fix(knowledge): restore GitLab PAT setup and secret references

[waleedlatif1]

Summary

• Restore ordinary GitLab PAT setup for regular knowledge bases while preserving Search's source-permission requirements.
• Reuse the shared secret input, picker, and reference highlighting for {{SECRET_NAME}} references. Resolve secrets after authorization, store encrypted token snapshots, and redact credentials from setup validation errors.
• Document the setup and add regression coverage for the modal, secret resolution, and the full create/sync/search/edit flow.

Type of Change

• Bug fix

Testing

• 470 focused tests and 3 PostgreSQL integration tests passed. Integration tests use fixture GitLab responses and embeddings with real connector persistence, encryption, indexing, retrieval, and access checks.
• Manually verified the actual modal and secret picker in a local preview with fixture data.
• Validated the connector's read endpoints against GitLab's official API documentation.
• App type-check, full repository lint, all 47 audits, API boundary validation, and generated-artifact checks passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 23, 2026 1:50am UTC

[cubic-dev-ai]

No issues found across 13 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no outstanding correctness or security findings.

Summary

Restores GitLab personal-access-token setup for regular knowledge bases while retaining stricter source-permission requirements for Search.

• Adds workspace-access support for ordinary GitLab knowledge connectors.
• Resolves personal or workspace secret references only after authorization and persists an encrypted token snapshot.
• Redacts connector credentials from provider validation failures.
• Reuses the shared secret picker and adds focused unit and integration coverage.
• Documents GitLab PAT requirements and secret snapshot behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[GitLab PAT or secret reference] --> B[Authorize workspace access]
    B --> C[Resolve secret reference]
    C --> D[Validate GitLab configuration]
    D --> E[Encrypt token snapshot]
    E --> F[Persist connector]
    F --> G[Sync and index project content]
    G --> H[Apply knowledge-base workspace access]

Loading

_{Reviews (3) · Last reviewed commit: "fix(knowledge): reuse shared secret refe..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}