[erichare]

Adds GitLab project, issue, merge request, and comment actions plus signed issue and merge request triggers. Connections verify the token owner's identity, actual api scope, issuing instance, and provider expiration. Project webhooks use Standard Webhooks HMAC signatures and reject unsigned or unrelated deliveries.

Depends on the shared provider runtime. Both PRs target release-1.14.0. The GitLab bundle is registered in the default package inventory, reviewed profile, lockfile, and versioned provider contract.

Each trigger commits a pending callback reservation before provider creation. A lost create response still leaves a durable cleanup target. Retries recover the exact callback and HMAC ownership marker without duplicating hooks. Pause and delete reconcile unknown hook IDs within the original project, and cleanup proves the original GitLab user before deletion. Owner deletion retains only the existing bounded sealed access token. Re-enable waits for cleanup, and update actions preserve unspecified fields.

Verification

The Python commands used an existing read-only langflow-base and lfx dev environment with UV_NO_SYNC=1. Backend PYTHONPATH pointed to this worktree and the temporary installed GitLab wheel.

• uv build src/bundles/gitlab --wheel --out-dir /private/tmp/le-3197-dist built the wheel.
• uv pip install --python /Users/erichare/.codex/worktrees/le-3191-trigger-replicas/langflow/.venv/bin/python --no-deps --reinstall --target /private/tmp/le-3197-installed /private/tmp/le-3197-dist/lfx_gitlab-0.1.0-py3-none-any.whl installed it into an isolated target.
• PYTHONPATH=src/lfx/src:/private/tmp/le-3197-installed uv run --no-sync pytest src/bundles/gitlab/tests -o addopts='' -q --confcutdir=src/bundles/gitlab passed 60 tests with backend imports blocked.
• uv run --no-sync pytest src/backend/tests/unit/services/triggers/test_gitlab_provider.py src/backend/tests/unit/services/triggers/test_gitlab_lifecycle.py -o addopts='' -o log_cli=false -q --tb=short --timeout=60 --maxfail=1 passed 69 tests. These cover installed catalog ownership, save, enable, signed ingress, deduplication, dispatch, pause, cleanup, and refusal paths.
• uv run --no-sync python scripts/ci/check_capability_manifests.py passed with four manifests.
• uv run --no-sync python scripts/ci/manage_bundle_profiles.py check passed.
• uv lock --check --offline passed with 866 resolved packages.
• uv run --no-sync python scripts/ci/bundle_release_plan.py plan --base-ref 5af9a26d1d3a742bc36731f9239e9fff688f7a06 --check --output /private/tmp/le-3197-release-plan.json marked lfx-gitlab 0.1.0 ready.
• Scoped Ruff lint and format checks, git diff --check, and protected commit hooks passed.

uv run --no-sync pytest scripts/ci/test_provider_integration_contracts.py scripts/ci/test_capability_manifests.py -o addopts='' -o log_cli=false -q --tb=short passed 44 tests after the final shared contract fixes.

Live GitLab tenant acceptance remains unverified. This preview requires GitLab 19.1 or newer and one public HTTPS GitLab origin configured by the operator. Personal tokens require manual replacement before expiration. Desktop triggers, private-only origins, path-prefix installations, custom ports, polling backfill, and project or group tokens remain unsupported. Bot metadata can be absent, so own-actor filtering is the primary default loop guard. Owner acceptance remains pending in the provider contract.

Final review and verification addendum

uv run --no-sync pytest src/bundles/gitlab/tests -q -o addopts= -o cache_dir=/private/tmp/le2477-palette-pytest — 71 passed from source and again against the rebuilt installed wheel. Real palette template construction covers every exported component; previous internal helper imports remain aliases.

uv run --no-sync pytest -q -p no:cacheprovider src/backend/tests/unit/services/triggers/test_gitlab_lifecycle.py -k 'unknown_remote_id or unknown_id_cleanup or pending_intent or unproven_callback or reservation_is_durable or sealed_cleanup_snapshot or cleanup_checks_remote or duplicate_remote' — 17 passed. Unknown remote IDs remain recoverable without deleting unproven callbacks.

The installed nine-provider validation passed 445 backend tests and built all 58 real component templates. The exact aggregate commands and shared-runtime results are recorded in #15947. Independent code, Python, and security review found no unresolved confirmed provider findings.

Source checkpoint: fcb528de7cbd781cc7743c0fced20ac584bb9c93. GitHub Actions CI, Mend scan, and PR checks.

Live GitLab tenant acceptance remains unverified.

Verification after conflict resolution

The final head is 4da04f6168. It includes the reviewed common changes from 7702a4a514 and the release squash 0b9eaeccdf. Its source tree matches tested merge 3b8ae27 exactly.

Merge conflicts are resolved. The provider contract entry and implementation were preserved. Shared files retain the reviewed response validation and audit fix, both sets of locale keys, and the approved label exceptions. Shared runtime regression results are recorded separately in #15947.

Provider runtime and lifecycle tests passed 69 tests. The CI script suite passed 716 tests with 1 skip. Backend tests used UV_PROJECT_ENVIRONMENT=/private/tmp/secret-sync-oss-venv, UV_CACHE_DIR=/private/tmp/open-pr-audit-20261023/uv-cache, and PYTHONPATH=src/backend/base:src/lfx/src:src/sdk/src:src/bundles/gitlab/src:/private/tmp/open-pr-audit-20261023/gitlab-installed.

uv run --no-sync pytest src/backend/tests/unit/services/triggers/test_gitlab_provider.py src/backend/tests/unit/services/triggers/test_gitlab_lifecycle.py -q -o addopts= -o log_cli=false -o cache_dir=/private/tmp/open-pr-audit-20261023/gitlab-backend-cache --tb=short --show-capture=no
uv run --no-sync pytest scripts/ci -q -o addopts= -o log_cli=false -o cache_dir=/private/tmp/open-pr-audit-20261023/gitlab-ci-cache --tb=short --show-capture=no

Release planning and bundle profile checks passed. Commit hooks and secret scans passed.

uv run --no-sync scripts/ci/bundle_release_plan.py plan --base-ref 0b9eaeccdf77abf37af994da89d458c82aad24e2 --head-ref HEAD --check --output /private/tmp/open-pr-audit-20261023/gitlab-release-plan.json
uv run --no-sync scripts/ci/manage_bundle_profiles.py check

GitHub reports no merge conflicts against the current release. New CI checks are still running. Live provider acceptance remains unverified.

Summary by CodeRabbit

• New Features

  • Added preview GitLab support for retrieving, creating, and updating projects, issues, merge requests, and comments.
  • Added GitLab issue and merge-request triggers with configurable events and webhook delivery.
  • Added provider token setup, including scope verification and optional expiration requirements.
  • Expanded trigger integrations to support installed providers with compatible polling, webhook, and OAuth capabilities.

• Documentation

  • Added setup guidance, supported configurations, and limitations for GitLab integrations and provider triggers.

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft