feat(scm): detect self-hosted GitLab out of the box with glab v1.5x (kunchenguid#346)

* fix(gitlab): drive self-hosted GitLab out-of-the-box with glab v1.5x

Make the GitLab backend work against self-hosted instances and the
current glab CLI without manual configuration.

Self-hosted detection:
- DetectProvider falls back to glab's configured hosts (config.yml,
  honoring GLAB_CONFIG_DIR/XDG_CONFIG_HOME) when a remote's hostname
  carries no "gitlab" marker, matching on the host key or its api_host.
  Reads only what the user configured; no host is hardcoded; any
  read/parse failure fails closed to ProviderUnknown.
- Add scm.ExtractHost to recover the host (sans port, lowercased) from
  scp-style, URL, and ssh:// remotes, including IPv6 literals and
  '@'-in-path edge cases.

glab v1.5x backend fixes:
- Scope `glab auth status` with --hostname <host>. Unscoped, it checks
  every configured instance and fails if ANY has a stale token, falsely
  reporting an authenticated repo as unauthenticated. Falls back to the
  unscoped check when the host is unknown (fail-safe).
- Drop the removed `--state opened` flag from `glab mr list`; open is the
  default in v1.5x and passing the unknown flag fails the whole command.
- Read pipeline jobs via the branch-independent REST endpoint
  (`glab api projects/<group%2Fproject>/pipelines/<id>/jobs`) so they
  work in the daemon's detached-HEAD worktree, where `glab ci get`
  refuses to run. --paginate walks every page; the parser handles the
  resulting concatenated JSON documents. Maps finished_at into
  Check.CompletedAt for CI re-run detection. The legacy `glab ci get`
  path remains as the fallback when no project path is known.

Structural polish:
- Locate the GitLab project-path parser in the gitlab backend as
  exported gitlab.ProjectPath, mirroring github.RepoSlug, instead of a
  private helper in the pipeline layer.
- Scope the Host via positional constructor params
  New(cmd, cliAvailable, host, projectPath), matching the GitHub
  backend, rather than an Options struct.
- Distinguish clean EOF from a malformed mid-stream document when
  decoding paginated jobs: surface the decode error instead of silently
  swallowing a corrupt page, while still returning any jobs that parsed.
- Escape each project-path segment with url.PathEscape (rejoined with
  %2F) instead of a bare slash replacement.

* fix(gitlab): propagate paginated CI decode errors; tighten gitlab fallback test and ExtractHost subtests

Surface decode errors from paginated `glab api` output so a corrupt
later page can no longer hide a failed job. parseGitlabJobs previously
dropped the decode error whenever at least one job parsed, letting
GetChecks treat a partial slice as authoritative; a failed job on a
dropped page would then read green. It now returns the parsed checks
alongside any non-nil decode error.

Align the GetChecks fallback test fixture with the real invocation:
the fallback runs `glab ci get --pipeline-id <id> --output json
--with-job-details`, but the mock keyed on the command without
--with-job-details, so the case passed through the generic
unexpected-command path instead of the intended fallback-error path.

Convert TestExtractHost to t.Run subtests so each remote-URL case
reports independently, matching the table-driven convention used by the
neighboring tests in the file.

* no-mistakes(document): document out-of-the-box self-hosted GitLab detection in provider guide

* no-mistakes(document): document glab config env vars and self-hosted GitLab detection

* no-mistakes: apply CI fixes

Author: karotkriss

AGENTS.md

@@ -69,6 +69,12 @@ Safest local verification sequence after non-trivial changes:
 - GitLab and Bitbucket fork MR/PR routing is intentionally out of scope until implemented end to end.
 - If a legacy or manually edited row has `fork_url` for GitLab or Bitbucket, PR creation must skip instead of opening a self PR.
 
