str | None = None,
         author_name: str | None = None,
         _stats: bool | None = False,
-        force: bool | None = False,
+        _force: bool | None = False,
     ) -> dict[str, Any]:
         """
         Create a commit in a project.
@@ -1073,8 +1073,8 @@ class GraphQL:
             state: Optional merge request state (e.g., 'opened').
             labels: Optional list of labels (not supported in GraphQL).
             milestone: Optional milestone title (not supported in GraphQL).
-            author_username: Optional author username (not supported in GraphQL).
-            reviewer_username: Optional reviewer username (not supported in GraphQL).
+            author_username: Optional author username filter.
+            reviewer_username: Optional reviewer username filter.
             source_branch: Optional source branch (not supported in GraphQL).
             target_branch: Optional target branch (not supported in GraphQL).
             search: Optional search term (not supported in GraphQL).
@@ -1086,9 +1086,9 @@ class GraphQL:
         """
         MergeRequestModel(project_id=project_id, state=state)  # type: ignore
         query = """
-        query ($fullPath: ID!, $state: MergeRequestState, $first: Int, $after: String) {
+        query ($fullPath: ID!, $state: MergeRequestState, $authorUsername: String, $reviewerUsername: String, $first: Int, $after: String) {
             project(fullPath: $fullPath) {
-                mergeRequests(state: $state, first: $first, after: $after) {
+                mergeRequests(state: $state, authorUsername: $authorUsername, reviewerUsername: $reviewerUsername, first: $first, after: $after) {
                     nodes {
                         iid
                         title
@@ -1106,6 +1106,10 @@ class GraphQL:
         variables = {"fullPath": str(project_id), "first": first}
         if state:
             variables["state"] = state
+        if author_username:
+            variables["authorUsername"] = author_username
+        if reviewer_username:
+            variables["reviewerUsername"] = reviewer_username
         if after:
             variables["after"] = after
         return self.execute_gql(query, variables=variables)
@@ -1347,7 +1351,7 @@ class GraphQL:
         username: str | None = None,
         updated_after: str | None = None,
         updated_before: str | None = None,
-        order_by: str | None = None,
+        _order_by: str | None = None,
         sort: str | None = None,
         first: int | None = 20,
         after: str | None = None,
@@ -1361,8 +1365,8 @@ class GraphQL:
             status: Optional pipeline status filter (not supported in GraphQL).
             source: Optional source filter (not supported in GraphQL).
             username: Optional username filter (not supported in GraphQL).
-            updated_after: Optional updated after filter (not supported in GraphQL).
-            updated_before: Optional updated before filter (not supported in GraphQL).
+            updated_after: Optional filter: pipelines updated after this time.
+            updated_before: Optional filter: pipelines updated before this time.
             order_by: Optional order by field (not supported in GraphQL).
             sort: Optional sort order (not supported in GraphQL).
             first: Number of pipelines to fetch.
@@ -1373,9 +1377,9 @@ class GraphQL:
         """
         PipelineModel(project_id=project_id)
         query = """
-        query ($fullPath: ID!, $first: Int, $after: String) {
+        query ($fullPath: ID!, $updatedAfter: Time, $updatedBefore: Time, $first: Int, $after: String) {
             project(fullPath: $fullPath) {
-                pipelines(first: $first, after: $after) {
+                pipelines(updatedAfter: $updatedAfter, updatedBefore: $updatedBefore, first: $first, after: $after) {
                     nodes {
                         id
                         status
@@ -1390,6 +1394,10 @@ class GraphQL:
         }
         """
         variables = {"fullPath": str(project_id), "first": first}
+        if updated_after:
+            variables["updatedAfter"] = updated_after
+        if updated_before:
+            variables["updatedBefore"] = updated_before
         if after:
             variables["after"] = after
         return self.execute_gql(query, variables=variables)
@@ -2622,9 +2630,9 @@ class GraphQL:
         """
         IssueModel(project_id=project_id)  # type: ignore
         query = """
-        query ($fullPath: ID!, $state: IssueState, $labels: [String!], $assigneeUsernames: [String!], $search: String, $first: Int, $after: String) {
+        query ($fullPath: ID!, $state: IssueState, $labels: [String!], $authorUsername: String, $assigneeUsernames: [String!], $search: String, $first: Int, $after: String) {
             project(fullPath: $fullPath) {
-                issues(state: $state, labels: $labels, assigneeUsernames: $assigneeUsernames, search: $search, first: $first, after: $after) {
+                issues(state: $state, labels: $labels, authorUsername: $authorUsername, assigneeUsernames: $assigneeUsernames, search: $search, first: $first, after: $after) {
                     nodes {
                         iid
                         title
@@ -2643,6 +2651,8 @@ class GraphQL:
             variables["state"] = state
         if labels:
             variables["labels"] = labels  # type: ignore
+        if author_username:
+            variables["authorUsername"] = author_username
         if assignee_username:
             variables["assigneeUsernames"] = [assignee_username]  # type: ignore
         if search:

