vitaly.nikitenko/ai-setup
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(rules): document per-project GitLab tokens

Browse Source 
GitLab access uses project access tokens, one per project, and a token from
another project answers 404 instead of 403 - a wrong token is indistinguishable
from a missing project. Nothing described where those tokens live, so agents
either guessed or gave up.

Added section 10 with the file -> project mapping (superapp-launcher,
common-library, smart_home), a working curl example, and the note that the
generic `gitlab_token` fallback is gone: helpers such as eltex-review need an
explicit --token-file.
This commit is contained in:
Виталий Никитенко
2026-08-12 11:24:06 +03:00
parent ee32371d30
commit 7304c5c84b
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
home-configs/GLOBAL_RULES.md
View File

@@ -70,3 +70,22 @@ Use these defaults across projects, then apply any more specific repository inst
``` ```
- Read `issue.description`, `issue.status.name`, and recent non-empty `issue.journals[].notes`. If the key is missing or the request fails, report that instead of guessing the task requirements. - Read `issue.description`, `issue.status.name`, and recent non-empty `issue.journals[].notes`. If the key is missing or the request fails, report that instead of guessing the task requirements.
- Never print, log, or write the API key into repository files. - Never print, log, or write the API key into repository files.
## 10. GitLab (gitlab.eltex.loc)
- GitLab access uses **per-project** tokens stored in `~/.config/ai-setup/` (mode 600). Each one is a project access token and works only for its own project:
| File | Project | id |
| :--- | :--- | :--- |
| `gitlab_token_superapp` | `voip/vp-apps/superapp-launcher` | 4928 |
| `gitlab_token_common_library` | `voip/vp-apps/common-library` | 4825 |
| `gitlab_token_smart_home` | `android_apps/smart_home` | 1409 |
- Pick the file matching the project you are working with. A token from another project returns HTTP 404, not 403, so a wrong token looks exactly like a missing project — check the token before concluding the resource does not exist.
```bash
curl -fsS -H "PRIVATE-TOKEN: $(cat ~/.config/ai-setup/gitlab_token_superapp)" \
"https://gitlab.eltex.loc/api/v4/projects/4928/merge_requests/241"
```
- There is no generic `gitlab_token` fallback any more. Tools that accept an explicit token path (for example the `eltex-review` helper) must be given `--token-file <path>`.
- `local.properties` in superapp-launcher also holds `gitlab.token` and `redmine.apiKey`; it is gitignored and must stay that way.
- Never print, log, or write these tokens into repository files.