Give ci-workflow-review first-class GitLab coverage#53
Merged
Conversation
The skill named GitLab CI in scope but its concrete patterns were all GitHub-specific, so a GitLab review leaned on the agent to translate and could miss GitLab-only hazards. Each checklist category now names both platforms' mechanics, grounded in GitLab's pipeline security, CI/CD job token, and runner security docs: - injection: $CI_MERGE_REQUEST_TITLE / $CI_COMMIT_MESSAGE into script: alongside the github.event equivalents - PPE: fork MR pipelines running the fork's edited .gitlab-ci.yml - token scope: CI_JOB_TOKEN allowlist and masked/protected variables alongside GITHUB_TOKEN permissions - pinning: remote include:/CI-CD Catalog components and image digests - runners: privileged Docker/DinD and shell executors on shared runners (CI_JOB_TOKEN and cross-project source theft) Adds a GitLab eval fixture (privileged DinD runner + MR-title injection in a fork-reachable job) next to the existing GitHub one; the eval runner and structure test now allow multiple fixtures per skill via a <skill>-<variant> directory suffix. Bumped to 0.2.0; plugin tree regenerated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #52. The skill listed GitLab CI as in-scope but every concrete pattern was GitHub-flavored, so a
.gitlab-ci.ymlreview was directionally right yet leaned on the agent to translate — and could miss GitLab-only hazards (privileged DinD runners, protected-variable boundaries, job-token allowlist).Each checklist category now names both platforms' mechanics, grounded in sources fetched before writing — GitLab pipeline security, CI/CD job token, runner security:
$CI_MERGE_REQUEST_TITLE/$CI_COMMIT_MESSAGEintoscript:beside thegithub.eventcases.gitlab-ci.yml(thepull_request_targetanalogue)CI_JOB_TOKENallowlist + masked/protected variables besideGITHUB_TOKENpermissionsinclude:/ CI-CD Catalog components andimage:digestsAdds a GitLab eval fixture (privileged DinD runner + MR-title injection in a fork-reachable job) alongside the GitHub one; the runner and structure test now allow multiple fixtures per skill via a
<skill>-<variant>directory suffix. Bumped to 0.2.0, plugin tree regenerated, 125 tests pass.🤖 Generated with Claude Code