Use GitLab’s oauth2 username for CLI updater authentication

.github/workflows/update-devpanel-cli.yml

@@ -9,8 +9,8 @@ name: Update DevPanel CLI binaries
 # cache entry to rebuild the same commit.
 #
 # The plan job resolves the default branch HEAD through Git; the build fetches
-# that commit under RUNNER_TEMP. GITLAB_TOKEN needs read_repository access.
-# GITLAB_USER and GITLAB_TOKEN authenticate Git requests.
+# that commit under RUNNER_TEMP. GITLAB_TOKEN needs read_repository access and
+# authenticates Git requests with GitLab's oauth2 username.
 # The workflow token commits the binaries.
 
 on:
@@ -36,20 +36,15 @@ jobs:
         id: upstream
         env:
           GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-          GITLAB_USER: ${{ vars.GITLAB_USER }}
           GIT_TERMINAL_PROMPT: "0"
         run: |
           set -euo pipefail
           if [[ -z "${GITLAB_TOKEN}" ]]; then
             echo "::error::GITLAB_TOKEN is required to read gitlab.com/devpanel-vn/cli."
             exit 1
           fi
-          if [[ -z "${GITLAB_USER}" ]]; then
-            echo "::error::GITLAB_USER is required to authenticate to gitlab.com/devpanel-vn/cli."
-            exit 1
-          fi
 
-          auth=$(printf '%s:%s' "${GITLAB_USER}" "${GITLAB_TOKEN}" | base64 -w0)
+          auth=$(printf 'oauth2:%s' "${GITLAB_TOKEN}" | base64 -w0)
           echo "::add-mask::${auth}"
           head=$(git -c "http.https://gitlab.com/.extraheader=AUTHORIZATION: basic ${auth}" \
             ls-remote https://gitlab.com/devpanel-vn/cli.git HEAD)
@@ -102,14 +97,13 @@ jobs:
       - name: Fetch GitLab CLI
         env:
           GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-          GITLAB_USER: ${{ vars.GITLAB_USER }}
           UPSTREAM_SHA: ${{ needs.plan.outputs.sha }}
           GIT_TERMINAL_PROMPT: "0"
         run: |
           set -euo pipefail
           dest="${RUNNER_TEMP}/devpanel-cli"
           mkdir "$dest"
-          auth=$(printf '%s:%s' "${GITLAB_USER}" "${GITLAB_TOKEN}" | base64 -w0)
+          auth=$(printf 'oauth2:%s' "${GITLAB_TOKEN}" | base64 -w0)
           echo "::add-mask::${auth}"
           git -C "$dest" init
           git -C "$dest" remote add origin https://gitlab.com/devpanel-vn/cli.git
@@ -128,7 +122,6 @@ jobs:
         env:
           ARCH: ${{ matrix.arch }}
           GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
-          GITLAB_USER: ${{ vars.GITLAB_USER }}
           GIT_TERMINAL_PROMPT: "0"
           GOPRIVATE: gitlab.com/devpanel-vn/*
         run: |
@@ -137,15 +130,15 @@ jobs:
             echo "::error::GitLab source does not contain cmd/devpanel-client; verify the client build path."
             exit 1
           fi
-          auth=$(printf '%s:%s' "${GITLAB_USER}" "${GITLAB_TOKEN}" | base64 -w0)
+          auth=$(printf 'oauth2:%s' "${GITLAB_TOKEN}" | base64 -w0)
           echo "::add-mask::${auth}"
           export GIT_CONFIG_COUNT=1
           export GIT_CONFIG_KEY_0=http.https://gitlab.com/.extraheader
           export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${auth}"
           dest="${RUNNER_TEMP}/devpanel-${ARCH}"
           env -u GOOS -u GOARCH CGO_ENABLED=0 \
             go build -trimpath -o "$dest" ./cmd/devpanel-client
-          unset GITLAB_TOKEN GITLAB_USER GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 auth
+          unset GITLAB_TOKEN GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 auth
           chmod 0755 "$dest"
           "$dest" version
           "$dest" app trigger --help

