[darrenoh]

Status: draft — upstream source unverified

Configure the manual update workflow to resolve and fetch https://gitlab.com/devpanel-vn/cli with GitLab credentials, while preserving the original client output paths and native build matrix. The GitLab source is unreachable from this session; the assumed cmd/devpanel-client path comes from the existing executable metadata and must be confirmed against the real repository before merging.

Required repository settings

• Actions secret GITLAB_TOKEN: GitLab deploy token with read_repository access to devpanel-vn/cli (or a personal access token with that scope and project access).
• Actions variable GITLAB_USER: the deploy-token username (or a non-empty GitLab username for a personal access token).

GitLab authentication is scoped to GitLab Git HTTP requests, without global Git config. The token is removed before running the built client. The GitHub workflow token still commits binaries.

Validation and limitations

Targeted YAML lint and actionlint passed (with unchanged Ubuntu 26.04 labels ignored by this actionlint version). Exercised credential validation, URL-scoped Git configuration, default HEAD parsing, cache decisions, fetch command construction and smoke checks using local mocks/fixtures. GitLab authentication, source layout, actual native builds, private dependencies, and hosted workflow remain unverified until GitLab access is available.

The Dockerfile continues to consume base/bin/devpanel, not the new architecture-specific output paths; this PR does not change image behavior.

[Copilot]

🟡 Changes recommended

The documented credentials cannot authenticate the workflow’s commits API request, causing the plan job to fail before either build starts.

1 open issue

• Documented credentials cannot authenticate the commits API request · New

What changed in this PR

This draft moves the manual DevPanel CLI updater from GitHub to authenticated GitLab access, preserving native AMD64/ARM64 builds and existing output paths. Docker image behavior remains unchanged; upstream source and credentialed builds remain unverified.

Changes:

• Resolve the upstream default-branch HEAD through GitLab’s commits API and scope revision caches per destination branch.
• Scope Git authentication to GitLab, clear credentials before smoke checks, and add client-path and command checks.
• Document repository settings and outstanding validation work.

File	Description
TODO.md	Tracks GitLab migration tasks and remaining validation.
README.md	Documents credentials, caching, builds, and limitations.
AGENTS.md	Updates updater conventions and required repository settings.
.github/​workflows/​update-devpanel-cli.yml	Implements GitLab resolution, authenticated fetching, branch-scoped caching, and additional checks.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The upstream GitLab source and credentialed hosted run remain unverified, leaving cmd/devpanel-client, private dependency authentication, both native builds, and CLI smoke commands unconfirmed.

No open issues 🎉

1 resolved since last review

• Documented credentials cannot authenticate the commits API request

_{Review effort: Balanced}