You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(clients): default GitLab clones to HTTPS - #24612
GitLab repositories selected through Add Project → Clone now start with the host’s HTTPS/web URL. Explicit SSH URLs remain available through Git URL; other forge defaults are unchanged. Updated servers already recover some SSH failures through HTTPS fallback; this skips that first SSH attempt and supports older servers without the fallback. SSH-only private repositories require the explicit SSH path. Self-hosted HTTP URLs remain HTTP.
Choosing a GitLab repository through Add Project → Clone used SSH even after signing in with glab over HTTPS. Without a registered SSH key, lookup succeeded but cloning failed.
GitLab's host definition now defaults to HTTPS, using the same shared clone-selection path as other HTTPS hosts. Web, desktop, and mobile inherit that choice; pasted URLs and other providers keep their existing behavior. Self-hosted GitLab still needs credentials configured for its host.
The existing shared regression test uses GitLab's actual web-URL shape. It fails with the SSH default and passes with the fix; all 18 project-operation tests pass. Client-runtime and GitLab package typechecks and targeted lint also pass. Private-repository credential-helper authentication was not exercised; this change only selects the clone URL.
Original fix and reproduction by @Mnigos in #13351. Maintainer takeover by Claude Opus 5.5 and Claude Fable 5.1 through T3 Code, independently reviewed by Claude Opus 5.5 and GPT-6.1-Sol through the Codex harness.
Takeover
Original fix and reproduction by @Mnigos in #13351. Rebuilt on current main because the forge definition moved to shared/; the one-field implementation is retained, and the tests use current shared clone selection.
No GitLab special cases were added outside the forge package. No scratch scripts or captures are committed. Pixel-diff amplification driver is uploaded separately.
Real GitLab picker: before SSH rejection → HTTPS fallback success; after direct HTTPS success
C1
Real GitHub picker: HTTPS success on both
C2
Explicit GitLab SSH submitted unchanged on both; real SSH rejection/fallback, after DNS failure and recorded Retry success
P1
Tracked clone exercised, including Retry
G3/G4/C3/C4/S2
Helper fixtures, focused tests and source; nested/custom-host URLs and exact HTTP scheme disclosed
P2/E1/S1
Older-server path, additional entry/gate paths and direct-service protocols source-only
M1/M2
Native iOS and Android unverified
Recordings: enter repository → lookup → choose destination → clone → terminal outcome. Timestamped steps and actual submitted URLs are narrated in the linked clips; complete timeline. GitLab’s official SSH endpoint on port 443 was used because port 22 hangs on this VM.
Environment: real web app, Chromium 148 / Playwright 1.60, Xvfb, 1280×900, DPR 1, dark, reduced motion, fixed relative-time clock, DejaVu Sans fallback. Fresh sandbox home, seeding disabled; live userdata untouched.
What else changed in the captures: original GitLab interaction clips ended with stale Git metadata; the separate settled clips and primary images supersede those endpoints. Corrected GitLab and GitHub frames are pixel-identical. C2 input has a faint blurred background label difference (1,427 pixels, max channel delta 9/255); its after outcome shows a real DNS failure, retained with separate successful Retry. No private-authentication or successful SSH-authentication claim is made.
Tests: project-operation file 6 → 7; GitLab regression fails with SSH and passes with HTTPS. 48 focused tests across projects, forge definition and registry passed. Targeted lint/format, GitLab and client-runtime typechecks passed.
Reviews: round 1 MERGE / FIX_FIRST; SSH-only picker objection resolved against the authorized HTTPS default and explicit SSH path. Round 2 MERGE / MERGE. No added regex/parser or dependencies.
Proof audit: SUFFICIENT; inspected all primary images, 27 diffs and 15 recordings. Independent real HTTPS clone succeeded; reproduced input delta 681 pixels, max 2/255, none above 16.
Final head / main integration: e8f29cc13c merges 843f4e3529 without rebasing. All 48 scoped tests pass on this head. The captured web, shared clone runtime, GitLab package and mobile project-flow blobs are unchanged from captured after revision; main additions are outside those paths.
CI: At handoff, 8 checks successful, 19 pending, 0 failing on final head; no bot comments yet. CI/review monitoring returns to the dispatcher because this is a delegated child task. Original-fork checks are not claimed for this replacement.
Unverified: native iOS/Android, separate Electron shell, light/narrow viewports, private-repository authentication, authenticated SSH, older-server blocking clone, direct service/MCP protocols, relay/tunnel and multiple environments. Only the web capture and source/shared tests are claimed.