AGENTS.md

@@ -132,7 +132,7 @@ Baseline JSON files in `tests/baselines/` track pre-existing lint violations per
 - **`update-devpanel-cli.yml`** — manual `workflow_dispatch` on branches only. Resolves the GitLab `devpanel-vn/cli` default branch HEAD through authenticated Git access and builds `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64` in parallel on native runners from `cmd/devpanel-client` (the original binary's embedded package path; confirm against GitLab source). The Go version comes from upstream `go.mod`. A branch-specific Actions cache records the revision only after the workflow token commits both binaries. A new run cancels one already in progress. Upstream Git authentication is scoped to GitLab requests, not global configuration.
 - **`test.yml`** — runs YAML, shell, and Dockerfile linting plus build/run tests on pushes and pull requests.
 - Production images are tagged without suffix (e.g. `devpanel/php:8.3-base`); `develop` branch builds use the `-rc` suffix.
-- Required repository secrets: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`. Optional: `GHCR_TOKEN` (falls back to `GITHUB_TOKEN` for GHCR pushes). `update-devpanel-cli.yml` requires `GITLAB_TOKEN` with `read_repository` access and the `GITLAB_USER` repository variable containing that account's GitLab username.
+- Required repository secrets: `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`. Optional: `GHCR_TOKEN` (falls back to `GITHUB_TOKEN` for GHCR pushes). `update-devpanel-cli.yml` requires `GITLAB_TOKEN` with `read_repository` access and uses GitLab's `oauth2` username for Git requests.
 
 ## Environment Variables (base images)
 

README.md

@@ -300,9 +300,9 @@ for setup instructions.
   revision per destination branch only after both binaries are committed,
   and skips subsequent builds on a cache hit. Delete that cache entry to
   rebuild the same commit. A new run cancels one already in progress.
-  Set the `GITLAB_TOKEN` repository secret to the service account's GitLab
-  token with `read_repository` access. Set the `GITLAB_USER` repository
-  variable to the service account's username. The workflow resolves the
+  Set the `GITLAB_TOKEN` repository secret to a GitLab access token with
+  `read_repository` access. The workflow authenticates Git requests with
+  GitLab's `oauth2` username. The workflow resolves the
   default-branch HEAD using authenticated Git access, so it does not require
   GitLab API access.
   The workflow token commits the binaries. GitLab credentials are scoped

TODO.md

@@ -109,13 +109,25 @@ Use this file to track work that needs to be done. Lint scripts automatically ap
 - [x] Add a manual workflow based on `main`. The workflow token commits the binaries.
 - [x] Resolve and cache the upstream default branch HEAD through authenticated Git access, and skip revisions already built for the destination branch.
 - [x] Build linux/amd64 and linux/arm64 in parallel on native runners, then commit both binaries.
-- [x] Configure GitLab source-fetch authentication with the service account's `GITLAB_TOKEN` (`read_repository`) and `GITLAB_USER`.
+- [x] Configure GitLab source-fetch authentication with a `read_repository` token and GitLab's `oauth2` username.
 - [ ] Confirm `cmd/devpanel-client`, Go setup, build dependencies and smoke checks against the actual GitLab source.
 - [ ] Run the workflow with GitLab credentials and verify both binaries and revision caching.
 
 ## Definition of Done
 - A cache miss resolves the latest default-branch commit through authenticated Git access, builds both binaries on `ubuntu-26.04` and `ubuntu-26.04-arm`, and commits `base/bin/devpanel-amd64` and `base/bin/devpanel-arm64`.
-- GitLab access uses the service account's `GITLAB_TOKEN` with `read_repository` access plus its username in `GITLAB_USER`; the built revision is cached after the binaries are committed.
+- GitLab access uses `GITLAB_TOKEN` with `read_repository` access; the built revision is cached after the binaries are committed.
+
+# Task: Fix GitLab CLI HTTPS authentication
+
+## Steps
+- [x] Diagnose the cached-revision job's GitLab authentication failure from its Actions logs.
+- [x] Use GitLab's documented `oauth2` username with the access token in every Git request.
+- [x] Update workflow documentation and run focused validation and secret scanning.
+
+## Definition of Done
+- Plan, source fetch, and private-module requests use the same documented GitLab access-token authentication.
+- Documentation no longer requires `GITLAB_USER`.
+- Focused validation passes and changed files contain no secrets.
 
 # Task: Fix cached DevPanel CLI revision lookup