feat: CI execution scoring and self-hosted GitLab token fixes

[craigkilpatrick]

Summary

• CI execution verification: The CI scanner now checks that configured CI patterns (SAST, secret detection, etc.) are actually executing in pipelines, not just defined in .gitlab-ci.yml. Scoring reflects whether patterns are configured-only vs. actively running.
• Self-hosted GitLab token validation: Fixes 404 errors when validating tokens against self-hosted GitLab instances that don't expose /api/v4/user. Falls back to /version endpoint.

Test plan

• New test_ci_execution.py with 259 lines covering execution scoring logic
• New test_validate_token.py covering /user 404 fallback to /version
• Updated test_cli.py for validation flow changes
• Manual test against self-hosted GitLab instance with restricted API

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Improved GitLab API token validation with fallback mechanism for enhanced reliability
  • Enhanced error messages to distinguish between authentication failures and API unreachability issues

• Tests

  • Added comprehensive test coverage for token validation scenarios

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: f0fe82f6-4884-46d1-9315-0f0cf9457a72

📥 Commits

Reviewing files that changed from the base of the PR and between 192af6d and bb4cb91.

📒 Files selected for processing (3)

• src/ai_fluency_collector/gitlab_client.py
• tests/test_cli.py
• tests/test_validate_token.py

---

📝 Walkthrough

Walkthrough

The GitLab token validation method now implements a fallback strategy: it first attempts authentication via the /user endpoint, and if that returns 404, it retries with the /version endpoint before raising an error. Comprehensive test coverage is added for this new fallback behavior and various error scenarios.

Changes

Cohort / File(s)	Summary
Token Validation Logic src/ai_fluency_collector/gitlab_client.py	Modified validate_token() to implement endpoint fallback: attempts /user first, falls back to /version on 404, and distinguishes between unreachable API (all 404s) and authentication failures (401s).
Test Coverage tests/test_validate_token.py	New test module with 5 test cases covering token validation scenarios: successful /user validation, fallback to /version after 404, both endpoints returning 404, immediate 401 rejection, and /user 404 followed by /version 401.
CLI Error Handling tests/test_cli.py	Added test case for CLI handling of "not reachable" GitLab API error message, distinct from existing authentication failure test.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Hoppy hops through endpoints with glee,
First /user, then /version to see,
If one path fails, another's in store,
Fallback logic—what tests are for!
GitLab's reachability, now crystal and clear, ✨

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}