gitlab_api/mcp_server.py

@@ -35,7 +35,7 @@ from agent_connector_sdk.mcp.tool_surface import register_tool_surface
 from gitlab_api.api_client import Api
 from gitlab_api.auth import get_client
 
-__version__ = "27.3.0"
+__version__ = "27.3.2"
 print(f"Gitlab MCP v{__version__}", file=sys.stderr)
 
 logger = get_logger(name="mcp_server")
@@ -354,10 +354,10 @@ _RUNNERS_ACTIONS: dict[str, Any] = {
     "register": "register_new_runner",
     "delete": "delete_runner",
     "verify_auth": "verify_runner_authentication",
-    "reset_gitlab_token": "reset_gitlab_runner_token",
-    "reset_project_token": "reset_project_runner_token",
-    "reset_group_token": "reset_group_runner_token",
-    "reset_token": "reset_token",
+    "reset_gitlab_token": "reset_gitlab_runner_token",  # nosec B105 - an action name, not a credential
+    "reset_project_token": "reset_project_runner_token",  # nosec B105 - an action name, not a credential
+    "reset_group_token": "reset_group_runner_token",  # nosec B105 - an action name, not a credential
+    "reset_token": "reset_token",  # nosec B105 - an action name, not a credential
 }
 
 #: Action -> Api method for the ``gitlab_tags`` tool.

gitlab_api/ontology/ingest_sources.json

@@ -0,0 +1,19 @@
+{
+  "connector": "gitlab-api",
+  "sources": [
+    {
+      "source_id": "projects",
+      "record_type": "Project",
+      "tools": [
+        "gitlab_get_projects"
+      ],
+      "records_path": "data",
+      "id_field": "id",
+      "title_field": "path_with_namespace",
+      "text_field": "description",
+      "cursor_field": "last_activity_at",
+      "incremental": true,
+      "description": "GitLab projects visible to the configured token."
+    }
+  ]
+}

{gitlab_api-27.3.0.dist-info → gitlab_api-27.3.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-api
-Version: 27.3.0
+Version: 27.3.2
 Summary: GitLab API + MCP Server
 Author-email: Project Maintainers <maintainers@users.noreply.github.com>
 License: MIT
@@ -12,11 +12,11 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.0
+Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.5
 Requires-Dist: python-dotenv>=1.2.4
 Requires-Dist: gql[requests]>=4.4.0
 Provides-Extra: mcp
-Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.0; extra == "mcp"
+Requires-Dist: agent-connector-sdk[mcp]<1.0.0,>=0.3.5; extra == "mcp"
 Provides-Extra: gql
 Requires-Dist: gql[requests]>=4.4.0; extra == "gql"
 Provides-Extra: all
@@ -50,7 +50,7 @@ Dynamic: license-file
 ![PyPI - Wheel](https://img.shields.io/pypi/wheel/gitlab-api)
 ![PyPI - Implementation](https://img.shields.io/pypi/implementation/gitlab-api)
 
-*Version: 27.3.0*
+*Version: 27.3.2*
 
 > **Documentation** — Installation, deployment, usage across the API, CLI, and MCP
 > backing GitLab instance are maintained in the

