Add glab (GitLab CLI) coverage#1
Open
gl-njanz wants to merge 1 commit into
Open
Conversation
claude-guard guarded gh (GitHub CLI) destructive commands but had no coverage for glab (GitLab CLI). This adds the glab equivalents plus glab-native destructive operations gh has no analog for. Mapping is not 1:1: glab has no extension system, and stores CI/CD secrets as variables (so gh secret delete maps to glab variable delete). Command names verified against docs.gitlab.com/cli. Tier 1 (hard deny): - glab repo delete Tier 2 (deny + redirect): - glab release delete, glab variable delete, glab repo archive, glab token revoke, glab ci delete, glab ssh-key/gpg-key/deploy-key delete - glab mr delete / glab issue delete -> close instead - glab work-items delete -> confirm intent (no close subcommand) The glpat- token pattern already exists in credentials.py, so Tier 3 needs no changes. Adds 20 tests; full suite (298) passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
claude-guard guards
gh(GitHub CLI) destructive commands but had no coverage forglab(GitLab CLI). This adds the glab equivalents of the existing gh rules, plus glab-native destructive operations that gh has no analog for.Mapping is intentionally not 1:1 — glab has no extension system, and stores CI/CD secrets as variables (so
gh secret deletemaps toglab variable delete). All command names were verified against docs.gitlab.com/cli.Rules added (in
packs/cicd.py)Tier 1 (hard deny):
glab repo deleteTier 2 (deny + redirect):
glab release deleteglab release listfirstglab variable deleteglab variable listfirstglab repo archiveglab repo unarchiveglab token revokeglab token listfirstglab ci deleteglab ci listfirstglab ssh-key/gpg-key/deploy-key deleteglab mr deleteglab mr closeglab issue deleteglab issue closeglab work-items deleteThe
glpat-GitLab token pattern already exists incredentials.py, so Tier 3 needs no changes.Docs & version
guard-rulesSKILL.md tables, andstatuscommand updated.2026.6.0→2026.6.1.Testing
TestCICD; full suite (298 tests) passes.command-guard.pyconfirm deny/ask/allow behave correctly.🤖 Generated with Claude Code