+**GitLab Backend (`internal/scm/gitlab`)**
+
+- The GitLab `Host` is constructed via `gitlab.New(cmd, cliAvailable, host, projectPath)`, mirroring the GitHub backend's positional constructor. `host` is the repo's GitLab hostname (from `scm.ExtractHost(UpstreamURL)`); `projectPath` is the `group/project` path (subgroups allowed, from `gitlab.ProjectPath` - which lives in the gitlab package next to the `Host` that consumes it, mirroring `github.RepoSlug`). Both are optional; passing `"", ""` reproduces the legacy unscoped behavior used by unit tests.
+- glab's flag surface drifts between versions; the backend is pinned against `glab v1.5x`. Two flags bit us: `glab auth status` must be **host-scoped** with `--hostname <host>` (unscoped, it checks every configured instance and fails if ANY has a stale token, falsely reporting an authenticated repo as unauthenticated); and `glab mr list` no longer accepts `--state opened` (open is the default; v1.5x exposes `-c/--closed`, `-M/--merged`, `-A/--all`) - passing the removed flag fails the whole command. When the host is unknown, fall back to the unscoped auth check (fail-safe).
+- The daemon operates in a **detached-HEAD worktree** (it checks out the commit, not a branch). `glab ci get` refuses to run there ("you're not on any Git branch (a 'detached HEAD' state)") even with an explicit `--pipeline-id`. Read pipeline jobs via the branch-independent REST endpoint instead: `glab api projects/<url-encoded group%2Fproject>/pipelines/<id>/jobs` (`Host.pipelineJobsArgs`). The legacy `glab ci get` path is kept only as the fallback when no project path is supplied. The `glab api .../jobs` payload carries `finished_at`, mapped into `Check.CompletedAt` (needed for CI re-run detection).
+
 **Documentation**
 
 - Keep `README.md` concise and high-level. The bar needs to be extremely high for what has to show up there.

docs/src/content/docs/guides/provider-integration.md

@@ -140,6 +140,12 @@ These are GitHub and GitLab only right now.
 
 Self-hosted GitHub Enterprise and self-hosted GitLab instances work through the same `gh` and `glab` CLIs. Authenticate the CLI against your instance (`gh auth login --hostname your-ghe.example.com`, `glab auth login --hostname gitlab.example.com`) and `no-mistakes` will route through the CLI as usual.
 
+Self-hosted GitLab is detected out of the box even when the hostname carries no `gitlab` marker (for example `git.example.com`).
+When the hostname is not obviously GitLab, `no-mistakes` consults glab's configured hosts (`config.yml`, honoring `GLAB_CONFIG_DIR` then `XDG_CONFIG_HOME/glab-cli`, then `~/.config/glab-cli`) and treats the upstream as GitLab if its host appears there as a configured host or `api_host`.
+Running `glab auth login --hostname your-gitlab.example.com` is enough to make detection succeed; if glab is not configured for the host, detection fails closed and the upstream is treated as unsupported.
+
+The GitLab backend is pinned against `glab v1.5x`. Self-hosted detection and the merge-request and CI steps rely on its current flag and API surface, so keep `glab` reasonably up to date.
+
 ## Unsupported hosts
 
 If your upstream isn't GitHub, GitLab, or Bitbucket Cloud:

docs/src/content/docs/guides/troubleshooting.md

@@ -191,6 +191,7 @@ Check the [Provider Integration](/no-mistakes/guides/provider-integration/) requ
 - `gh auth status` shows not authenticated
 - Bitbucket env vars not set in the daemon's environment
 - Upstream is on a host that isn't supported (GitHub, GitLab, or `bitbucket.org`)
+- Self-hosted GitLab on a hostname with no `gitlab` marker isn't detected because `glab` isn't configured for the host; run `glab auth login --hostname your-gitlab.example.com` so detection finds it
 - A GitLab or Bitbucket repo record has a fork URL set; fork MR/PR routing is currently GitHub-only
 - You pushed the default branch (PR step always skips on the default branch)
 

docs/src/content/docs/reference/environment.md

@@ -79,6 +79,28 @@ Data directory used to discover OpenCode transcripts for intent extraction.
 When set, no-mistakes looks for OpenCode's intent transcript database at `$XDG_DATA_HOME/opencode/opencode.db`.
 When unset, it falls back to `~/.local/share/opencode/opencode.db`.
 