{gitlab_api-27.3.0.dist-info → gitlab_api-27.3.2.dist-info}/RECORD

@@ -2,14 +2,15 @@ gitlab_api/__init__.py,sha256=AL1xZwPaU1Gzu53VrWYsDptCebPdfucmt3A6yStoPkc,2811
 gitlab_api/__main__.py,sha256=MlKO_lzO6h18UmnI-D20s27-Ej94gQn8Pa0EqOlwFOM,90
 gitlab_api/api_client.py,sha256=Id5iu7ID3fjc-sIAu3QhKyGCUCPy_uXxfZi5VxDkmUc,1087
 gitlab_api/auth.py,sha256=OOY6o1XWDG-ysfgUuOFb_W1bIb9Ub-734ezGVkSirJw,8919
-gitlab_api/connector_prep.py,sha256=9ZZv5-URrGEcgPvHYjXPIqO5x2zMdUa_ijZC6z3zqD8,59658
-gitlab_api/gitlab_gql.py,sha256=86Pd_JjlbMBu58gjzj_wsErXRIyikiLWVG-YvaJl_WI,105610
+gitlab_api/connector_manifest.yml,sha256=mUypgulRxSm7w64CBrvpTg9cxm1f-2WclOLZJaFa8TA,13588
+gitlab_api/connector_prep.py,sha256=f_awZY5i9rvTLNde9iqVA1XLs_iqt5UmK4yLXPSO0Cw,60174
+gitlab_api/gitlab_gql.py,sha256=nBEU7K1RzLmZeZ1qD1U0-9NcRBwMu0xt_I0wDfRkGw8,106270
 gitlab_api/gitlab_input_models.py,sha256=35_ySA8E2GEbuGEjBtFeyiWiuqJMMEp3D2vRELiKwwE,115437
 gitlab_api/gitlab_response_models.py,sha256=m0jU8Xtwbq2y0AogCptVCslWlvi6SztLMDQZLSkefs8,150449
 gitlab_api/instances.py,sha256=RW7aKRvHWMQAQ5ZRRcjpKgpPgq_5YoncXt-_rC4ReXk,5423
 gitlab_api/kg_ingest.py,sha256=Verv5y0OtMYDXmzMoUD5EDUC8PZBiVfTddU5nND38b0,10750
 gitlab_api/mcp_config.json,sha256=2OOXrwO1sDLyHQqpZwhvDHizPIe3by6YmK4KFE333gI,23
-gitlab_api/mcp_server.py,sha256=aSVb3p2glE_Q4IbsDmLVbBKYuDNK4ggI10PapEJ_xzs,51654
+gitlab_api/mcp_server.py,sha256=0Cq9QStZ_YDvciiSNArNJPwALsNWUQbdcE6ffSKRvE8,51850
 gitlab_api/api/__init__.py,sha256=MQblcZQoMdWyzpfnlAOEmyVlP7pbNcz_BQgAs5JINOI,27
 gitlab_api/api/api_client_base.py,sha256=0jdaCaV0tCxbNop6mdtq4nXgbrxEXu-ENoOxVmlaORE,8670
 gitlab_api/api/api_client_environments.py,sha256=2OQ88aStucaKO-VNc6NbXJxQdB761h0aJnPcVaHwBxo,26403
@@ -28,6 +29,7 @@ gitlab_api/connectors/tool_schema_fingerprints.json,sha256=Xnko-DbeAdxlLCbv89u9v
 gitlab_api/ontology/__init__.py,sha256=508Z6ZA4AHEfTFVfTLsenl0Lj_3sfI-MZG8icDzlOSo,568
 gitlab_api/ontology/certification.json,sha256=1Gfxi5Nu-EdYhtsHJYaHW2dqblLhclfVCzaWgM5Cs4w,1650
 gitlab_api/ontology/gitlab.ttl,sha256=qJvCWigVMhMF80HpMwegHGC3cG5pAtC8jBESD4BchXU,8028
+gitlab_api/ontology/ingest_sources.json,sha256=ss1dw8bXIQ4NJLlfji1mZhKTK9zsXxUwUR4zCu3BsPk,457
 gitlab_api/ontology/fixtures/records.json,sha256=XwQXggBTlBkz8Vs_RZdQdT9OjjTPHnhT_QMMEUM1a0A,553
 gitlab_api/ontology/mappings/source.yaml,sha256=FnIGtTh_fKl84C4PFRZPj-QfBrQTtZHQAIwp6fCpXn8,545
 gitlab_api/ontology/migrations/manifest.json,sha256=RCw8U98LQshm7vclWxiJuK2m-fnFElytZda1DcY2Kj4,116
@@ -48,32 +50,34 @@ gitlab_api/skills/gitlab-pipelines/SKILL.md,sha256=OuEk9sRMjJQQzCE2eZtRq9-wgtWRO
 gitlab_api/skills/gitlab-pipelines/WORKFLOW.md,sha256=6C61qo-byMs-7bvry3NKCtyzdRWOEjhC-mOG0ZJvsL0,4314
 gitlab_api/skills/gitlab-vulnerabilities/SKILL.md,sha256=acBODboYBGccTtuCAv5fv5cY_gEXedMSmepur3q9f9Q,5212
 gitlab_api/skills/gitlab-vulnerabilities/WORKFLOW.md,sha256=OKnEKILIrhsnnNQTu0MLSQAWR6jL2w6PuX6ztu0Nhdk,5041
-gitlab_api-27.3.0.dist-info/licenses/LICENSE,sha256=9eAPQLU4cIYQNvAIt6PNoiVQozaVoPRhMV_N7_UHG7A,1068
+gitlab_api-27.3.2.dist-info/licenses/LICENSE,sha256=9eAPQLU4cIYQNvAIt6PNoiVQozaVoPRhMV_N7_UHG7A,1068
 scripts/check_import_safety.py,sha256=IjaMe7nWwK261tNPO8vmLdDy-skX1mpMACQKJhvp0ik,13503
