Use gitlab-config.

.gitignore

@@ -1,3 +1,4 @@
 tests.xml
 coverage.*
 codeclimate.json
+/keys.txt

.gitlab-ci.yml

@@ -125,15 +125,34 @@ sync_releases:
   stage: deploy
 
   image:
-    name: registry.gitlab.com/tozd/gitlab/release/tag/v0-3-3:latest-debug
+    name: registry.gitlab.com/tozd/gitlab/release/tag/v0-6-0:latest-debug
     entrypoint: [""]
 
   script:
-    - /gitlab-release
+    # On branch jobs, just update or remove releases, thus releases are created only on tag jobs.
+    - /gitlab-release ${CI_COMMIT_BRANCH:+--no-create}
 
   rules:
     # Protected tags start with "v".
     - if: '$GITLAB_API_TOKEN && ($CI_COMMIT_BRANCH == "main" || ($CI_COMMIT_TAG && $CI_COMMIT_REF_NAME =~ /^v/))'
 
   # We do not need build artifacts in this job.
   dependencies: []
+
+sync_config:
+  stage: deploy
+
+  image:
+    name: registry.gitlab.com/tozd/gitlab/config/tag/v0-5-0:latest-debug
+    entrypoint: [""]
+
+  script:
+    - /gitlab-config set
+
+  rules:
+    - if: '$GITLAB_API_TOKEN && $SOPS_AGE_KEY_FILE && $CI_COMMIT_BRANCH == "main"'
+      changes:
+        - .gitlab-conf.yml
+
+  # We do not need build artifacts in this job.
+  dependencies: []

