andrew.dunn.dev

gitlab-contribution

~3 min
gitlabllmai-harnesscontrolled-egressself-managedsecurity
Source CI Pipelines

gitlab-contribution is a project in GitLab.com’s Public Sector group. It packages two things as Claude Code skills: a pinned, byte-faithful vendored copy of GitLab’s own gitlab-org/ai/skills, 19 skills covering glab CLI usage, commit-message format, MR-description structure, review-reply mechanics, pipeline watching, GLQL, and more. It adds one authored skill, skills/gitlab-contribution.

That authored skill teaches an agent how to contribute to a GitLab project, especially the gitlab-org/gitlab monorepo, from an environment with no GitLab Development Kit (GDK): a controlled-egress or self-managed environment where a GDK checkout isn’t an option. My own itch was simpler: I want several simulations running at once, so I work against cloud VMs instead of one local GDK, and contributing from there means filing issues, opening merge requests (including docs-only MRs through the API), surviving the monorepo’s clone and pipeline behavior, and responding to review, whether I’m the one doing it or an agent is doing it for me. A sibling project, gitlab-simulation, supplies those environments: a running dev and caproni GitLab instance plus source-tree tooling that the authored skill routes GDK-shaped tasks to.

19 skills1 skillcontributesGDK workVENDORED19 GitLab skillspinned commitAUTHOREDgitlab-contributionno GDK requiredHARNESSClaude Codeboth trees, one loadTARGETgitlab-org/gitlabissues, MRs, reviewSIBLINGgitlab-simulationdev and caproni VMs
Nineteen vendored GitLab skills and one authored no-GDK skill load into one Claude Code harness that contributes to the gitlab-org/gitlab monorepo and routes work needing a running instance to the gitlab-simulation sibling.
syncpassregenloadsroutesUPSTREAMgitlab-org/ai/skillscloned at a pinned commit19 skillsMIT licensedSCANskillspectorfail-closed, static, no LLMaborts before copyingallowlist: scan-accept.ymlVENDOREDvendor/gitlab-ai-skillsbyte-faithful + LICENSEstamped: origin, commit2 patches: psql, clickhouseSYMLINKSskills/<name>one per vendored skill→ vendor/gitlab-ai-skillsregenerated on every syncAUTHOREDgitlab-contributionSKILL.md → contribute.mdhands off vendored skills by nameowns no-GDK, monorepo survivalSIBLING PROJECTgitlab-simulationdev: checkout, RSpeccaproni: live instancetakes GDK-shaped tasks
Upstream skills are cloned at a pinned commit, scanned fail-closed before anything is copied, vendored byte-faithful with a stamp per skill, symlinked at the top level, and handed with the authored skill to an agent that routes GDK-shaped tasks to gitlab-simulation.

Two flows share the repository: vendoring the upstream skill tree in, and handing what’s vendored, plus the authored skill, to a contributor. An agent consumes both through a Claude Code plugin install or a SKILL_HOMES-style harness pointed at the two skill trees, which hold plain SKILL.md files, the portable Agent Skills layout that made a dedicated registry tool like rune unnecessary once it settled. CI’s static job checks the vendored tree, its symlinks, and the authored scripts offline; the skillspector scan itself runs manually, and the vendored tree ships on a reviewed allowlist rather than a clean scan.

It sits in the same Public Sector group as egress, another project for the self-managed, controlled-egress case, this one asking what a GitLab AI-agent skill needs to assume when a GDK isn’t on the table.