fix: warn when gl-set-slack targets legacy service on a Slack-app repo

**Targets:**

- `make gl-add-sec` - Bulk-add CI/CD secrets from `GITLAB_SEC_FILE` (skips with message if file missing)

- `make gl-rm-sec` - Bulk-remove CI/CD secrets

- `make gl-set-slack SLACK_ON=<true\|false>` - Toggle Slack notifications

- `make gl-set-slack SLACK_ON=<true\|false>` - Toggle the **legacy** "Slack notifications" webhook (see note below)

- `make gl-merge-mr GITLAB_MERGE_REQUEST=<iid>` - Merge an MR

- `make gl-setup` - `gl-add-sec` + `gl-set-slack`

- `make gl-new-repo` - Create a new GitLab repository (also wires Slack on)

- `make gl-setup` - `gl-add-sec` + `gl-set-slack` (Slack = legacy webhook only)

- `make gl-new-repo` - Create a new GitLab repository (also wires on the **legacy** Slack webhook)

- `make gl-new-deploy-key` - Generate SSH keypair in Vault and register as deploy key

- `make gl-add-deploy-key` - Add `GITLAB_DEPLOY_KEY_FILE` to ssh-agent (`chmod 400` first)

> **Slack: legacy webhook vs. the GitLab for Slack app.** `gl-set-slack` (and `gl-setup` / `gl-new-repo`, which call it) configure only the **legacy "Slack notifications" webhook** service. They do **not** manage the modern **GitLab for Slack app** (slug `gitlab-slack-application`) — on a repo where that app is the active integration these are a no-op for live notifications (the command warns when it detects this). Configure the app via its Slack slash command (`/gitlab <project> settings`), the project UI, or `PUT /projects/:id/integrations/gitlab-slack-application`; it routes **per-event channels** (`issue_channel`, `note_channel`, …), so enabling an event without setting its channel silently drops it.

### gitlab-admin.mk

Instance-scoped GitLab admin: runner inventory and cleanup. No `GITLAB_REPO` or Vault required — operates against the server as a whole.

(`access_level >= 40`, inherited group owners included), so it works out of the

box. Set `OTICA_MAINTAINER=<gitlab-username>` (env or `~/.otica-maintainer`) only

to override who gets pinged. Want these in Slack too? Configure the **project's**

GitLab→Slack integration once with `make gl-set-slack SLACK_ON=true`; GitLab then

forwards events to your channel — the agents stay webhook-free. (Note: `gl-set-slack`

is a consumer-project target that needs vault auth + a `GITLAB_TOKEN`, separate

from the agents' `OTICA_SERVER_TOKEN` — it's a one-time project setup, not part of

the agent loop.)

GitLab→Slack integration once; GitLab then forwards events to your channel — the

agents stay webhook-free. There are **two distinct integrations**, pick the one

your repo actually uses:

- **GitLab for Slack app** (modern OAuth integration, slug

  `gitlab-slack-application`) — the common case. `gl-set-slack` does **not**

  manage this; configure it via its Slack slash command (`/gitlab <project>

  settings`), the project UI (Settings → Integrations → GitLab for Slack app), or

  `PUT /projects/:id/integrations/gitlab-slack-application`. It routes

  **per-event channels**, so for agent activity set `issue_channel` **and**

  `note_channel` (comments / agent @-mentions) — enabling `issues_events`/

  `note_events` without their channel silently drops the notification.

- **Legacy "Slack notifications" webhook** (slug `slack`) — configure once with

  `make gl-set-slack SLACK_ON=true`. (Consumer-project target; needs vault auth +

  a `GITLAB_TOKEN`, separate from the agents' `OTICA_SERVER_TOKEN`; a one-time

  setup, not part of the agent loop.) It **warns** if it detects the GitLab for

  Slack app is the active integration, since editing the legacy service would then

  be a no-op for live notifications.

## Operating caveats (read before first run)

- **The workflow scripts must exist on the branch the resolver branches from.**

.PHONY: gl-set-slack

gl-set-slack: SLACK_ON=true

gl-set-slack: vault-login gl-init ## toggle slack notifications. make gl-set-slack SLACK_ON=<true|false>

gl-set-slack: vault-login gl-init ## toggle legacy Slack-notifications webhook. make gl-set-slack SLACK_ON=<true|false>

	@gl-set-slack.sh ${SLACK_ON}

.PHONY: gl-merge-mr

	fi

.PHONY: gl-setup

gl-setup: gl-add-sec gl-set-slack ## set common gitlab, secrets, and other integrations

gl-setup: gl-add-sec gl-set-slack ## set common gitlab + secrets (Slack = legacy webhook only)

.PHONY: gl-new-repo

gl-new-repo: vault-login gl-init  ## create a new gitlab repo

proj_id=$(get_project_id ${GITLAB_REPO})

# When enabling, warn if the modern "GitLab for Slack app" is the active integration:

# this script edits only the legacy webhook service, so there it's a no-op for live

# notifications (issue #6). Fail open if the lookup errors (permission/network).

if [[ "true" == "$SLACK_ON" ]]; then

    active_app=$(gitlab_get "projects/$proj_id/integrations" 2>/dev/null \

        | jq -r '.[]? | select(.slug=="gitlab-slack-application" and .active==true) | .slug' 2>/dev/null || true)

    if [[ -n "$active_app" ]]; then

        cat >&2 <<'EOF'

WARNING: this project's active Slack integration is the "GitLab for Slack app"

(gitlab-slack-application), but gl-set-slack configures only the legacy

"Slack notifications" (incoming-webhook) service. This change will NOT affect

live notifications.

Configure the GitLab for Slack app instead via one of:

  - the Slack slash command:  /gitlab <project> settings

  - the project UI:           Settings > Integrations > GitLab for Slack app

  - the API:  PUT /projects/:id/integrations/gitlab-slack-application

The app routes per-event channels, so set issue_channel / note_channel /

merge_request_channel etc. explicitly -- enabling an event without its channel

silently drops it.

EOF

    fi

fi

slack_json | render.sh | gitlab_put_stdin projects/$proj_id/services/slack | grep "Slack notifications" > /dev/null

if [[ "true" == "$SLACK_ON" ]]; then