+## `GLAB_CONFIG_DIR`
+
+Directory holding glab's `config.yml`, consulted when detecting self-hosted GitLab.
+
+| | |
+|---|---|
+| Type | `string` |
+| Default | (none) |
+
+When the upstream hostname carries no `gitlab` marker, no-mistakes reads glab's configured hosts from `$GLAB_CONFIG_DIR/config.yml` to decide whether the host is a GitLab instance. It takes precedence over `XDG_CONFIG_HOME`. See [Provider Integration](/no-mistakes/guides/provider-integration/#self-hosted-githubgitlab).
+
+## `XDG_CONFIG_HOME`
+
+Config directory used to locate glab's `config.yml` for self-hosted GitLab detection.
+
+| | |
+|---|---|
+| Type | `string` |
+| Default | `~/.config` |
+
+When `GLAB_CONFIG_DIR` is unset, no-mistakes looks for glab's configured hosts at `$XDG_CONFIG_HOME/glab-cli/config.yml`, falling back to `~/.config/glab-cli/config.yml` when `XDG_CONFIG_HOME` is unset.
+
 ## `NO_MISTAKES_UMAMI_HOST`
 
 Override the telemetry collection host.

internal/pipeline/steps/host.go

@@ -41,7 +41,12 @@ func buildHost(sctx *pipeline.StepContext, provider scm.Provider) (scm.Host, str
 			// GitLab source-project routing is implemented end to end.
 			return nil, "fork PR routing for GitLab is not implemented"
 		}
-		return gitlab.New(cmdFactory, func() bool { return stepCLIAvailable(sctx, provider) }), ""
+		return gitlab.New(
+			cmdFactory,
+			func() bool { return stepCLIAvailable(sctx, provider) },
+			scm.ExtractHost(sctx.Repo.UpstreamURL),
+			gitlab.ProjectPath(sctx.Repo.UpstreamURL),
+		), ""
 	case scm.ProviderBitbucket:
 		if sctx.Repo.ForkURL != "" {
 			// Fork PR routing for Bitbucket is intentionally not half-wired.

internal/scm/auth_test.go

@@ -41,7 +41,9 @@ func TestCLIAvailable(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	t.Setenv("PATH", binDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	// Set PATH to JUST the temp dir so a real glab installed on the host does
+	// not leak in and make the ProviderGitLab assertion below flaky.
+	t.Setenv("PATH", binDir)
 
 	if !CLIAvailable(ProviderGitHub) {
 		t.Fatal("expected gh to be available")

internal/scm/gitlab/gitlab.go

@@ -2,12 +2,16 @@
 package gitlab
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"net/url"
 	"os/exec"
 	"strings"
+	"time"
 
 	"github.com/kunchenguid/no-mistakes/internal/scm"
 )
@@ -19,12 +23,93 @@ type CmdFactory func(ctx context.Context, name string, args ...string) *exec.Cmd
 type Host struct {
 	cmd          CmdFactory
 	cliAvailable func() bool
+	host         string // repo's GitLab hostname; scopes the auth check
+	projectPath  string // repo's "group/project" path; enables REST job reads
 }
 
