feat: support namespace level workflow in agentic chat

What does this MR do and why?

This MR supports namespace-level workflow in Agentic Chat, which currently is a limitation for Agentic Chat that it can't be used outside of project context. This limitation was originally coming from that Duo Workflow is tightly coupled with project entity, so we've introduced namespace-level workflow to let users use Agentic Chat even if they are on group-level resource, such as Epic. See gitlab-org/gitlab#550324 (closed) for more info.

This is required for the feature parity with Classic Duo Chat which has already cross-project and group-level entity support (e.g. ask question about epic where there are no 1-to-1 relationships with a project).

References

Related to

• Agentic Chat doesn't work outside of project (G... (gitlab-org/gitlab#550324 - closed)
• Allow to pass namespace id when creating workflow (gitlab-org/gitlab!196781 - merged)
• Fix Duo Workflow GraphQL API doesn't expose req... (gitlab-org/gitlab!198050 - merged)

How to set up and validate locally

Confirmed that it's working in local GDK environment:

Created workflow record:

[1] pry(main)> Ai::DuoWorkflows::Workflow.last
=> #<Ai::DuoWorkflows::Workflow:0x000076a155152d78
 id: 235,
 user_id: 1,
 project_id: nil,
 created_at: Thu, 17 Jul 2025 07:09:21.803026000 UTC +00:00,
 updated_at: Thu, 17 Jul 2025 07:09:30.974213000 UTC +00:00,
 status: 6,
 goal: "Generate a commit message for these changes",
 agent_privileges: [1, 2, 3, 4, 6],
 workflow_definition: "chat",
 allow_agent_to_request_user: true,
 pre_approved_agent_privileges: [1, 2],
 image: nil,
 namespace_id: 1000000,
 environment: "ide">

How to test:

1. Apply the following patch in gitlab-lsp (LSP fix is gitlab-org/editor-extensions/gitlab-lsp!1870 (closed)):

   diff --git a/packages/lib_workflow_executor/src/api/workflow_rails_service.ts b/packages/lib_workflow_executor/src/api/workflow_rails_service.ts
   index 066293d3..b1dbf6ea 100644
   --- a/packages/lib_workflow_executor/src/api/workflow_rails_service.ts
   +++ b/packages/lib_workflow_executor/src/api/workflow_rails_service.ts
   @@ -113,7 +113,7 @@ export class DefaultWorkflowRailsService implements WorkflowRailsService {
           method: 'POST',
           path: '/api/v4/ai/duo_workflows/workflows',
           body: {
   -          project_id: projectPath,
   +          namespace_id: "gitlab-duo",
             goal,
             workflow_definition: type || WorkflowType.SOFTWARE_DEVELOPMENT,
             agent_privileges: this.#agentPrivileges,

2. Checkout this branch and run poetry run duo-workflow-service
3. Checkout gitlab-org/gitlab!198050 (merged).
4. Run GDK.

Merge request checklist

• Tests added for new functionality. If not, please raise an issue to follow up.
• Documentation added/updated, if needed.