All owned capture/audit processes stopped; temporary worktree and scratch removed before handoff.
Implementation/tests: Claude Opus 5.5 through T3 Code; independent review: GPT-6.1-Sol (Codex) and Claude Opus 5.5; capture/proof audit: GPT-6.1-Sol through Codex.
Macroscope's review found this PR approvable — The specified revisions have no net changes. GitLab cloning still defaults to SSH, so this comparison introduces no product-default change or additional risk.
Notes:
No code objects were reviewed. Approvability was decided on eligibility alone.
You can add or adjust custom eligibility rules. Learn more.
GitLab’s default clone transport changes from SSH to HTTPS. A test checks that getDefaultCloneUrl returns the GitLab HTTPS URL when an SSH URL is also supplied.
Changes: Clone transport selection
Layer / File(s)
Summary
GitLab default and URL selection tests packages/source-control-gitlab/src/shared/definition.ts, packages/client-runtime/src/operations/projects.test.ts
GitLab’s default clone transport changes to HTTPS. A test checks that GitLab URL selection returns HTTPS when an SSH URL is also supplied.
GitLab clones through Add Project → Clone now default to the project's web URL over HTTPS. This is the intended behavior and should work on standard GitLab hosts. There is a small residual risk on instances that expose a separate HTTP clone endpoint, so the author should confirm the behavior on one such instance.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title names the main change: GitLab clones made through Add Project → Clone now default to HTTPS. It uses a conventional commit prefix and is specific to the changeset. The title is short, single-…
Description check
The description follows the repository template. It has a clear problem statement, a change explanation, a scope section that links issue #13350 and states the bug, and a verification section with tes…
Linked Issues check
The only direct linked issue is #13350. Its coding requirement is that GitLab clones selected through Add Project → Clone use HTTPS, so the glab credential helper can authenticate without an SSH key. …
Out of Scope Changes check
The whole-PR diff touches two files. definition.ts changes one GitLab field and adds a comment explaining the HTTPS credential-helper rationale. projects.test.ts adds one GitLab regression asserti…
Full details: Title check
Explanation
The title names the main change: GitLab clones made through Add Project → Clone now default to HTTPS. It uses a conventional commit prefix and is specific to the changeset. The title is short, single-sentence, and not vague.
Full details: Description check
Explanation
The description follows the repository template. It has a clear problem statement, a change explanation, a scope section that links issue #13350 and states the bug, and a verification section with tests, typechecks, lint, and recordings. The template's Problem section is only implied by the opening paragraph and the original description, and the Scope section does not explicitly justify the absence of an issue, but the issue is linked. The description is mostly complete and is lengthy, with heavy media content and an unusually large evidence section. The template asks for concise verification and the description spends most of its length on evidence links and image tables, but the required information is present.
Full details: Linked Issues check
Explanation
The only direct linked issue is #13350. Its coding requirement is that GitLab clones selected through Add Project → Clone use HTTPS, so the glab credential helper can authenticate without an SSH key. The whole-PR diff (base to head) changes defaultCloneTransport in packages/source-control-gitlab/src/shared/definition.ts from "ssh" to "https". The shared getDefaultCloneUrl in packages/client-runtime/src/operations/projects.ts then selects repository.url for GitLab. The added assertion in projects.test.ts checks that a GitLab provider with url: "https://gitlab.com/group/subgroup/project" and an SSH URL returns the HTTPS URL. This covers the issue's suggested minimum fix (include GitLab in the HTTPS default). The issue's optional git_protocol discovery is not implemented, and the issue does not require it as a minimum. Private-repository authentication is not tested, which the issue does not require as a coding test. The apps/mobile impact is covered by the shared clone-selection path, which the PR does not modify separately.
Full details: Out of Scope Changes check
Explanation
The whole-PR diff touches two files. definition.ts changes one GitLab field and adds a comment explaining the HTTPS credential-helper rationale. projects.test.ts adds one GitLab regression assertion to the existing shared clone-selection test. Both changes implement #13350. No unrelated source, configuration, or dependency changes appear in the diff. The PR description's claims about self-hosted HTTP URLs and explicit SSH entry through Git URL concern existing behavior that the diff does not alter.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Clients send GitLab's SSH URL without a protocol, so a refused key or an
unverified host key is already retried over HTTPS with the glab credential
helper. Defaulting to HTTPS gives no SSH retry, so it breaks GitLab users who
only have SSH access.
AI-assisted; verified with the tests and tools listed above.
46-46: Major · Data Integrity & Integration · Heavy lift
Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.