 // New builds a Host. cliAvailable reports whether the glab binary is
-// resolvable on the caller's PATH (possibly overridden by env).
-func New(cmd CmdFactory, cliAvailable func() bool) *Host {
-	return &Host{cmd: cmd, cliAvailable: cliAvailable}
+// resolvable on the caller's PATH (possibly overridden by env). host is the
+// repo's GitLab hostname; when set the availability check is scoped to it via
+// --hostname so a stale credential for an unrelated configured glab host cannot
+// make this repo look unauthenticated. projectPath is the repo's "group/project"
+// path (subgroups allowed); when set, pipeline-job reads go through `glab api`
+// (REST), which is branch-independent and works in the daemon's detached-HEAD
+// worktree, where `glab ci get` refuses to run without a current branch. Both
+// are optional; empty reproduces the legacy unscoped behavior.
+func New(cmd CmdFactory, cliAvailable func() bool, host, projectPath string) *Host {
+	return &Host{
+		cmd:          cmd,
+		cliAvailable: cliAvailable,
+		host:         strings.TrimSpace(host),
+		projectPath:  strings.TrimSpace(projectPath),
+	}
+}
+
+// ProjectPath extracts the "group/project" path (no host, no trailing .git)
+// from a GitLab remote URL. GitLab projects can live under nested subgroups, so
+// the full path - not just the last two segments - is returned. It handles
+// HTTPS/ssh:// URLs and scp-style SSH (git@host:group/project.git). Returns ""
+// when no path can be determined; callers treat that as "unknown" and fall back
+// to branch-dependent porcelain.
+func ProjectPath(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+	var path string
+	if strings.Contains(raw, "://") {
+		if u, err := url.Parse(raw); err == nil {
+			path = u.Path
+		}
+	} else if colon := strings.Index(raw, ":"); colon >= 0 && !isWindowsDrivePath(raw) {
+		// scp-style: [user@]host:group/project.git -> group/project. The first
+		// ':' separates host from path, so the path is recovered whether or not
+		// a "user@" prefix is present (e.g. gitlab.example.com:group/project.git).
+		// A Windows drive-letter path (C:\...) carries a colon too, but it is a
+		// local filesystem path, not a remote URL, so it is excluded above.
+		path = raw[colon+1:]
+	}
+	path = strings.Trim(path, "/")
+	return strings.TrimSuffix(path, ".git")
+}
+
+// isWindowsDrivePath reports whether raw begins with a Windows drive specifier
+// like "C:\..." or "C:/...". Such a path's drive-letter colon must not be
+// mistaken for the host:path separator of scp-style SSH syntax, which would
+// otherwise turn a local filesystem path into a spurious "group/project".
+func isWindowsDrivePath(raw string) bool {
+	if len(raw) < 2 || raw[1] != ':' {
+		return false
+	}
+	c := raw[0]
+	if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')) {
+		return false
+	}
+	return len(raw) == 2 || raw[2] == '\\' || raw[2] == '/'
+}
+
+// pipelineJobsArgs returns the glab invocation that lists a pipeline's jobs.
+// With a known project path it uses `glab api` (branch-independent, works in a
+// detached-HEAD worktree); otherwise it falls back to `glab ci get`, which
+// needs a current branch.
+func (h *Host) pipelineJobsArgs(pipelineID int) []string {
+	if h.projectPath != "" {
+		// GitLab's REST API wants the project as a single URL-encoded
+		// "group%2Fproject" path parameter. Escape each segment defensively and
+		// rejoin with %2F so any reserved character in a segment is encoded too,
+		// not just the separating slashes.
+		segments := strings.Split(h.projectPath, "/")
+		for i, seg := range segments {
+			segments[i] = url.PathEscape(seg)
+		}
+		enc := strings.Join(segments, "%2F")
+		// --paginate walks every page; a pipeline with more jobs than fit on one
+		// page (GitLab defaults to 20 per page) would otherwise silently drop the
+		// jobs on later pages and the CI verdict could miss a failed job. glab
+		// writes one JSON array per page, so the parser handles concatenated docs.
+		return []string{"api", "--paginate", fmt.Sprintf("projects/%s/pipelines/%d/jobs", enc, pipelineID)}
+	}
+	return []string{"ci", "get", "--pipeline-id", fmt.Sprintf("%d", pipelineID), "--output", "json", "--with-job-details"}
 }
 
