From 7304c5c84ba1d4966d08fd13525f0b61961c183f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=92=D0=B8=D1=82=D0=B0=D0=BB=D0=B8=D0=B9=20=D0=9D=D0=B8?= =?UTF-8?q?=D0=BA=D0=B8=D1=82=D0=B5=D0=BD=D0=BA=D0=BE?= Date: Wed, 12 Aug 2026 11:24:06 +0300 Subject: [PATCH] docs(rules): document per-project GitLab tokens GitLab access uses project access tokens, one per project, and a token from another project answers 404 instead of 403 - a wrong token is indistinguishable from a missing project. Nothing described where those tokens live, so agents either guessed or gave up. Added section 10 with the file -> project mapping (superapp-launcher, common-library, smart_home), a working curl example, and the note that the generic `gitlab_token` fallback is gone: helpers such as eltex-review need an explicit --token-file. --- home-configs/GLOBAL_RULES.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/home-configs/GLOBAL_RULES.md b/home-configs/GLOBAL_RULES.md index cdedfb6..db6df97 100644 --- a/home-configs/GLOBAL_RULES.md +++ b/home-configs/GLOBAL_RULES.md @@ -70,3 +70,22 @@ Use these defaults across projects, then apply any more specific repository inst ``` - Read `issue.description`, `issue.status.name`, and recent non-empty `issue.journals[].notes`. If the key is missing or the request fails, report that instead of guessing the task requirements. - Never print, log, or write the API key into repository files. + +## 10. GitLab (gitlab.eltex.loc) + +- GitLab access uses **per-project** tokens stored in `~/.config/ai-setup/` (mode 600). Each one is a project access token and works only for its own project: + + | File | Project | id | + | :--- | :--- | :--- | + | `gitlab_token_superapp` | `voip/vp-apps/superapp-launcher` | 4928 | + | `gitlab_token_common_library` | `voip/vp-apps/common-library` | 4825 | + | `gitlab_token_smart_home` | `android_apps/smart_home` | 1409 | + +- Pick the file matching the project you are working with. A token from another project returns HTTP 404, not 403, so a wrong token looks exactly like a missing project — check the token before concluding the resource does not exist. + ```bash + curl -fsS -H "PRIVATE-TOKEN: $(cat ~/.config/ai-setup/gitlab_token_superapp)" \ + "https://gitlab.eltex.loc/api/v4/projects/4928/merge_requests/241" + ``` +- There is no generic `gitlab_token` fallback any more. Tools that accept an explicit token path (for example the `eltex-review` helper) must be given `--token-file `. +- `local.properties` in superapp-launcher also holds `gitlab.token` and `redmine.apiKey`; it is gitignored and must stay that way. +- Never print, log, or write these tokens into repository files.