.gitlab-conf.yml

@@ -0,0 +1,348 @@
+project:
+  # Set whether or not merge requests can be merged with skipped jobs. Type: boolean
+  allow_merge_on_skipped_pipeline: null
+  # Set whether or not a pipeline triggerer is allowed to approve deployments. Type:
+  # boolean
+  allow_pipeline_trigger_approve_deployment: false
+  # One of disabled, private or enabled. Type: string
+  analytics_access_level: enabled
+  # Auto-cancel pending pipelines. This action toggles between an enabled state and
+  # a disabled state; it is not a boolean. Type: string
+  auto_cancel_pending_pipelines: enabled
+  # Auto Deploy strategy (continuous, manual, or timed_incremental). Type: string
+  auto_devops_deploy_strategy: continuous
+  # Enable Auto DevOps for this project. Type: boolean
+  auto_devops_enabled: false
+  # Set whether auto-closing referenced issues on default branch. Type: boolean
+  autoclose_referenced_issues: true
+  # The Git strategy. Defaults to fetch. Type: string
+  build_git_strategy: fetch
+  # The maximum amount of time, in seconds, that a job can run. Type: integer
+  build_timeout: 3600
+  # One of disabled, private, or enabled. Type: string
+  builds_access_level: enabled
+  # Enable or disable running pipelines in the parent project for merge requests
+  # from forks. (Introduced in GitLab 15.3.) Type: boolean
+  ci_allow_fork_pipelines_to_run_in_parent_project: true
+  # The path to CI configuration file. Type: string
+  ci_config_path: ""
+  # Default number of revisions for shallow cloning. Type: integer
+  ci_default_git_depth: 20
+  # Enable or disable prevent outdated deployment jobs. Type: boolean
+  ci_forward_deployment_enabled: true
+  # Enable or disable allow job retries for rollback deployments. Type: boolean
+  ci_forward_deployment_rollback_allowed: true
+  # Set whether or not caches should be separated by branch protection status. Type:
+  # boolean
+  ci_separated_caches: true
+  # Update the image cleanup policy for this project. Accepts: cadence (string),
+  # keep_n (integer), older_than (string), name_regex (string), name_regex_delete
+  # (string), name_regex_keep (string), enabled (boolean). Type: hash
+  container_expiration_policy:
+    cadence: 1d
+    enabled: false
+    keep_n: 10
+    name_regex_delete: .*
+    name_regex_keep: null
+    older_than: 90d
+  # Set visibility of container registry, for this project, to one of disabled,
+  # private or enabled. Type: string
+  container_registry_access_level: disabled
+  # The default branch name. Type: string
+  default_branch: main
+  # Short project description. Type: string
+  description: A Go package to control another process and call system calls in it. https://pkg.go.dev/gitlab.com/tozd/go/pcontrol
+  # Enable email notifications. Type: boolean
+  emails_enabled: true
+  # Enforce auth checks on uploads. Type: boolean
+  enforce_auth_checks_on_uploads: true
+  # One of disabled, private, or enabled. Type: string
+  environments_access_level: disabled
+  # The classification label for the project. Type: string
+  external_authorization_classification_label: ""
+  # One of disabled, private, or enabled. Type: string
+  feature_flags_access_level: disabled
+  # One of disabled, private, or enabled. Type: string
+  forking_access_level: enabled
+  # Enable group runners for this project. Type: boolean
+  group_runners_enabled: true
+  # URL the repository was imported from. Type: string
+  import_url: null
+  # One of disabled, private, or enabled. Type: string
+  infrastructure_access_level: disabled
+  # Template used to suggest names for branches created from issues. (Introduced in
+  # GitLab 15.6.) Type: string
+  issue_branch_template: null
+  # One of disabled, private, or enabled. Type: string
+  issues_access_level: enabled
+  # Default description for Issues. Description is parsed with GitLab Flavored
+  # Markdown. See Templates for issues and merge requests. Type: string
+  issues_template: null
+  # Disable or enable the ability to keep the latest artifact for this project.
+  # Type: boolean
+  keep_latest_artifact: true
+  # Enable LFS. Type: boolean
+  lfs_enabled: true
+  # Template used to create merge commit message in merge requests. (Introduced in
+  # GitLab 14.5.) Type: string
+  merge_commit_template: null
+  # Set the merge method used. Type: string
+  merge_method: merge
+  # Enable or disable merge pipelines. Type: boolean
+  merge_pipelines_enabled: false
+  # One of disabled, private, or enabled. Type: string
+  merge_requests_access_level: enabled
+  # Default description for merge requests. Description is parsed with GitLab
+  # Flavored Markdown. See Templates for issues and merge requests. Type: string
+  merge_requests_template: null
+  # Enable or disable merge trains. Type: boolean
+  merge_trains_enabled: false
+  # One of disabled, private, or enabled. Type: string
+  monitor_access_level: disabled
+  # Set whether merge requests can only be merged when all the discussions are
+  # resolved. Type: boolean
+  only_allow_merge_if_all_discussions_are_resolved: false
+  # Indicates that merges of merge requests should be blocked unless all status
+  # checks have passed. Defaults to false.Introduced in GitLab 15.5 with feature
+  # flag only_allow_merge_if_all_status_checks_passed disabled by default. The
+  # feature flag was enabled by default in GitLab 15.9. Type: boolean
+  only_allow_merge_if_all_status_checks_passed: false
+  # Set whether merge requests can only be merged with successful jobs. Type:
+  # boolean
+  only_allow_merge_if_pipeline_succeeds: false
+  # Enable or disable packages repository feature. Type: boolean
+  packages_enabled: false
+  # One of disabled, private, enabled, or public. Type: string
+  pages_access_level: enabled
+  # Show link to create/view merge request when pushing from the command line. Type:
+  # boolean
+  printing_merge_request_link_enabled: true
+  # If true, jobs can be viewed by non-project members. Type: boolean
+  public_jobs: true
+  # One of disabled, private, or enabled. Type: string
+  releases_access_level: enabled
+  # Enable Delete source branch option by default for all new merge requests. Type:
+  # boolean
+  remove_source_branch_after_merge: true
+  # One of disabled, private, or enabled. Type: string
+  repository_access_level: enabled
+  # Allow users to request member access. Type: boolean
+  request_access_enabled: true
+  # One of disabled, private, enabled or public. Type: string
+  requirements_access_level: disabled
+  # Automatically resolve merge request diffs discussions on lines changed with a
+  # push. Type: boolean
+  resolve_outdated_diff_discussions: false
+  # Allow only users with the Maintainer role to pass user-defined variables when
+  # triggering a pipeline. For example when the pipeline is triggered in the UI,
+  # with the API, or by a trigger token. Type: boolean
+  restrict_user_defined_variables: false
+  # (GitLab 14.9 and later) Security and compliance access level. One of disabled,
+  # private, or enabled. Type: string
+  security_and_compliance_access_level: disabled
+  # Enable or disable Service Desk feature. Type: boolean
+  service_desk_enabled: true
+  # Enable shared runners for this project. Type: boolean
+  shared_runners_enabled: true
+  # One of disabled, private, or enabled. Type: string
+  snippets_access_level: disabled
+  # Template used to create squash commit message in merge requests. (Introduced in
+  # GitLab 14.6.) Type: string
+  squash_commit_template: null
+  # One of never, always, default_on, or default_off. Type: string
+  squash_option: default_off
+  # The commit message used to apply merge request suggestions. Type: string
+  suggestion_commit_message: null
+  # The list of topics for the project. This replaces any existing topics that are
+  # already added to the project. (Introduced in GitLab 14.0.) Type: array
+  topics:
+    - go
+    - ptrace
+  # One of disabled, private, or enabled. Type: string
+  wiki_access_level: disabled
+avatar: ""
+# expires_at: Share expiration date in ISO 8601 format: 2016-09-26. Type: string
+# group_access: The role (access_level) to grant the group. Type: integer
+# group_id: The ID of the group to share with. Type: integer
+shared_with_groups: []
+approvals:
+  # Allow or prevent overriding approvers per merge request. Type: boolean
+  disable_overriding_approvers_per_merge_request: false
+  # Allow or prevent authors from self approving merge requests; true means authors
+  # can self approve. Type: boolean
+  merge_requests_author_approval: false
+  # Allow or prevent committers from self approving merge requests. Type: boolean
+  merge_requests_disable_committers_approval: false
+  # Require approver to enter a password to authenticate before adding the approval.
+  # Type: boolean
+  require_password_to_approve: false
+  # Reset approvals on a new push. Type: boolean
+  reset_approvals_on_push: true
+  # Reset approvals from Code Owners if their files changed. Can be enabled only if
+  # reset_approvals_on_push is disabled. Type: boolean
+  selective_code_owner_removals: false
+# applies_to_all_protected_branches: Whether the rule is applied to all protected
+# branches. If set to true, the value of protected_branch_ids is ignored. Default
+# is false. Introduced in GitLab 15.3. Type: boolean
+# approvals_required: The number of required approvals for this rule. Type:
+# integer
+# group_ids: The IDs of groups as approvers. Type: Array
+# id: The ID of a approval rule. Type: integer
+# name: The name of the approval rule. Type: string
+# protected_branch_ids: The IDs of protected branches to scope the rule by. To
+# identify the ID, use the API. Type: Array
+# rule_type: The type of rule. any_approver is a pre-configured default rule with
+# approvals_required at 0. Other rules are regular and report_approver. Type:
+# string
+# user_ids: The IDs of users as approvers. If you provide both user_ids and
+# usernames, both lists of users are added. Type: Array
+approval_rules: []
+push_rules:
+  # All commit author emails must match this, for example @my-company.com$. Type:
+  # string
+  author_email_regex: ""
+  # All branch names must match this, for example `(feature. Type: string
+  branch_name_regex: null
+  # Users can only push commits to this repository if the committer email is one of
+  # their own verified emails. Type: boolean
+  commit_committer_check: null
+  # No commit message is allowed to match this, for example ssh\:\/\/. Type: string
+  commit_message_negative_regex: null
+  # All commit messages must match this, for example Fixed \d+\..*. Type: string
+  commit_message_regex: ""
+  # Deny deleting a tag. Type: boolean
+  deny_delete_tag: false
+  # All committed filenames must not match this, for example `(jar. Type: string
+  file_name_regex: ""
+  # Maximum file size (MB). Type: integer
+  max_file_size: 0
+  # Restrict commits by author (email) to existing GitLab users. Type: boolean
+  member_check: false
+  # GitLab rejects any files that are likely to contain secrets. Type: boolean
+  prevent_secrets: false
+  # Reject commits when they are not GPG signed. Type: boolean
+  reject_unsigned_commits: null
+forked_from_project: 0
+# color: The color of the label given in 6-digit hex notation with leading '#'
+# sign (for example, #FFAABB) or one of the CSS color names. Type: string
+# description: The description of the label. Type: string
+# id: The ID or title of a group's label. Type: integer or string
+# name: The name of the label. Type: string
+# priority: The priority of the label. Must be greater or equal than zero or null
+# to remove the priority. Type: integer
+labels: []
+# allow_force_push: When enabled, members who can push to this branch can also
+# force push. Type: boolean
+# allowed_to_merge: Array of merge access levels, with each described by a hash of
+# the form {user_id: integer}, {group_id: integer}, or {access_level: integer}.
+# Type: array
+# allowed_to_push: Array of push access levels, with each described by a hash of
+# the form {user_id: integer}, {group_id: integer}, or {access_level: integer}.
+# Type: array
+# allowed_to_unprotect: Array of unprotect access levels, with each described by a
+# hash of the form {user_id: integer}, {group_id: integer}, {access_level:
+# integer}, or {id: integer, _destroy: true} to destroy an existing access level.
+# The access level No access is not available for this field. Type: array
+# code_owner_approval_required: Prevent pushes to this branch if it matches an
+# item in the CODEOWNERS file. Type: boolean
+# name: The name of the branch or wildcard. Type: string
+protected_branches:
+  - allow_force_push: false
+    allowed_to_merge:
+      # Maintainers
+      - access_level: 40
+        group_id: null
+        id: 76085787
+        user_id: null
