Bump duo-cli version from 9.25.0 to 9.29.0 in StartWorkflowService (!260311) · Merge requests · GitLab.org / GitLab

What does this MR do and why?

Bumps the Duo CLI version pinned in Ai::DuoWorkflows::StartWorkflowService from 9.27.0 to 9.29.0.

Why

Flows started from a mention or from Implement on an issue run in a CI job, with the Duo CLI as the flow executor. In this headless CI mode, the CLI refuses to read images with read_file (capability_absent). Its CI workflow token carries no server_capabilities, so the image_response capability check always fails. The model cannot see screenshots in the repository or attachments on issues and merge requests.

gitlab-org/editor-extensions/gitlab-lsp!4393 (merged) fixes this by reading the capabilities from aiFlowsMetadata. It was tested end to end on GDK with a Rails-launched CI job: the issue upload read went from refused to success, and the agent described the image (gitlab-org/editor-extensions/gitlab-lsp!4393 (comment 3983006228)).

Why 9.29.0

gitlab-lsp releases with semantic-release, and someone runs the release job by hand. main already has two feat: commits since v9.28.1, so the next release is 9.29.0. If a release runs before the fix merges, the fix lands in a later version.

Scope

One constant. CI reads it to install and verify the binary. The preflight check fails until the 9.29.0 binaries exist in the package registry, so this pipeline is red until the release.
The constant only applies to custom images. The default image workflow-generic-image:v0.0.21 ships Duo CLI 9.27.0, and jobs skip the download when duo is already present.

Before merging

Duo CLI 9.29.0 is released and its release notes include fix(cli): source image_response capability from aiFlowsMetadata in headless CI mode.
The preflight package registry check passes.

How to verify

Custom image: add agent-config.yml with image: python:3.12 to a GDK project. Start a flow from a mention. The job log shows Downloading duo-cli 9.29.0, and duo --version prints 9.29.0.

In both cases, ask the flow to read an image from the repository and an image attached to the issue. read_file returns the image instead of refusing it with capability_absent.