Install glab from official GitLab releases instead of third-party mirror

Jafar Soltanirequested to merge
duo/fix/595853-glab-official-releases into master

What does this MR do and why?

Replaces the upciti/wakemeops third-party APT repository (hosted on GitHub) with a direct download from the canonical GitLab CLI release artifacts at gitlab.com/gitlab-org/cli/-/releases.

The wakemeops approach required piping a shell script from a third-party GitHub repository (curl | bash), which is a supply-chain risk. The new approach downloads a pinned version directly from the official GitLab source.

Changes:

  • ee/lib/gitlab/ai/catalog/third_party_flows/seeder.rb: Updated both Claude and Codex agent definitions
  • doc/user/duo_agent_platform/agents/external_examples.md: Updated both Claude Code and OpenAI Codex examples
  • doc-locale/ja-jp/user/duo_agent_platform/agents/external_examples.md: Updated Japanese locale translation

The new install command:

  • Downloads glab v1.105.0 (matching GlabSetup::VERSION)
  • Detects OS and architecture at runtime (supports amd64 and arm64)
  • Uses --fail flag so errors are surfaced rather than silently ignored
  • Is consistent with the pattern already used in Gitlab::DuoWorkflow::GlabSetup

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/595853

Screenshots or screen recordings

N/A — no UI changes.

Before After
curl ... upciti/wakemeops ... | bash then apt-get install glab curl ... gitlab.com/gitlab-org/cli/-/releases/... .tar.gz | tar -xz

How to set up and validate locally

  1. Review the diff — the only change is the glab install command in the agent YAML definitions.
  2. Optionally run the seeder spec: bundle exec rspec ee/spec/lib/gitlab/ai/catalog/third_party_flows/seeder_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports