Add .gitlab/duo/agent-config.yml for Duo Agent Platform CI/CD execution

What does this MR do and why?

Add .gitlab/duo/agent-config.yml to configure the Duo Agent Platform flow execution environment for gitlab-org/gitlab.

The core goal is to run the agent from GDK's pre-configured gitlab directory (with a live database, Gitaly, workhorse, and node_modules already in place) rather than from the bare CI checkout. This means the agent can run bundle exec rspec, yarn jest, and other tasks that require a running environment without spending time debugging missing infrastructure.

The setup script is necessarily involved because:

• Git history alignment: The GDK image's gitlab checkout defaults to pointing at the gitlab-community fork. We repoint the remote, fetch master (needed for pre-push hook diff computation), and overlay the CI branch files via git archive without disturbing node_modules or other GDK-managed files.
• Deleted file cleanup: git archive only extracts files present at HEAD — files deleted on the agent's branch would otherwise linger. We fetch the CI branch tip as a local ref and use git diff --diff-filter=D to find and remove them.
• mise PATH: GDK's startup scripts require ruby to be resolvable, so mise shims must be on PATH before gdk start.
• gitleaks config: The gitleaks pre-push hook checks that config/gitleaks-local.toml is in sync with config/gitleaks.toml (it diffs the expected generated output against the actual file). Any branch that's behind master on these files may fail this check. We regenerate gitleaks-local.toml during setup to guarantee it's always in sync.
• Sandbox runtime: @anthropic-ai/sandbox-runtime is installed globally for network/filesystem isolation during agent tool execution.

References

• Add `.gitlab/duo/agent-config.yml` for Duo Agen... (#593976)
• https://docs.gitlab.com/user/duo_agent_platform/flows/execution/

Screenshots or screen recordings

Setup output: GDK services starting, gitleaks config, lefthook hooks installed

# Git history aligned, CI branch ref fetched for deletion cleanup
From /builds/gitlab-org/gitlab
 * [new ref]               HEAD       -> refs/ci-head

# GDK services starting
ok: run: /gitlab-gdk/gitlab-development-kit/services/postgresql: (pid 248) 0s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/redis: (pid 331) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/praefect: (pid 409) 0s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/praefect-gitaly-0: (pid 410) 0s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/gitlab-http-router: (pid 547) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/gitlab-topology-service: (pid 546) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/gitlab-workhorse: (pid 550) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/rails-background-jobs: (pid 544) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/rails-web: (pid 545) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/sshd: (pid 548) 1s, normally down
ok: run: /gitlab-gdk/gitlab-development-kit/services/vite: (pid 543) 1s, normally down

=> GitLab available at http://gdk.local:3000
=>   - Ruby: ruby 3.3.10 (2025-10-23 revision 343ea05002) [aarch64-linux].
=>   - Node.js: v22.22.1.
=> The TopologyService is up and running.

# sandbox-runtime installed (19s)
added 8 packages in 19s

# gitleaks local config regenerated
Generated: /gitlab-gdk/gitlab-development-kit/gitlab/config/gitleaks-local.toml

# lefthook hooks installed
sync hooks: ✔️ (pre-push)

How to set up and validate locally

• Setup GDK following: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/73a23215e960b7db5e865c154129ddc7b2413ba9/doc/howto/ai/duo_agent_platform.md
• Rename your local gitlab checkout inside GDK to gitlab-org/gitlab (the script hardcodes this path) and update the remote URL accordingly
• Create an issue on your GDK test project (see sample issues below) and use the Generate MR with Duo option
• Observe the setup phase in the job logs: look for GDK services starting, sync hooks: ✔️, then the agent running your task

Sample issues for validation

Issue 1 — RSpec (fast_spec_helper, no DB)

Title: Add darken(percent) method to Gitlab::Color

Add a darken(percent) method to Gitlab::Color (lib/gitlab/color.rb) that returns a new Gitlab::Color instance representing a darker shade. The method should reduce each RGB component by the given percentage (e.g., darken(20) reduces each component by 20%). Clamp values to 0.

Update spec/lib/gitlab/color_spec.rb with tests covering:

• darken(0) returns the same color
• darken(50) on #FF8800 returns #804400
• darken(100) returns #000000
• darken on an already-black color stays #000000

This spec uses fast_spec_helper (no database needed).

Definition of Done: Run bundle exec rspec spec/lib/gitlab/color_spec.rb 2>&1 | tail -30 — all examples must pass. Include the rspec summary line in your final message.

Result: bundle exec rspec — 326 examples, 0 failures (~2s). Agent found ruby on PATH immediately via mise shims. Completed in ~4 minutes, created MR.

Issue 2 — Jest (yarn + node)

Title: Add uniqueByKey function to array_utility.js

Add a uniqueByKey(array, key) function to app/assets/javascripts/lib/utils/array_utility.js that deduplicates an array of objects by a given property name, keeping the first occurrence.

Example: uniqueByKey([{id: 1, name: 'a'}, {id: 2, name: 'b'}, {id: 1, name: 'c'}], 'id') returns [{id: 1, name: 'a'}, {id: 2, name: 'b'}].

Update spec/frontend/lib/utils/array_utility_spec.js with tests covering:

• Empty array returns empty array
• Array with no duplicates returns same array
• Array with duplicates keeps first occurrence
• Works with string keys

Definition of Done: Run yarn jest spec/frontend/lib/utils/array_utility_spec.js 2>&1 | tail -30 — all tests must pass. Include the jest summary line in your final message.

Result: yarn jest — 31 passed, 31 total (~3s). node_modules already present in GDK checkout — no install needed. Completed in ~3 minutes, created MR.

Issue 3 — lefthook pre-push hooks

Title: Add lighten(percent) method to Gitlab::Color

Add a lighten(percent) method to Gitlab::Color (lib/gitlab/color.rb) that returns a new Gitlab::Color instance representing a lighter shade. The method should increase each RGB component toward 255 by the given percentage (e.g., lighten(50) moves each component halfway to 255).

Update spec/lib/gitlab/color_spec.rb with tests:

• lighten(0) returns the same color
• lighten(100) returns #FFFFFF
• lighten(50) on #000000 returns #808080

This spec uses fast_spec_helper (no database needed).

Definition of Done:

1. Run bundle exec rspec spec/lib/gitlab/color_spec.rb 2>&1 | tail -30 — all examples must pass
2. Commit the change — lefthook pre-commit hooks must pass. Do NOT use --no-verify or LEFTHOOK=0. If the commit fails due to hooks, fix the issue and retry. Include the full commit output in your final message so hook results are visible.

Result: Lefthook pre-push hooks fired (gitleaks, rubocop). Agent respected hook feedback and fixed violations before committing. Confirms lefthook install and hook execution work end-to-end during agent commits.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.