gitlab-api: API and Agent Channel

This plugin includes the existing API Actions and Workflow Triggers plus the gitlab-api/agent-issues Agent Channel. Existing action/trigger IDs, schemas and API authentication methods are unchanged. The additional Channel authentication is listed at plugin level; per-action authentication subsets are intentionally deferred. Use existing API Connections for Actions/Triggers and the Channel credentials below for agent conversations. No migration of unused standalone Channel installations is provided.

GitLab bot Channel

The gitlab-api/agent-issues Agent Channel serves a customer's own GitLab bot account: a project or group access token's bot, a service account or a dedicated user, on GitLab.com or a self-managed instance. It treats each issue or merge request as one conversation. Deployment settings choose where (projects and groups), who (access, allowedSenderKeys, plus the minimumRole floor) and when (respondTo: mentions or all_messages) a message starts a turn. Input identity comes from the verified payload; a redelivery with another webhook-id cannot create another input.

Use the definition-only plugin from @dual-os/gitlab-api/definition, or the executable plugin from @dual-os/gitlab-api or @dual-os/gitlab-api/executable. Credentials come from the Connection: the instance URL (https://gitlab.com by default), an access token with the api scope and the webhook's signing token (whsec_…, verified as a Standard Webhooks signature) or secret token (X-Gitlab-Token). Existing API Connections and published actions keep their existing contracts.

Activation adds a project webhook with the Channel's URL and that secret to each listed project whose hooks the token may manage (Maintainer or higher), and deactivation deletes it. Other projects, groups and an empty projects list keep the webhook the customer adds by hand.

The provider supports notes, note updates and deletion, portable reactions as award emoji, a plan note and bounded conversation reads. Automatic activity is unavailable. It does not ingest attachments, edited notes, internal notes, or comments on commits and snippets. References to previous bot notes are read through their issue or merge request and checked against the bot's author before a note update, deletion, reaction or plan replacement.