GitLab CI
Store QUOLLVAULT_TOKEN as a masked/protected CI variable and upload after the build job creates the artifact.
yaml
upload_quollvault:
script:
- npm install --global quollvault-cli
- quollvault config set api https://api.quollvault.com
- quollvault config set app "$QUOLLVAULT_APP_ID"
- quollvault config set environment "$QUOLLVAULT_ENVIRONMENT_ID"
- quollvault upload ./build/app.apk --app-identifier "$QUOLLVAULT_APP_IDENTIFIER" --version "$QUOLLVAULT_VERSION" --build-number "$QUOLLVAULT_BUILD_NUMBER"QuollVault detects GitLab CI provenance from standard CI variables. Do not echo the token or place it in command arguments.
Prompt an agent to add GitLab CI upload
text
Add a QuollVault upload job to this repository's GitLab CI pipeline.
Inspect `.gitlab-ci.yml` and included pipeline files first. Put the upload after the mobile artifact is built and make sure the job receives that artifact through the existing dependency or artifact flow. Install `quollvault-cli`, configure the API origin plus App and Environment UUIDs, then upload the actual IPA, APK or AAB. Map `QUOLLVAULT_TOKEN` only from a masked, protected GitLab CI variable. Store the non-secret target IDs and required Android identity values as ordinary CI variables. Keep GitLab's native provenance environment intact and never echo the token.
Before editing, ask me which pipeline job and artifact to use if there is more than one candidate. Ask which App/Environment, variable scope and Android identity source to use whenever those choices are not established in the repository. If the token variable is absent, ask me to configure it in GitLab rather than requesting its value.
Validate the CI YAML and report the required variable names, job dependency and artifact path without exposing secrets.Common failures
Ensure the upload job receives the build artifact, masked variables are available on the branch, and the Automation Token scope covers the selected App.