Vince Lozada efabfbcf8a feat: document JSON body pattern for inline MR diff comments (#31) ...

* feat: document JSON body pattern for inline MR comments + add post-inline-comment.py script

glab api --field silently falls back to general comments when GitLab
rejects position data (common with new files, encoded paths). Fix is
to use Python urllib with Content-Type: application/json.

- glab-mr: new 'Posting Inline Comments on MR Diffs' section with
  full code example, line number parsing helper, and batch script usage
- scripts/post-inline-comment.py: reusable script supporting single
  and batch comment posting; auto-reads token from glab config;
  reports inline vs general fallback per comment

Closes #28

* security: harden post-inline-comment.py + add openclaw.requires metadata

Security fixes before ClawHub publish:
- Enforce HTTPS-only for --host (prevents token leakage over HTTP)
- Validate --project path format with regex
- Validate --file path (no null bytes or newlines)
- Cap --body at 10,000 chars with truncation warning
- Validate --line is a positive integer
- Batch file size limit (1MB) and count limit (100 comments)
- Validate token is non-empty and whitespace-free before first API call
- Fetch token after input validation (avoids credential access on bad input)
- Explicit SSL context on all urllib calls (strict CA verification)
- Error body truncated in exception messages (prevents token reflection)

Root SKILL.md: add openclaw.requires block declaring:
- GITLAB_TOKEN credential (optional, falls back to glab config)
- Outbound HTTPS network access scope
- Write-access warning (comments, thread resolution, MR approval)

---------

Co-authored-by: Steven (Bot) <steven@winkintel.com>

2026-03-03 09:57:31 -06:00

..

references

Phase 2: Add scripts, TOCs, and troubleshooting (#14)

2026-02-11 22:51:20 -06:00

SKILL.md

feat: document JSON body pattern for inline MR diff comments (#31)

2026-03-03 09:57:31 -06:00