code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Use GitLab API for cloud agent MRs #432

Merged
PlasticDigits merged 1 commit from cursor/cloud-agent-glab-api-mrs-2526 into main 2026-06-06 14:52:14 +00:00
Conversation 3 Commits 1 Files changed 2 +45 -22
PlasticDigits commented 2026-06-06 14:51:24 +00:00 (Migrated from gitlab.com)

Summary

  • Update AGENTS cloud-agent instructions to explicitly require glab api / scripts/glab-mr-create.sh for GitLab MRs instead of Cursor platform/GitHub PR tooling.
  • Rework scripts/glab-mr-create.sh so it creates MRs with glab api projects/:id/merge_requests instead of high-level glab mr create, avoiding the PlasticDigits/yieldomega.git 404 observed on Cloud VMs.

Related issues

Related to the cloud-agent MR creation workflow discovered after !430.

Layers touched

  • scripts / devops (scripts/, .cursor/, CI)
  • docs only (no runtime product behavior change)

Verification

Layer Command Result
scripts bash -n scripts/glab-mr-create.sh && bash scripts/glab-mr-create.sh --help PASS
docs/devops git diff -- AGENTS.md scripts/glab-mr-create.sh PASS
MR creation bash scripts/glab-mr-create.sh --title "Use GitLab API for cloud agent MRs" --description ... PASS

Notes for reviewers

This intentionally avoids the Cursor platform PR tool and high-level glab mr create; the helper now posts directly to GitLab REST using GITLAB_TOKEN.

## Summary - Update AGENTS cloud-agent instructions to explicitly require `glab api` / `scripts/glab-mr-create.sh` for GitLab MRs instead of Cursor platform/GitHub PR tooling. - Rework `scripts/glab-mr-create.sh` so it creates MRs with `glab api projects/:id/merge_requests` instead of high-level `glab mr create`, avoiding the `PlasticDigits/yieldomega.git` 404 observed on Cloud VMs. ## Related issues Related to the cloud-agent MR creation workflow discovered after !430. ## Layers touched - [x] **scripts / devops** (`scripts/`, `.cursor/`, CI) - [x] **docs only** (no runtime product behavior change) ## Verification | Layer | Command | Result | |-------|---------|--------| | scripts | `bash -n scripts/glab-mr-create.sh && bash scripts/glab-mr-create.sh --help` | PASS | | docs/devops | `git diff -- AGENTS.md scripts/glab-mr-create.sh` | PASS | | MR creation | `bash scripts/glab-mr-create.sh --title "Use GitLab API for cloud agent MRs" --description ...` | PASS | ## Notes for reviewers This intentionally avoids the Cursor platform PR tool and high-level `glab mr create`; the helper now posts directly to GitLab REST using `GITLAB_TOKEN`.
PlasticDigits commented 2026-06-06 14:52:14 +00:00 (Migrated from gitlab.com)

mentioned in commit 4ba06e1be4

mentioned in commit 4ba06e1be431c806e52d1c8268475203f9aa1c2a
PlasticDigits (Migrated from gitlab.com) merged commit 4ba06e1be4 into main 2026-06-06 14:52:14 +00:00
ghost1 commented 2026-06-06 14:54:51 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: 6af591594258853bf077343152c16916f55b24ac
Scope: scripts/glab-mr-create.sh (switch from glab mr create to glab api projects/:id/merge_requests) and AGENTS.md documentation updates for Cloud Agent MR workflow.

Outcome: FINDINGS: 0 medium+

Summary

Reviewed the MR diff for injection, authz bypass, secret leakage, SSRF, and unsafe input handling on the new GitLab REST API path.

  • API parameters (source_branch, target_branch, title, description, labels) are passed via glab api -f (--raw-field), which sends literal strings and does not interpret @file uploads (that behavior is --field only). Values are assembled in a quoted bash array, so metacharacters in branch names or descriptions are not re-evaluated by the shell.
  • Removing passthrough EXTRA args to high-level glab mr create reduces unexpected flag injection; unknown CLI options now fail closed.
  • GITLAB_TOKEN is required and not echoed; the helper only logs the API endpoint and branch names.
  • TEMPLATE_NAME path construction allows .. segments, but this is a local agent-only helper where the caller controls CLI flags; no plausible remote attacker path without VM compromise or prompt injection against the agent (out of scope for this diff).
  • GITLAB_REPO / project slug remains caller-controlled via env (pre-existing); token scope is the real boundary.

No medium, high, or critical vulnerabilities with a plausible attack path were identified in this diff.

Inline threads: none (no findings).

## Security review **Commit reviewed:** `6af591594258853bf077343152c16916f55b24ac` **Scope:** `scripts/glab-mr-create.sh` (switch from `glab mr create` to `glab api projects/:id/merge_requests`) and `AGENTS.md` documentation updates for Cloud Agent MR workflow. **Outcome:** `FINDINGS: 0` medium+ ### Summary Reviewed the MR diff for injection, authz bypass, secret leakage, SSRF, and unsafe input handling on the new GitLab REST API path. - **API parameters** (`source_branch`, `target_branch`, `title`, `description`, `labels`) are passed via `glab api -f` (`--raw-field`), which sends literal strings and does not interpret `@file` uploads (that behavior is `--field` only). Values are assembled in a quoted bash array, so metacharacters in branch names or descriptions are not re-evaluated by the shell. - **Removing passthrough `EXTRA` args** to high-level `glab mr create` reduces unexpected flag injection; unknown CLI options now fail closed. - **`GITLAB_TOKEN`** is required and not echoed; the helper only logs the API endpoint and branch names. - **`TEMPLATE_NAME` path construction** allows `..` segments, but this is a local agent-only helper where the caller controls CLI flags; no plausible remote attacker path without VM compromise or prompt injection against the agent (out of scope for this diff). - **`GITLAB_REPO` / project slug** remains caller-controlled via env (pre-existing); token scope is the real boundary. No medium, high, or critical vulnerabilities with a plausible attack path were identified in this diff. **Inline threads:** none (no findings).
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit 86d897a929

mentioned in commit 86d897a929417bc3be2dfff7955cf38c04b1a17d
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!432
No description provided.