[HaoQianCheng]

What changed

Self-managed GitLab repositories could not use the GitHub-only credential and repository setup. This adds a separate GitLab instance URL/PAT, identity verification, instance-bound repository parsing, and host-scoped Git authentication across local execution and runners. GitHub credentials remain separate.

Repository inputs now explicitly advertise GitHub / GitLab and accept configured GitLab URLs without a separate platform selector.

The GitLab adapter also supports MR lookup, delivery-state refresh, and the existing scheduled create/merge path, with source-SHA checks before merging.

This is an initial integration, submitted as a draft. GitLab Issue import, promotion/default-branch reconciliation, and automatic MR creation in ordinary SOPs are not included. No live repository writes or complete agent-delivery run were performed.

Scope

• Platform core / API / runner
• Public adapter / deployment
• Classic
• Portable
• Shared behavior contract
• Installer / CLI
• Documentation only

Compatibility

• Adds nullable gitlab_token and gitlab_base_url columns through the existing incremental GORM schema setup.
• GitLab tasks require runner 0.8.0+; older runners are rejected before receiving the new credential binding.
• Repository links must match the configured GitLab instance. Token verification checks identity only, not repository permissions.
• Deployment and API documentation describe the credential and runner changes.

Validation

• go test -p=2 ./... -count=1 -timeout=180s: all changed packages passed. The unchanged internal/managedcli/TestUpdateFailuresAndCandidateReuse/help failed its healthy-provider assertion under a 200 ms deadline; an isolated rerun reproduced it.
• go vet ./...: passed.
• python3 scripts/check-public.py: passed.
• bash scripts/scan-secrets.sh: passed.
• Public Playwright suite against an isolated MySQL-backed instance using installed Chrome: 21 passed, 1 failed, 6 skipped. The remaining mobile-English-dark welcome assertion measured 844.4375 px in an 844 px viewport.
• Added GitLab browser regressions passed: independent credential storage, redacted responses, reload behavior, localized settings, identity-only verification messaging, and recognizing/saving a GitLab URL from the project repository input.
• Read-only live identity, Git branch-listing and MR-listing checks passed during local integration. No push, MR creation or merge was tested against a live repository.
• Docker/container and paid-model acceptance were not run. Local editions are unchanged.

Safety

• I did not include credentials, internal endpoints, production data, or organization-specific infrastructure.
• I preserved user files and unrelated changes.
• I updated generated Classic host bundles when applicable. (Not applicable.)
• I documented third-party content and licensing changes when applicable. (No new dependency.)