 scripts/security_contract.py,sha256=3517zbvFsLEaWhZOiBwjb9lQiNvH8C-8HzlK4i4SBF8,25137
-scripts/security_sanitizer.py,sha256=gE65xtYMGx43oYUnK0kozBm73Hx97mCdrQUM7GGzIbk,9449
-scripts/verify_api_integration.py,sha256=3AK8HKW52o1yxCDaEUtXngnh7CjYw6NiG9Eb3EIoXNE,10256
+scripts/security_sanitizer.py,sha256=W1LGgsq_uksvJ-oqwHIIcE4szNCCDAWA_PheBYSPnXg,9813
+scripts/verify_api_integration.py,sha256=hblaw-oAf8zas-t-OGgm6XOF-wfSHZihFw7uLO3YzfA,10347
 tests/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tests/conftest.py,sha256=srq80Qcj_VFRxMFCYZ6pXtEDfXO1PzVY-HEI4kmm29s,2090
 tests/test_api_wrapper.py,sha256=jUXDVR4lKOZLTvE3vAS8Xjkc4q57smd6MJr7u_eBU9U,5717
-tests/test_auth.py,sha256=4Fn0JFvGW5wxUu3-gJQEZO0agLrtOw8LEQ6HH5uYKLk,4420
-tests/test_connector_prep.py,sha256=m4cGbZlfmZLcai7ShUiiip5a-QvNVy8WQ-P9jaVcAFM,10714
+tests/test_auth.py,sha256=dpiDD9Z5SfN6re59tb22PqkbsY8A8pWOBX9KuoXoTTc,4404
+tests/test_connector_prep.py,sha256=YgPoTq0nFqsZ4HA1Iq7F_jJlKxscePvgQJREZB3bczk,10770
 tests/test_gitlab_a2a_validation.py,sha256=Wxu7zSIxnmT5bOg-BwFvR6z9TprSzObG5mIEC4NBwwM,5130
 tests/test_gitlab_api_brute_force_coverage.py,sha256=yS3LoPE6JCC2jcI2agYmNI8kpSBK9jAZsmGnrYq-mPU,14294
 tests/test_gitlab_gql.py,sha256=UVMGoYCkaB3EjyGouADp98AYzkyRv7iR-NweHhMrwtQ,11198
 tests/test_gitlab_mcp_validation.py,sha256=Ma2e3ZchIVUHF0OJPPAW1DRYEG6X-I6dUFRpLE31Rwk,2423
 tests/test_gitlab_models.py,sha256=9buJwE0VmioDXRcKlCfcKYgg6PdQnx7HvDRBPnMC3Ak,542220
 tests/test_identity_context_scoping.py,sha256=wY_xb37E7qd91F5NNhf0g2Hv1uRyrM0wnCO_6WEEcW4,2269
+tests/test_ingest_sources.py,sha256=XCPTezZIdauzQdrIR9P5KiXG9ZuB1YfvIXGVuAo6Hks,1347
 tests/test_init_dynamics.py,sha256=fsfRhuT6yCY91JXoHd7gbHfuPjZfLW0A7aJgyXptL6E,1693
 tests/test_instances.py,sha256=C8csQIJPv1Wdbh4Le2JBg1pM7iFo5rYfL-vp_aGwOtA,4167
 tests/test_kg_ingest.py,sha256=sgo6KNYKs7xbvbmKZDOXpHDhb3YkXvxjWsIELpxcAGI,7633
 tests/test_mock_coverage.py,sha256=yO5A8ZP3UxTx1fO-T15p2Dy74EZaXRHgUyBXfhqN96k,11053
+tests/test_security_sanitizer.py,sha256=l7huytJgfHmS8fmTiNPkX85eRrcRrnqu3fOJYKugD4E,1070
 tests/test_startup.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tests/test_tool_modes.py,sha256=aiAaQE0yXp9SKGz9BVgik4HIjE5kar8FBD9uVOK5pwA,721
 tests/test_verify_agent.py,sha256=XdW2NtR5643rgjDYLu6RajWu-4wqrZjCUsRehfsKCqQ,6465
 tests/verify_a2a_queries.py,sha256=JMKBexwzo6c59NpVrBfYgW4HnmSG8-qqfdeku5YFtwc,3613
-gitlab_api-27.3.0.dist-info/METADATA,sha256=3i4OzlUaSNYLDO6R_3mdL5fAMCbRiCLj5uUrodvjAew,40527
-gitlab_api-27.3.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-gitlab_api-27.3.0.dist-info/entry_points.txt,sha256=-FUZqPa8FPHty3mGFhNlFRajrMh6fgSgV8fcxAI1KTA,366
-gitlab_api-27.3.0.dist-info/top_level.txt,sha256=fJ-T_zkuttbq8Kn1dq0mBvyjtKqPdMic01oCdbzxh_k,48
-gitlab_api-27.3.0.dist-info/RECORD,,
+gitlab_api-27.3.2.dist-info/METADATA,sha256=umVBzzDghYU6_Ey2fpEuH4PPnDm1BiMgxKBcNXZ_cUs,40527
+gitlab_api-27.3.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+gitlab_api-27.3.2.dist-info/entry_points.txt,sha256=-FUZqPa8FPHty3mGFhNlFRajrMh6fgSgV8fcxAI1KTA,366
+gitlab_api-27.3.2.dist-info/top_level.txt,sha256=fJ-T_zkuttbq8Kn1dq0mBvyjtKqPdMic01oCdbzxh_k,48
+gitlab_api-27.3.2.dist-info/RECORD,,

