Use $GITLAB_PERSONAL_ACCESS_TOKEN in check-ci-jobs

Author: cataphract

appsec/helper-rust/CLAUDE.md

@@ -318,11 +318,8 @@ The appsec child pipeline IID can be found in the parent pipeline's downstream p
 The GitLab MCP tools don't include a job trace/log reader. To read job logs via the API:
 
 ```bash
-# Extract the token from MCP config (project ID 355 = DataDog/apm-reliability/dd-trace-php)
-jq -r '.mcpServers.gitlab.env.GITLAB_PERSONAL_ACCESS_TOKEN' ~/.claude.json
-
-# Then fetch job trace using the token
-curl -s -H "PRIVATE-TOKEN: <TOKEN>" "https://gitlab.ddbuild.io/api/v4/projects/355/jobs/<JOB_ID>/trace" > /tmp/...
+# project ID 355 = DataDog/apm-reliability/dd-trace-php
+curl -s -H "PRIVATE-TOKEN: $GITLAB_PERSONAL_ACCESS_TOKEN" "https://gitlab.ddbuild.io/api/v4/projects/355/jobs/<JOB_ID>/trace" > /tmp/...
 ```
 
 ### Monitoring CI Jobs

appsec/helper-rust/scripts/check-ci-jobs.py

@@ -13,7 +13,6 @@
 """
 
 import argparse
-import json
 import os
 import subprocess
 import sys
@@ -50,18 +49,12 @@
 
 
 def get_token() -> str:
-    config_path = Path.home() / ".claude.json"
-    config = json.loads(config_path.read_text())
-    token = (
-        config.get("mcpServers", {})
-        .get("gitlab", {})
-        .get("env", {})
-        .get("GITLAB_PERSONAL_ACCESS_TOKEN")
-    )
-    if not token or token == "null":
-        print("ERROR: Could not extract GitLab token from ~/.claude.json", file=sys.stderr)
-        sys.exit(1)
-    return token
+    token = os.environ.get("GITLAB_PERSONAL_ACCESS_TOKEN")
+    if token and token != "null":
+        return token
+
+    print("ERROR: GITLAB_PERSONAL_ACCESS_TOKEN is not set", file=sys.stderr)
+    sys.exit(1)
 
 
 def api_get(token: str, path: str, params: dict | None = None) -> list | dict: