Agent skill · vince-winkintel
glab-artifact-registry
Exchange GitLab credentials for short-lived Artifact Registry tokens, verify token identity, and configure package-manager authentication with glab. Use when checking GitLab Artifact Registry access, obtaining an ephemeral registry token, or configuring Docker, Maven, Gradle, npm, or sbt for a GitLab Artifact Registry. Triggers on artifact registry, glab artifact-registry, glab ar, get-token, token exchange, registry access status, artifact-registry login, Docker credential helper, Maven registry, Gradle registry, npm auth, sbt credentials.
What it needs
About 4k tokens when loaded.
What this skill does
glab artifact-registry Exchange the active GitLab credential for a short-lived Artifact Registry access token. The command group also accepts the glab ar alias. This command group is experimental; verify live help and the target GitLab instance before using it in durable automation. Prerequisites GitLab Enterprise Edition 19.1 or later. The instance administrator enabled the gatetokenexchangeendpoint feature flag. glab is authenticated to the intended hostname. The token is ephemeral but still a credential. Never print it in logs, store it in a repository, include it in command arguments, or paste it into issue/MR content. Check access first status performs the token exchange and prints non-secret identity metadata: issuer, subject, audience, and expiry. Each check mints and immediately discards a server-side token; prefer JSON for automation and do not call it in a tight loop. Confirm that the issuer, subject, and audience identify the intended instance, actor, and registry before requesting a token for another process. Request a short-lived token Text output is the bare token on stdout so a shell can capture or pipe it. Default duration is 15 minutes; accepted durations range from 1 second through 12 hours. Use the shortest duration that covers the operation. Use --output json only when a consumer also needs the expiry. Treat the JSON document as secret because it contains the token. Do not pass --jq expressions that print the token into logs. Configure package-manager authentication glab artifact-registry login configures exactly one package manager per run: --docker installs the docker-credential-glab shim and registers glab under Docker's per-registry credHelpers. --maven writes a <server> block to ~/.m2/settings.xml, keyed by --registry-alias; the consuming <repository> must use the same <id>. --gradle writes {alias}Url, {alias}Username, and {alias}Password to ~/.gradle/gradle.properties, where {alias} is --registry-alias. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills vince-winkintel/glab-artifact-registry