scripts/security_sanitizer.py

@@ -232,7 +232,15 @@ def _should_secret_scan(file_path: Path) -> bool:
     return True
 
 
+#: The fleet's one inline exemption: ``# sanitizer:ignore - <reason>`` on the
+#: exact line of a reviewed synthetic literal. A bare marker without a reason
+#: exempts nothing; there is no file-, path- or value-level exemption.
+SANITIZER_IGNORE_RE = re.compile(r"#\s*sanitizer:ignore\s*[-\u2014:]\s*\S")
+
+
 def _secret_violations_in_line(line: str, rel_path: Path, idx: int):
+    if SANITIZER_IGNORE_RE.search(line):
+        return []
     violations = []
     for label, pattern in SECRET_PATTERNS:
         for match in pattern.findall(line):

scripts/verify_api_integration.py

@@ -3,6 +3,7 @@ import os
 import ast
 import glob
 import sys
+from typing import TypeGuard
 
 BASELINES = {
     "adguard-home-agent": 89.2,
@@ -35,7 +36,9 @@ def _is_api_client_class(node: ast.ClassDef) -> bool:
     return "api" in class_name or "client" in class_name or node.name == "Api"
 
 
-def _is_public_client_method(item) -> bool:
+def _is_public_client_method(
+    item: ast.stmt,
+) -> TypeGuard[ast.FunctionDef | ast.AsyncFunctionDef]:
     return (
         isinstance(item, (ast.FunctionDef, ast.AsyncFunctionDef))
         and not item.name.startswith("_")

tests/test_auth.py

@@ -44,7 +44,7 @@ def test_get_client_oidc_delegation(monkeypatch):
     monkeypatch.setattr(
         delegation,
         "exchange_token",
-        lambda settings, *, subject_token, http_client, resolver=None: AccessToken(
+        lambda settings, *, subject_token, http_client, **_unused: AccessToken(
             value="delegated_tok", ttl_seconds=3600, expires_at=0.0
         ),
     )
@@ -63,7 +63,7 @@ def test_get_client_oidc_delegation_failed(monkeypatch):
 
     monkeypatch.setattr(delegation, "current_user_token", lambda: "caller-token")
 