+    allowed_to_push:
+      # Maintainers
+      - access_level: 40
+        deploy_key_id: null
+        group_id: null
+        id: 77865038
+        user_id: null
+    allowed_to_unprotect: []
+    code_owner_approval_required: false
+    name: main
+# allowed_to_create: Array of access levels allowed to create tags, with each
+# described by a hash of the form {user_id: integer}, {group_id: integer}, or
+# {access_level: integer}. Type: array
+# name: The name of the tag or wildcard. Type: string
+protected_tags:
+  - allowed_to_create:
+      # TOZD Bot
+      - access_level: 40
+        deploy_key_id: null
+        group_id: null
+        user_id: 10417491
+      # Maintainers
+      - access_level: 40
+        deploy_key_id: null
+        group_id: null
+        user_id: null
+    name: v*
+# description: The description of the variable. Default: null. Introduced in
+# GitLab 16.2. Type: string
+# environment_scope: The environment_scope of the variable. Default: *. Type:
+# string
+# key: The key of a variable; must have no more than 255 characters; only A-Z,
+# a-z, 0-9, and _ are allowed. Type: string
+# masked: Whether the variable is masked. Default: false. Type: boolean
+# protected: Whether the variable is protected. Default: false. Type: boolean
+# raw: Whether the variable is treated as a raw string. Default: false. When true,
+# variables in the value are not expanded. Type: boolean
+# value: The value of a variable. Type: string
+# variable_type: The type of a variable. Available types are: env_var (default)
+# and file. Type: string
+variables:
+  - description: null
+    environment_scope: '*'
+    key: GITLAB_API_TOKEN
+    masked: true
+    protected: true
+    raw: true
+    # sops:enc
+    value: ENC[AES256_GCM,data:1Ge0HMrW993GLXolLXYxnQFh6gA94M1Q+fU=,iv:08XiX1j5r5uzsRtq4269DkxToc+jslzfOCjTRLQM4tc=,tag:ly6mX+YsnXK9ZiXiiCaVYw==,type:str]
+    variable_type: env_var
+  - description: null
+    environment_scope: '*'
+    key: SOPS_AGE_KEY_FILE
+    masked: false
+    protected: true
+    raw: true
+    # sops:enc
+    value: ENC[AES256_GCM,data:64EWygToTCSsACgPoCI8fvDu4LtvcbYoLTMz04hNA9X+iSPNDBwtruHzXneieAlGurimlQHOO3t4Yqc6xDRKqUUx9g5+9nA5KCJzuKliM1wJhrMALFSGHknNh4vXNjd9PEYjbuHO6MJB9KkkWOzPAr8usCz7RLRAmU9CFFlQQC4nSOT2pihW6L6vf38hV+t2b6IQP7dOL5I4J7Ugv39WwIAivjmofZ4Em317kl8Bv2pMX73tqkAbMQZoJdZJ,iv:2dmRlOD/B/yF17MtehpboSlemIv6Xi22lRmRTgwigXA=,tag:3M2oHZV3ltwkg1Aj3yQfsw==,type:str]
+    variable_type: file
+# active: The activation of pipeline schedule. If false is set, the pipeline
+# schedule is initially deactivated. Type: boolean
+# cron: The cron schedule, for example: 0 1 * * *. Type: string
+# cron_timezone: The time zone supported by ActiveSupport::TimeZone (for example
+# Pacific Time (US & Canada)), or TZInfo::Timezone (for example
+# America/Los_Angeles). Type: string
+# description: The description of the pipeline schedule. Type: string
+# id: The pipeline schedule ID. Type: integer
+# ref: The branch or tag name that is triggered. Type: string
+# variables: Array of variables, with each described by a hash of the form {key:
+# string, value: string, variable_type: string}. Type: array
+pipeline_schedules: []
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1kp8vchw7hh7mwahpm6dc9dha2sruqytrz335anykyetuaram8pxsejgu0n
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyWUozREZlSnZjbWgvMUZY
+        U2Rnck9VU3E4R21MdEQyNTZ0VEc1NWFaU1VBCkt0NmJ5Y05jUGFUdnhHVS9qWm1F
+        ZllIazlJeG1hd2RqKzBTV1NuRFZGRUkKLS0tIG9seWVJYXM1azJkSlN5U3Vhc2xM
+        dkVmL1JwQnMrN0FKKzV0ZTZpaFVSbFkKDb8G2VN2Vfam1OnrZX9e5j68i8m+Mxrx
+        VM+KQGoGLam/lieYvpzg7slK42TiND8S0CFYQ8FxfYXf4AX3x6pCoQ==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2023-10-04T22:07:27Z"
+  mac: ENC[AES256_GCM,data:yH2j6XZ0xEcLk2DOAvfHEl/4KefjuEz4zST1a9gtxuYiYivy6RijPgKt/ruXRzuAJz4vL1QmkJT7hU3N4iF8Hi9/V4PjsKujrS0Cpi5dXoAmHRRQQ+aCmMwIERVNhY47N81Dh5i1+PuzJS6nX6k2NOkc7C756MbNgZeyQbBmBx4=,iv:YVlgMNqs5rpNFhD2dh5enr0lwXc1FcI8jSAQkp1RIak=,tag:FIylNUu6LUDOJnFA2xCSog==,type:str]
+  pgp: []
+  encrypted_comment_regex: sops:enc
+  mac_only_encrypted: true
+  version: 3.7.3

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: ^\.gitlab-conf\.yml$
+    age: age1kp8vchw7hh7mwahpm6dc9dha2sruqytrz335anykyetuaram8pxsejgu0n