 func (h *Host) Provider() scm.Provider { return scm.ProviderGitLab }
@@ -37,7 +122,17 @@ func (h *Host) Available(ctx context.Context) error {
 	if h.cliAvailable != nil && !h.cliAvailable() {
 		return errors.New("glab CLI is not installed")
 	}
-	if err := h.cmd(ctx, "glab", "auth", "status").Run(); err != nil {
+	// Scope the auth check to this repo's host. Unscoped `glab auth status`
+	// checks every configured instance and exits non-zero if ANY of them has a
+	// stale/expired token, even when this repo's own host is fully
+	// authenticated. Passing --hostname keeps an unrelated bad credential from
+	// poisoning availability for this repo. When the host is unknown we fall
+	// back to the unscoped check (fail-safe: same behavior as before).
+	authArgs := []string{"auth", "status"}
+	if h.host != "" {
+		authArgs = append(authArgs, "--hostname", h.host)
+	}
+	if err := h.cmd(ctx, "glab", authArgs...).Run(); err != nil {
 		return errors.New("glab CLI is not authenticated")
 	}
 	return nil
@@ -70,7 +165,11 @@ func (h *Host) FindPR(ctx context.Context, branch, base string) (*scm.PR, error)
 	if strings.TrimSpace(base) != "" {
 		args = append(args, "--target-branch", base)
 	}
-	args = append(args, "--state", "opened", "--output", "json")
+	// `glab mr list` returns open MRs by default. Older glab accepted
+	// `--state opened`, but glab v1.5x removed it (it now exposes
+	// -c/--closed, -M/--merged, -A/--all); passing the unknown flag fails the
+	// whole command. Rely on the open-by-default behavior.
+	args = append(args, "--output", "json")
 	cmd := h.cmd(ctx, "glab", args...)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -238,10 +337,10 @@ func (h *Host) getChecksFallback(ctx context.Context, pr *scm.PR) ([]scm.Check,
 	if payload.HeadPipeline.ID == 0 {
 		return nil, nil
 	}
-	jobsCmd := h.cmd(ctx, "glab", "ci", "get", "--pipeline-id", fmt.Sprintf("%d", payload.HeadPipeline.ID), "--output", "json", "--with-job-details")
+	jobsCmd := h.cmd(ctx, "glab", h.pipelineJobsArgs(payload.HeadPipeline.ID)...)
 	jobsOut, err := jobsCmd.CombinedOutput()
 	if err != nil {
-		return nil, fmt.Errorf("glab ci get: %s: %w", strings.TrimSpace(string(jobsOut)), err)
+		return nil, fmt.Errorf("glab pipeline jobs: %s: %w", strings.TrimSpace(string(jobsOut)), err)
 	}
 	return parseGitlabJobs(jobsOut)
 }
@@ -264,7 +363,7 @@ func (h *Host) FetchFailedCheckLogs(ctx context.Context, pr *scm.PR, _ string, _
 	if trimmed := bytesTrimToJSON(viewOut); len(trimmed) == 0 || json.Unmarshal(trimmed, &payload) != nil || payload.HeadPipeline.ID == 0 {
 		return "", nil
 	}
-	jobsCmd := h.cmd(ctx, "glab", "ci", "get", "--pipeline-id", fmt.Sprintf("%d", payload.HeadPipeline.ID), "--output", "json", "--with-job-details")
+	jobsCmd := h.cmd(ctx, "glab", h.pipelineJobsArgs(payload.HeadPipeline.ID)...)
 	jobsOut, err := jobsCmd.CombinedOutput()
 	if err != nil {
 		return "", nil
@@ -306,63 +405,102 @@ func bytesTrimToJSON(out []byte) []byte {
 }
 
 type gitlabJob struct {
-	ID     int    `json:"id"`
-	Name   string `json:"name"`
-	Status string `json:"status"`
-	Stage  string `json:"stage"`
+	ID         int    `json:"id"`
+	Name       string `json:"name"`
+	Status     string `json:"status"`
+	Stage      string `json:"stage"`
+	FinishedAt string `json:"finished_at"`
 }
 
