Skip to content

fix(gitlab): repository lookup uses the only signed-in glab host - #26646

Open
juliusmarminge wants to merge 6 commits into
mainfrom
fix/issue-26606
Open

juliusmarminge wants to merge 6 commits into
mainfrom
fix/issue-26606

Conversation

@juliusmarminge

Copy link
Copy Markdown
Member

Problem

When glab is signed in only to a self-hosted GitLab and its default host is left at gitlab.com, Add project → GitLab repository → group/project fails with "Repository lookup failed". The lookup runs glab api projects/<path> from the server's working directory, which has no GitLab remote, so glab sends it to gitlab.com. Publishing a repository to GitLab has the same problem. Reproduced on main 886d8f6 against a stub self-hosted GitLab (see Verification).

Change

Before a repository lookup or publish, GitLabCli runs glab auth status (5 s timeout). It points glab at a host only when all of these hold:

  • One host signed in: exactly one host is signed in.
  • No explicit host: the server's environment does not already set GITLAB_HOST, GL_HOST or GITLAB_URI.
  • No known remote: no remote in the working directory, fetch or push URL, is on gitlab.com or a host glab is configured for. Without such a remote glab would fall back to its default host.

In that case the glab child process gets GITLAB_HOST=<that host>. In every other case, including a failed or timed-out probe, the command runs exactly as on main.

  • Why GITLAB_HOST and not --hostname: glab 1.124 rejects a host with a port as --hostname, but accepts it in GITLAB_HOST.
  • Host spelling: the host is passed exactly as glab auth status printed it, because glab matches its config keys case-sensitively. parseGitLabAuthStatusHosts no longer lowercases; its two existing callers lowercase where they compare.
  • Shared remote parsing: the remote check uses the provider's existing remote-host parsing, which handles userless SCP remotes. It now also accepts a trailing slash.

Out of scope:

Scope and approval

Fixes #26606

Triaged via the automated issue flow.

Verification

  • Focused tests in packages/source-control-gitlab/src/server/GitLabCli.test.ts: vp test run src/server/ gives 126 passed (9 files).
    • The red test fails on main with expected 'api projects/team%2Fapp' to contain '--hostname …' (later rewritten to assert the env), and passes with the fix.
    • It covers: a single signed-in host with a port and mixed case; an explicit GITLAB_HOST; several signed-in hosts; a gitlab.com remote in the four forms (with a user, userless SCP, trailing slash, push URL only); publish passing the host on both API calls; and an auth-status timeout falling back to the original command.
    • Each remote case was checked red by reverting its part of the fix.
  • vp run check:changed passed: format, lint, knip, typecheck, and tests next to the changes.
  • Real glab 1.124 against a stub self-hosted GitLab, using a synthetic config, a stub server and a transcript:
  • Real app: web dev server on a fresh database, Add project → GitLab repository → team/app. The server-only change shows up as the lookup result.
Before (main 886d8f6, no default host) Control (main 886d8f6, default host = self-hosted) After (b91ef48, reporter's config host: gitlab.com)
before-main-lookup-failed.png control-main-default-host-set.png after-branch-lookup-found.png
  • The before and control runs used a config with no default host. On main, glab falls back to gitlab.com either way.
  • The last commit, the push-URL and trailing-slash remote checks, came after the app capture and is covered by the unit tests above.
  • Not checked:
    • glab versions other than 1.124.
    • A live self-hosted GitLab instance.
    • The macOS desktop app that the reporter used. The fix is server-side only, so I ran it on Linux.

Model and harness: Claude Opus 5.5 (Claude Code, T3 Code issue lead) with reviewers GPT-6.1 Sol (Codex) and Claude Opus 5.5.

🤖 Generated with Claude Code

juliusmarminge and others added 6 commits October 28, 2026 19:18
…gned-in host

These tests reproduce #26606: with no glab default host and a single
signed-in self-hosted host, getRepositoryCloneUrls runs `glab api` without
--hostname, so glab queries gitlab.com instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…glab host

Outside a GitLab checkout glab falls back to gitlab.com, so a user signed in
only to a self-hosted GitLab got a 404 when adding a GitLab repository or
publishing to one. When `glab auth status` reports exactly one signed-in host,
pass `--hostname <host>` to those `glab api` calls; otherwise, or if auth
status cannot run, keep today's argv.

Fixes #26606

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…a GITLAB_HOST

--hostname rejects host:port and IP hosts and overrides a checkout's remote.
Pass GITLAB_HOST in the child env instead, only when the user has not set
GITLAB_HOST/GITLAB_URI/GL_HOST and no remote of the cwd is on gitlab.com or a
host glab lists (glab would read its host from that remote, and GITLAB_HOST
overrides it for `glab api`). Keep the host as `glab auth status` printed it,
since glab matches config keys case-sensitively; existing comparisons
lowercase at the call site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The signed-in host fallback skipped remotes such as gitlab.com:team/app.git
and set GITLAB_HOST over them. Share the provider's SCP-aware remote host
parsing with the fallback guard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… host

glab also identifies a repository by a remote's push URL, and accepts
userless SCP remotes with a trailing slash. Check both before pointing the
fallback host at the only signed-in host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:M 30-99 changed lines (additions + deletions). labels Oct 28, 2026
@macroscopeapp

macroscopeapp Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — The fallback host for GitLab repository lookup and creation changes from gitlab.com to the sole signed-in host when no explicit host or recognized remote applies. Human review is needed to confirm this new default destination, including for project creation.

You can add or adjust custom eligibility rules. Learn more.