Use GitLab’s HTTP clone URL
This change selects repository.url, but GitLabCli.ts maps that field from web_url and discards http_url_to_repo. GitLab supports a separate HTTP(S) clone endpoint. If only that endpoint accepts Git traffic, provider-selected clones now fail. Preserve the clone URL through the repository contract and select it here. (raw.githubusercontent.com)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.
The automated pipeline stopped on this pull request and will not merge it:
in the real app the problem is still there, and the rework changed nothing:
No code change: the proof result shows the reported bug is already fixed. On both commits, with glab set up for HTTPS and no SSH key (the setup in issue #13350), the GitLab picker sent the SSH URL and the clone finished with an HTTPS origin. The issue was that the clone failed; it now succeeds because main's clone fallback (#30142) retries a refused SSH key or untrusted host key over HTTPS with the glab credential helper. The proof treats the SSH-first request as the problem, but HTTPS-first is exactly what the previous review rejected as worse than main: clones run with terminal prompts off and nothing retries HTTPS as SSH, so users with only SSH access would break. Keeping SSH first is deliberate. The pasted git@ URL staying unchanged is the intended behavior on both commits and was never in scope. The branch has no net diff against main and should be closed as superseded, with #13350 marked fixed by #30142. Making GitLab HTTPS-first anyway would need an HTTPS-to-SSH retry in the same change, and that is a maintainer decision.
It stays open for a person to finish or close.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bugfixFix PR opened by an issue lead; enters the PR looppr:needs-juliusNeeds Julius: route gate, unverifiable surface, or blockedsize:XS0-9 changed lines (additions + deletions).vouch:trustedAuthor is trusted by repo permissions or the VOUCHED list.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
the
vouch:trusted
juliusmarminge
added
bugfix
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
GitLab repositories selected through Add Project → Clone now start with the host’s HTTPS/web URL. Explicit SSH URLs remain available through Git URL; other forge defaults are unchanged. Updated servers already recover some SSH failures through HTTPS fallback; this skips that first SSH attempt and supports older servers without the fallback. SSH-only private repositories require the explicit SSH path. Self-hosted HTTP URLs remain HTTP.
Fixes #13350.
Original description by @Mnigos
Fixes #13350.
Choosing a GitLab repository through Add Project → Clone used SSH even after signing in with
glabover HTTPS. Without a registered SSH key, lookup succeeded but cloning failed.GitLab's host definition now defaults to HTTPS, using the same shared clone-selection path as other HTTPS hosts. Web, desktop, and mobile inherit that choice; pasted URLs and other providers keep their existing behavior. Self-hosted GitLab still needs credentials configured for its host.
The existing shared regression test uses GitLab's actual web-URL shape. It fails with the SSH default and passes with the fix; all 18 project-operation tests pass. Client-runtime and GitLab package typechecks and targeted lint also pass. Private-repository credential-helper authentication was not exercised; this change only selects the clone URL.
Original fix and reproduction by @Mnigos in #13351. Maintainer takeover by Claude Opus 5.5 and Claude Fable 5.1 through T3 Code, independently reviewed by Claude Opus 5.5 and GPT-6.1-Sol through the Codex harness.
Takeover
Original fix and reproduction by @Mnigos in #13351. Rebuilt on current main because the forge definition moved to
shared/; the one-field implementation is retained, and the tests use current shared clone selection.No GitLab special cases were added outside the forge package. No scratch scripts or captures are committed. Pixel-diff amplification driver is uploaded separately.
Evidence
Full fixture matrix · capture index, traces and all drivers · reproduction recipe · proof audit
Recordings: enter repository → lookup → choose destination → clone → terminal outcome. Timestamped steps and actual submitted URLs are narrated in the linked clips; complete timeline. GitLab’s official SSH endpoint on port 443 was used because port 22 hangs on this VM.
Environment: real web app, Chromium 148 / Playwright 1.60, Xvfb, 1280×900, DPR 1, dark, reduced motion, fixed relative-time clock, DejaVu Sans fallback. Fresh sandbox home, seeding disabled; live userdata untouched.
What else changed in the captures: original GitLab interaction clips ended with stale Git metadata; the separate settled clips and primary images supersede those endpoints. Corrected GitLab and GitHub frames are pixel-identical. C2 input has a faint blurred background label difference (1,427 pixels, max channel delta 9/255); its after outcome shows a real DNS failure, retained with separate successful Retry. No private-authentication or successful SSH-authentication claim is made.
Verification log
Fixes #13350