Download image assets uploaded to GitLab review threads

[stefanvictora]

Summary by CodeRabbit

• New Features
  • Review bundles can now localize linked image assets from GitLab threads into local bundle storage.
  • Markdown thread content can be rewritten to point to local asset paths while preserving the original thread data.
• Bug Fixes
  • Improved handling for remote asset downloads, including size limits, content-type checks, and clearer fallback behavior when downloads fail.
  • Expanded GitLab thread mapping so relative upload image links resolve correctly in more cases.
• Tests
  • Added coverage for asset localization, URL rewriting, and bundle output behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitLab thread image assets can now be downloaded into .revpack/assets, with matching Markdown thread URLs rewritten during bundle creation.

Changes

Review asset localization flow

Layer / File(s)	Summary
Contract and orchestration src/providers/provider.ts, src/orchestration/orchestrator.ts, CHANGELOG.md	ReviewProvider gains localizeReviewAssets, prepare() calls the provider hook when available and forwards assetRewrites into bundle creation, and the changelog records the GitLab asset behavior.
GitLab asset localization src/providers/gitlab/gitlab-provider.ts, src/providers/gitlab/gitlab-provider.test.ts	GitLab note mapping expands relative upload URLs, localized upload assets are downloaded and validated, and tests cover URL mapping plus localization outcomes.
Bundle markdown rewriting src/workspace/workspace-manager.ts, src/workspace/workspace-manager.test.ts	createBundle threads assetRewrites through thread rendering, threadToMarkdown rewrites comment bodies with rewriteMarkdownUrls, and the test keeps JSON unchanged while Markdown uses local asset paths.

Sequence Diagram(s)

sequenceDiagram
  participant Orchestrator
  participant GitLabProvider
  participant WorkspaceManager
  Orchestrator->>GitLabProvider: localizeReviewAssets(ref, threads, options)
  GitLabProvider-->>Orchestrator: assetRewrites
  Orchestrator->>WorkspaceManager: createBundle(..., { latestPatchContent, assetRewrites })

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐇 Hoppity hop, the threads are bright,
GitLab images now travel light.
Into .revpack/assets they softly land,
And markdown paths obey the hand.
Thump-thump! The bundle’s nice and neat.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: downloading GitLab review-thread image assets.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[stefanvictora]

@codex review

[coderabbitai]

🧹 Nitpick comments (1)

src/providers/gitlab/gitlab-provider.ts (1)

456-469: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider a timeout on the binary download fetch.

requestBinaryUrl has no timeout/abort. A stalled upload response can hang localizeReviewAssets (and thus prepare) indefinitely. An AbortSignal.timeout(...) keeps the best-effort download bounded.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/providers/gitlab/gitlab-provider.ts` around lines 456 - 469, The
requestBinaryUrl helper currently performs fetch without any timeout, so a
stalled binary download can block localizeReviewAssets and prepare indefinitely.
Update requestBinaryUrl to use an AbortSignal timeout (or equivalent abort
controller) when calling fetch, and make sure the timeout is applied alongside
the existing headers and optional fetchDispatcher handling so the download
remains bounded.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/providers/gitlab/gitlab-provider.ts`:
- Around line 456-469: The requestBinaryUrl helper currently performs fetch
without any timeout, so a stalled binary download can block localizeReviewAssets
and prepare indefinitely. Update requestBinaryUrl to use an AbortSignal timeout
(or equivalent abort controller) when calling fetch, and make sure the timeout
is applied alongside the existing headers and optional fetchDispatcher handling
so the download remains bounded.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 37a10892-9103-4a96-aeb5-99f00ca3e76a

📥 Commits

Reviewing files that changed from the base of the PR and between da150cd and 334ece1.

📒 Files selected for processing (7)

• CHANGELOG.md
• src/orchestration/orchestrator.ts
• src/providers/gitlab/gitlab-provider.test.ts
• src/providers/gitlab/gitlab-provider.ts
• src/providers/provider.ts
• src/workspace/workspace-manager.test.ts
• src/workspace/workspace-manager.ts

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 334ece16f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid forwarding GitLab tokens on asset redirects

In GitLab instances backed by object storage or a CDN, upload downloads can return a 302 to a different host; this fetch follows redirects by default while reusing headers, and Node/undici preserves custom headers like PRIVATE-TOKEN across those redirects. That means preparing a bundle for a thread image can send the user's GitLab token to the storage/CDN origin, so redirects need to be handled manually and auth headers kept only on same-origin GitLab requests.

Useful? React with 👍 / 👎.