@github-actions

Copy link
Copy Markdown
Contributor

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider Metric Main baseline This PR Impact PR ceiling
Codex Total thread wire 5.0 KiB 5.0 KiB 0 B (0.0%) 6.8 KiB ✅
Codex Thread snapshot wire 3.8 KiB 3.8 KiB 0 B (0.0%) 4.9 KiB ✅
Codex Live turn WebSocket wire 1.2 KiB 1.2 KiB 0 B (0.0%) 2.0 KiB ✅
Codex Live turn WebSocket decoded 21.6 KiB 21.6 KiB 0 B (0.0%) 24.4 KiB ✅
Codex Live turn messages 2 2 0 (0.0%) 8 ✅
Claude Total thread wire 5.0 KiB 5.1 KiB +6 B (+0.1%) 6.8 KiB ✅
Claude Thread snapshot wire 3.8 KiB 3.8 KiB 0 B (0.0%) 4.9 KiB ✅
Claude Live turn WebSocket wire 1.3 KiB 1.3 KiB +6 B (+0.5%) 2.0 KiB ✅
Claude Live turn WebSocket decoded 21.9 KiB 21.9 KiB 0 B (0.0%) 24.4 KiB ✅
Claude Live turn messages 2 2 0 (0.0%) 8 ✅

Baseline: 9826dbb · PR result: 9201451 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

  • Codex decoded thread snapshot: 108.5 KiB
  • Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

@coderabbitai

coderabbitai Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 9826dbb and 9201451.

Files selected for processing: 4
  • packages/source-control-gitlab/src/server/GitLabCli.test.ts
  • packages/source-control-gitlab/src/server/GitLabCli.ts
  • packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
  • packages/source-control-gitlab/src/server/gitLabAuthStatus.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

GitLab CLI repository lookup and creation now select the sole signed-in host when no host is explicitly configured and no GitLab remote determines the host. Remote parsing handles userless SCP-style URLs, and host comparisons are case-insensitive.

Changes: GitLab host selection

Layer / File(s) Summary
Host parsing and casing
packages/source-control-gitlab/src/server/GitLabCli.ts, packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts, packages/source-control-gitlab/src/server/gitLabAuthStatus.ts
GitLab remote parsing handles userless SCP-style URLs. Authenticated host comparisons ignore casing, while parsed host entries retain their casing.
Signed-in host selection
packages/source-control-gitlab/src/server/GitLabCli.ts, packages/source-control-gitlab/src/server/GitLabCli.test.ts
When no host variable is set, the CLI checks authentication status and Git remotes before selecting a host. Tests cover timeouts, remote configurations, and host-selection behavior.
Repository API host integration
packages/source-control-gitlab/src/server/GitLabCli.ts, packages/source-control-gitlab/src/server/GitLabCli.test.ts
Repository lookup, namespace lookup, and project creation use the selected environment. Tests verify lookup and publishing with a sole signed-in host.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant GitLabCli
  participant glab
  participant GitService
  participant ProcessExecution
  GitLabCli->>glab: Check auth status with a 5-second timeout
  glab-->>GitLabCli: Return configured hosts and accounts
  GitLabCli->>GitService: Inspect remote fetch and push URLs
  GitService-->>GitLabCli: Return remote URLs
  GitLabCli->>ProcessExecution: Run repository API command with selected environment
Loading

Possibly related issues

  • pingdotgg/t3code#17209 — The new 5-second timeout bounds the auth-status probe, but the change does not add caching for repeated probes.
  • pingdotgg/t3code#22342 — The existing generic CLI error mapping remains; this change does not add diagnostic details.

Suggested labels: bugfix, size:L

Suggested reviewers: macroscopeapp, maria-rcks

Merge Risk: Minimal · up to 92014

The host-selection change appears mergeable after normal checks; no unresolved issue was established that would block repository lookup or publishing.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: using the only signed-in GitLab host for repository lookup.
Description check Passed The description includes complete Problem, Change, Scope and approval, and Verification sections. It explains the behavior, scope, tests, manual checks, limitations, and agent usage.
Linked Issues check Passed Issue #26606 requires bare GitLab repository lookup on the only signed-in self-hosted host. GitLabCli probes glab auth status, requires one authenticated host, skips override when an explicit host…
Out of Scope Changes check Passed The changes stay within the GitLab host-selection fix for issue #26606. Remote parsing, auth-host casing, provider comparisons, repository creation, and tests support safe host selection. The PR does …
Full details: Linked Issues check

Explanation

Issue #26606 requires bare GitLab repository lookup on the only signed-in self-hosted host. GitLabCli probes glab auth status, requires one authenticated host, skips override when an explicit host or matching remote exists, and passes the printed host through GITLAB_HOST. The lookup and repository creation calls use the selected environment. Tests cover the host, environment, remote, timeout, and publishing cases.

Full details: Out of Scope Changes check

Explanation

The changes stay within the GitLab host-selection fix for issue #26606. Remote parsing, auth-host casing, provider comparisons, repository creation, and tests support safe host selection. The PR does not implement the excluded full-URL input, multi-host picker, or generic error-text changes.

Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@juliusmarminge juliusmarminge added bugfix Fix PR opened by an issue lead; enters the PR loop pr:needs-julius Needs Julius: route gate, unverifiable surface, or blocked labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Fix PR opened by an issue lead; enters the PR loop pr:needs-julius Needs Julius: route gate, unverifiable surface, or blocked size:M 30-99 changed lines (additions + deletions). vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: GitLab repository lookup ignores the signed-in self-hosted host and queries gitlab.com when glab's default host is unset

1 participant