Gitlab Code Reviewer

GitLab Code Reviewer

Overview

Automated code review tool for GitLab merge requests. Analyzes code for security vulnerabilities, code quality issues, and best practices violations.

⚠️ Important: GitLab Access

This tool uses GitLab API, NOT web pages.

When reviewing a GitLab MR:

1. DO NOT try to fetch the MR URL as a web page (will fail - redirects to login)
2. DO use the CLI tool with credentials from ~/.openclaw/credentials/gitlab.json
3. The tool automatically authenticates via PRIVATE-TOKEN header

Example workflow:

User: "Review MR !2223 in project kks/backend/bpm-platform"

✅ Correct: Run CLI tool with token authentication
❌ Wrong: Try to fetch https://git.company.com/... as web page

When to Use

• Review merge requests automatically
• Find security vulnerabilities (SQL injection, XSS, hardcoded secrets, etc.)
• Detect code quality issues
• Generate review comments for GitLab

Usage

Via OpenClaw

"Review MR !42 in project group/project"

Via CLI

# Using GitLab URL (recommended)
python scripts/gitlab_code_review.py --url "https://gitlab.com/group/project/-/merge_requests/42"

# Using project and MR IID
python scripts/gitlab_code_review.py --project group/project --mr 42

# Post comments to GitLab
python scripts/gitlab_code_review.py --project group/project --mr 42 --post-comments

# Save report to file
python scripts/gitlab_code_review.py --project group/project --mr 42 --output review.md

# From diff file (offline)
python scripts/gitlab_code_review.py --diff-file changes.json

Configuration

Credentials

Create ~/.openclaw/credentials/gitlab.json:

{
  "token": "glpat-xxx",
  "host": "https://gitlab.com",
  "ignore_patterns": [
    "*.min.js",
    "*.lock",
    "forms/*.json"
  ]
}

Get token: GitLab → Settings → Access Tokens → Create token with read_api, write_repository scopes.

Priority: --token arg > GITLAB_TOKEN env > credentials file

Security Checks

Review Priorities

• 🔴 Critical — Block merge (security vulns, data loss)
• 🟡 Major — Fix before merge (error handling, missing tests)
• 🟢 Minor — Recommendations (style, documentation)

Supported Languages

Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, YAML, JSON

File Ignoring

Default ignores: *.min.js, *.min.css, *.lock, package-lock.json, pnpm-lock.yaml, forms/*.json

Override with --ignore "*.json" "*.lock" or --no-default-ignores

Troubleshooting

"GitLab redirects to login page"

Problem: Trying to fetch GitLab URL as web page instead of using API.

Solution: Use the CLI tool with token authentication:

python scripts/gitlab_code_review.py --url "https://gitlab.com/group/project/-/merge_requests/123"

"401 Unauthorized"

Problem: Token is invalid or expired.

Solution:

1. Check token in ~/.openclaw/credentials/gitlab.json
2. Generate new token: GitLab → Settings → Access Tokens
3. Required scopes: read_api, write_repository

"404 Not Found"

Problem: Project path or MR IID is incorrect.

Solution: Verify the URL format:

• ✅ https://gitlab.com/group/project/-/merge_requests/123
• ❌ https://gitlab.com/group/project/merge_requests/123 (old format may not work)

Note: This tool assists human review but doesn't replace it.