Repository navigation
Rate versions with the GitLab version check service - #10
Merged
Merged
Conversation
Tag matching against gitlab-foss failed for every EE instance (revision never matches a foss tag commit), read only the first 20 tags by update date and reported any difference to the newest tag as CRITICAL. - read the installed version from /api/v4/metadata instead of the deprecated /api/v4/version - rate it with version.gitlab.com/check.json, as GitLab's own version badge does: success -> OK, warning -> WARNING, danger or critical_vulnerability -> CRITICAL - print installed version, latest patch release of the installed minor and latest release; no HTML in the output - read the token from CHECK_GITLAB_VERSION_TOKEN, reject tokens with characters invalid in HTTP headers so they never end up in an error message, document a read_user personal access token as least privilege - never follow redirects, cap responses at 1 MiB, --timeout per request (default 10 s instead of 30 s), usage errors exit UNKNOWN (3) - accept a base URL in --host besides a host name - replace requests with urllib from the standard library - test against a local HTTP server, including timeouts, redirects, invalid responses and running the plugin as a process; coverage 100 % - CI: separate lint job, tests on Python 3.9 to 3.15, pylint 4.1.3 BREAKING CHANGE: new output format and states (an available non-security update is WARNING instead of CRITICAL); CHECK_GITLAB_VERSION_URL is replaced by --version-check-url; requests is no longer a dependency. Assisted-by: claude-code:claude-opus-5-5 Signed-off-by: Marius Hein <marius.hein@netways.de>
actions/python-versions has no Python 3.9 build for Ubuntu 26.04 (ubuntu-latest), so the 3.9 job failed in setup-python and fail-fast cancelled the other versions. - run 3.9 on ubuntu-24.04, all other versions on ubuntu-latest - set fail-fast: false so every version reports its result Assisted-by: claude-code:claude-opus-5-5 Signed-off-by: Marius Hein <marius.hein@netways.de>
On GitLab CE, the REST API accepts ai_features only for /api/v4/metadata and /api/v4/version, so a group or project access token with this scope can read the version and nothing else. Verified on GitLab 19.5 CE: projects, groups, users, search, GraphQL and Git are denied. - README: ai_features group/project access token (role Guest) as the recommended token, including an API call to create it; note that the scope also grants GitLab Duo API access on EE - README: read_user personal access token as the alternative, warn against read_api and api (read access to all internal projects) - --token help: name both scopes Assisted-by: claude-code:claude-opus-5-5 Signed-off-by: Marius Hein <marius.hein@netways.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrite of the plugin. The state is now based on the rating of the GitLab version check service (
version.gitlab.com/check.json), the same service GitLab uses for the version badge in the Admin area. Before, the plugin compared the installed version with the Git tags on gitlab.com and reported every difference as CRITICAL.Changes
/api/v4/metadata;/api/v4/versionis deprecated.CHECK_GITLAB_VERSION_TOKENor--token. It needs only theai_featuresscope (group or project access token, role Guest) orread_user(personal access token), instead ofread_api.version.gitlab.com. Redirects are never followed, so the token cannot leak to a redirect target. Response size is limited to 1 MiB.requestsmodule is no longer needed. Python 3.9 or newer.CHECK_GITLAB_VERSION_URLis replaced by--version-check-url. New option--timeout(default 10 s).Breaking changes
Output format, states and the required token scope change. See "Upgrading from 0.1.0" in the README.
Tests
--fail-under 100).ai_featuresgroup access token.