-func parseGitlabJobs(out []byte) ([]scm.Check, error) {
+// completedAt parses the job's finished_at timestamp, returning the zero time
+// when it is absent or unparseable. GitLab emits RFC3339 (often with
+// fractional seconds and a 'Z' offset), which time.RFC3339 handles.
+func (j gitlabJob) completedAt() time.Time {
+	if strings.TrimSpace(j.FinishedAt) == "" {
+		return time.Time{}
+	}
+	if parsed, err := time.Parse(time.RFC3339, j.FinishedAt); err == nil {
+		return parsed
+	}
+	return time.Time{}
+}
+
+// decodeGitlabJobs reads every job from glab output. The output may contain a
+// single bare job array, a pipeline object with nested .jobs, or - when
+// `glab api --paginate` walks multiple pages - several JSON documents
+// concatenated back to back (one array per page). A streaming decoder reads
+// each top-level value in turn and accumulates the jobs across all of them.
+// It returns whatever was parsed plus a non-nil error when a document was
+// malformed: io.EOF terminates the stream cleanly, but any other decode error
+// means a corrupt page, which the caller can surface instead of mistaking it
+// for an empty result.
+func decodeGitlabJobs(out []byte) ([]gitlabJob, error) {
 	trimmed := bytesTrimToJSON(out)
 	if len(trimmed) == 0 {
 		return nil, nil
 	}
-	// glab may return a single pipeline object with nested jobs, or a bare job array.
-	var asArray []gitlabJob
-	if err := json.Unmarshal(trimmed, &asArray); err == nil && len(asArray) > 0 {
-		return jobsToChecks(asArray), nil
-	}
-	var asObject struct {
-		Jobs []gitlabJob `json:"jobs"`
-	}
-	if err := json.Unmarshal(trimmed, &asObject); err == nil && len(asObject.Jobs) > 0 {
-		return jobsToChecks(asObject.Jobs), nil
+	dec := json.NewDecoder(bytes.NewReader(trimmed))
+	var jobs []gitlabJob
+	for {
+		var raw json.RawMessage
+		err := dec.Decode(&raw)
+		if errors.Is(err, io.EOF) {
+			return jobs, nil
+		}
+		if err != nil {
+			// Malformed mid-stream document: stop, but keep what parsed so far
+			// and report the error rather than silently swallowing the page.
+			return jobs, fmt.Errorf("decode gitlab jobs: %w", err)
+		}
+		var asArray []gitlabJob
+		if err := json.Unmarshal(raw, &asArray); err == nil && len(asArray) > 0 {
+			jobs = append(jobs, asArray...)
+			continue
+		}
+		var asObject struct {
+			Jobs []gitlabJob `json:"jobs"`
+		}
+		if err := json.Unmarshal(raw, &asObject); err == nil && len(asObject.Jobs) > 0 {
+			jobs = append(jobs, asObject.Jobs...)
+		}
 	}
-	return nil, nil
+}
+
+func parseGitlabJobs(out []byte) ([]scm.Check, error) {
+	jobs, err := decodeGitlabJobs(out)
+	if len(jobs) == 0 {
+		return nil, err
+	}
+	// Surface any decode error even when some jobs parsed. A corrupt later page
+	// of paginated `glab api` output must not let a partial slice look
+	// authoritative: a failed job on the dropped page would otherwise be hidden
+	// and the CI verdict would read green.
+	return jobsToChecks(jobs), err
 }
 
 func jobsToChecks(jobs []gitlabJob) []scm.Check {
 	checks := make([]scm.Check, 0, len(jobs))
 	for _, job := range jobs {
-		checks = append(checks, scm.Check{Name: job.Name, Bucket: gitlabStatusBucket(job.Status)})
+		checks = append(checks, scm.Check{
+			Name:        job.Name,
+			Bucket:      gitlabStatusBucket(job.Status),
+			CompletedAt: job.completedAt(),
+		})
 	}
 	return checks
 }
 
 func findFailedJobID(out []byte, failingNames []string) int {
-	trimmed := bytesTrimToJSON(out)
-	if len(trimmed) == 0 {
-		return 0
-	}
 	targets := map[string]struct{}{}
 	for _, name := range failingNames {
 		name = strings.TrimSpace(name)
 		if name != "" {
 			targets[name] = struct{}{}
 		}
 	}
-	var asArray []gitlabJob
-	jobs := asArray
-	if err := json.Unmarshal(trimmed, &asArray); err == nil && len(asArray) > 0 {
-		jobs = asArray
-	} else {
-		var asObject struct {
-			Jobs []gitlabJob `json:"jobs"`
-		}
-		if err := json.Unmarshal(trimmed, &asObject); err == nil {
-			jobs = asObject.Jobs
-		}
-	}
+	// Best effort: scan whatever jobs parsed; a corrupt later page does not
+	// prevent locating a failed job that already decoded.
+	jobs, _ := decodeGitlabJobs(out)
 	for _, job := range jobs {
 		if !strings.EqualFold(job.Status, "failed") {
 			continue