id: gitlab-cli
name: gitlab
category: feature
displayName: GitLab CLI
description: 'The official GitLab CLI (`glab`) for merge requests, issues, CI/CD pipelines and releases. Targets gitlab.com or a self-managed host. Login persists across container rebuilds.'
documentationURL: https://gitlab.com/gitlab-org/cli
options:
  version:
    type: string
    default: latest
    description: 'glab release to install: `latest` (resolved from the GitLab release API at build) or a pinned version like `1.102.0`.'
    surface: silent
  apiToken:
    type: string
    default: ''
    description: 'GitLab personal access token (scopes: `api`, `write_repository`); exported as GITLAB_TOKEN. Empty for `glab auth login` on first run.'
    surface: env
  host:
    type: string
    default: ''
    description: 'Self-managed/Dedicated GitLab host (e.g. `gitlab.example.com`); empty targets gitlab.com. Exported as GITLAB_HOST, so every `glab` command uses it without `--hostname`.'
    surface: yml
feature:
  version: 1.0.1
  persistentHomePaths: [.config/glab-cli]
  vscodeExtensions: [GitLab.gitlab-workflow]
  # glab reads GITLAB_TOKEN / GITLAB_HOST from the environment. Handing
  # them to the workspace runtime env (compose `environment:` / image-mode
  # `containerEnv`) makes them visible to every process regardless of shell
  # type — including a plain (non-login) SSH session, which never sources
  # /etc/profile.d. Without GITLAB_HOST in the process env a non-login shell
  # would silently fall back to gitlab.com even against a self-managed host.
  # install.sh still writes the profile.d snippet as a fallback for CLIs
  # that predate this block; both carry the same values, so the redundancy
  # is harmless. Empty values drop their var (→ `glab auth login`).
  workspaceEnv:
    - vars:
        GITLAB_TOKEN: '${apiToken}'
        GITLAB_HOST: '${host}'
briefing:
  - text: 'GitLab CLI (`glab`) — merge requests, issues, CI/CD pipelines and releases. Targets the configured GitLab host (gitlab.com unless `host` was set). Pre-authenticated when a token was set; `glab auth status` shows the active account.'