-    def _boom(settings, *, subject_token, http_client, resolver=None):
+    def _boom(settings, *, subject_token, http_client, **_unused):
         raise ValueError("Exchange failed")
 
     monkeypatch.setattr(delegation, "exchange_token", _boom)
@@ -98,7 +98,7 @@ def test_get_graphql_client_oidc_delegation(monkeypatch):
     monkeypatch.setattr(
         delegation,
         "exchange_token",
-        lambda settings, *, subject_token, http_client, resolver=None: AccessToken(
+        lambda settings, *, subject_token, http_client, **_unused: AccessToken(
             value="delegated_tok", ttl_seconds=3600, expires_at=0.0
         ),
     )
@@ -116,7 +116,7 @@ def test_get_graphql_client_oidc_delegation_failed(monkeypatch):
 
     monkeypatch.setattr(delegation, "current_user_token", lambda: "caller-token")
 
-    def _boom(settings, *, subject_token, http_client, resolver=None):
+    def _boom(settings, *, subject_token, http_client, **_unused):
         raise ValueError("Exchange failed")
 
     monkeypatch.setattr(delegation, "exchange_token", _boom)

tests/test_connector_prep.py

@@ -217,7 +217,7 @@ def test_malformed_records_are_quarantined_without_commit(
 
 def test_secret_payload_is_redacted_from_evidence(context: PrepContext) -> None:
     prep, recorder = _prep()
-    secret = "glpat-should-never-be-retained"
+    secret = "glpat-should-never-be-retained"  # sanitizer:ignore - synthetic token proving redaction
     result = prep.process_page(
         "project",
         [{**_project(), "private_token": secret}],

tests/test_ingest_sources.py

@@ -0,0 +1,35 @@
+"""The packaged ingestible-source declaration (CONN-GITLAB-API-R001)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+from agent_connector_sdk.ingest.sources import load_ingest_sources
+from agent_connector_sdk.mcp.method_tools import operation_annotations, operation_verb
+from agent_connector_sdk.mcp.tool_surface import operation_prefix
+
+import gitlab_api
+from gitlab_api.api_client import Api
+
+
+@pytest.mark.spec("CONN-GITLAB-API-R001")
+def test_declares_ingestible_sources() -> None:
+    declaration = load_ingest_sources(Path(gitlab_api.__file__).parent)
+    assert declaration is not None
+    assert declaration.connector == "gitlab-api"
+    source = declaration.source("projects")
+    assert source is not None and source.record_type == "Project"
+    prefix = operation_prefix("gitlab-api")
+    assert source.tools == (f"{prefix}_get_projects",)
+    # The engine admits a record only under the pack mapping of its type.
+    manifest = yaml.safe_load(
+        (Path(gitlab_api.__file__).parent / "connector_manifest.yml").read_text(
+            "utf-8"
+        )
+    )
+    assert source.record_type in manifest["schema_mappings"]
+    method = getattr(Api, "get_projects")
+    annotations = operation_annotations("get_projects", operation_verb(method))
+    assert annotations.read_only_hint is True

tests/test_security_sanitizer.py

@@ -0,0 +1,30 @@
+"""The sanitizer's inline exemption marker is narrow (one justified line)."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+_SPEC = importlib.util.spec_from_file_location(
+    "security_sanitizer", Path(__file__).parents[1] / "scripts" / "security_sanitizer.py"
+)
+assert _SPEC is not None and _SPEC.loader is not None
+sanitizer = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(sanitizer)
+
+TOKEN = "glpat-" + "abcdefghijklmnopqrst"  # sanitizer:ignore - synthetic test token
+
+
+def test_unmarked_secret_is_reported() -> None:
+    line = f'token = "{TOKEN}"'
+    assert sanitizer._secret_violations_in_line(line, Path("x.py"), 1)
+
+
+def test_justified_marker_exempts_only_its_line() -> None:
+    marked = f'token = "{TOKEN}"  # sanitizer:ignore - synthetic fixture'
+    assert sanitizer._secret_violations_in_line(marked, Path("x.py"), 1) == []
+
+
+def test_bare_marker_exempts_nothing() -> None:
+    bare = f'token = "{TOKEN}"  # sanitizer:ignore'
+    assert sanitizer._secret_violations_in_line(bare, Path("x.py"), 1)