Gitlab Datastore Bootstrap

2026.10.22.2

Fixed: The README and manifest Quick Start documented token as a literal --input token=glpat-... value. Workflow --input values are recorded in cleartext in the run history, so a token written that way leaks. The docs now store the token with swamp vault put gitlab TOKEN (which prompts for the value) and pass it as a ${{ vault.get("gitlab", "TOKEN") }} expression, which swamp redacts. This earns the registry secret-safe-docs quality factor.

Changed: Docs only. No model schema, method, or behavior change. The upgrades chain gains an identity entry terminating at this version so existing definitions migrate cleanly.

Upgrade note: No action required. On the next method run, each existing definition's typeVersion advances to 2026.10.22.2 with its global arguments preserved.

2026.10.22.1

Fixed: Existing definitions created against an earlier version were stranded on upgrade. The model shipped new versions without a corresponding upgrades chain, so swamp could not migrate a definition's typeVersion and logged a warning that global arguments would not be migrated. This release backfills the full upgrade chain through every shipped version and terminates it at the current version, so stale definitions migrate cleanly. The transform is identity — no stored global argument value changes.

Upgrade note: No action required. On the next method run, each existing definition's typeVersion advances to 2026.10.22.1 with its global arguments preserved.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.27.1

Changed: Test suite now builds its method context from the shared createModelTestContext factory in @systeminit/swamp-testing instead of a hand-rolled context, wrapping writeResource to preserve the existing assertion API. No behavioral, schema, or method changes — the published provisioner is unchanged. The deno.json gains a dev-only @systeminit/swamp-testing import-map entry and its check task now type-checks the test file.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.23.1

Changed: Documentation only — no code changes. Added a ## Troubleshooting section covering the 401/404 branches in validateProject, the 403 branch in verifyStateAccess (needs api scope plus Developer role), JSON-parse failures from gitlabApi when self-hosted instances return HTML instead of JSON (wrong base_url or a login redirect), and the Maintainer-role requirement in createProjectToken (which always requests Developer-level tokens regardless of caller role).

2026.08.21.1

Changed: A malformed (non-JSON) response body from the GitLab API — e.g. an HTML error page from a proxy in front of a self-hosted instance — now raises a clear error naming the request method, path, and HTTP status, instead of a raw JSON.parse SyntaxError with no indication of which request failed.

2026.08.02.1

Fixed: The configure job in @webframp/bootstrap-gitlab-datastore failed with Invalid expression: No such key: attributes. The workflow queried data.latest("swamp-gitlab-provisioner", "state"), but the provisioner writes its resource under the instance name "main" (via writeResource("state", "main", ...)) — data.latest()'s second argument matches the resource's instance name, not its spec name. The configure job now queries data.latest("swamp-gitlab-provisioner", "main"), which resolves correctly.

Changed: The run-setup step now passes the provisioner's datastoreConfig through a DATASTORE_CONFIG environment variable instead of interpolating it directly into a single-quoted shell string. The prior pattern could allow a config value containing a single quote to break out of shell quoting.

Upgrade note: No action needed beyond swamp extension pull — the workflow file is re-pulled with the extension.

2026.08.02.1

Fixed: The configure job in @webframp/bootstrap-gitlab-datastore failed with Invalid expression: No such key: attributes. The workflow queried data.latest("swamp-gitlab-provisioner", "state"), but the provisioner writes its resource under the instance name "main" (via writeResource("state", "main", ...)) — data.latest()'s second argument matches the resource's instance name, not its spec name. The configure job now queries data.latest("swamp-gitlab-provisioner", "main"), which resolves correctly.

Changed: The run-setup step now passes the provisioner's datastoreConfig through a DATASTORE_CONFIG environment variable instead of interpolating it directly into a single-quoted shell string. The prior pattern could allow a config value containing a single quote to break out of shell quoting.

Upgrade note: No action needed beyond swamp extension pull — the workflow file is re-pulled with the extension.

2026.07.27.1

Fixed: The fmt task ran deno fmt --check, so deno task fmt verified formatting instead of applying it and there was no way to format the extension through its own task. fmt now formats and a new fmt:check verifies, matching every other extension in the repository.

Changed: Reformatted files that had drifted from deno fmt. No code behavior changes.

Fixed: deno fmt no longer inspects CLAUDE.md / AGENTS.md. Those files are gitignored and never present in CI, but deno fmt does not read .gitignore, so deno task fmt:check could fail locally on a file CI does not have.

Upgrade note: Tooling and formatting only. No model, method, schema, or behavior change — nothing to do on upgrade.