DiffPal GitLab CI Components

Reusable GitLab CI/CD components for running DiffPal in merge request pipelines.

Components

• review: Run diffpal review gitlab, upload artifacts, and publish Code Quality and SARIF reports.
• review-codex-api-key: Same as review, but also installs Codex CLI tooling and authenticates with OPENAI_API_KEY.

Requirements

Consumer projects must provide:

• a committed DiffPal config at .config/diffpal/config.yaml
• merge request pipelines
• GitLab publishing credentials through CI_JOB_TOKEN or GITLAB_TOKEN
• any provider-specific credentials required by the selected runtime

Use The Components

Generic review component:

include:
  - component: $CI_SERVER_FQDN/diffpal/components/review@1.0.0
    inputs:
      job_name: diffpal-review
      diffpal_version: latest
      feedback: review
      extra_args: --gate

Codex API key wrapper:

include:
  - component: $CI_SERVER_FQDN/diffpal/components/review-codex-api-key@1.0.0
    inputs:
      job_name: diffpal-review
      diffpal_version: latest
      codex_version: 0.139.0
      bridge_version: 1.6.3
      feedback: review
      extra_args: --gate

Security Model

These components are designed for trusted same-project merge request review by default.

Consumer pipelines are responsible for:

• exposing provider secrets only to trusted pipelines
• granting host tokens the minimum required API scope
• reviewing component versions before upgrading

Versioning

Use tagged releases such as 1.0.0. For production pipelines, prefer released versions over branch references.