GitLab integration: remaining gaps for production readiness

[ColeMurray]

Summary

The GitLab integration backend is substantially complete, but several gaps remain before it's production-ready. The primary blocker is web authentication — there's no GitLab OAuth flow, so users can't log in to a GitLab-configured deployment.

What's Done

• Provider abstraction — SourceControlProvider interface, factory, config resolver all support GitLab
• GitLab provider (gitlab-provider.ts) — fully implemented with PAT auth: repos, branches, merge requests, push auth, clone URLs
• Tests — comprehensive test coverage for all provider methods + state mapping
• Modal data plane — clone token routing and VCS env var injection handle SCM_PROVIDER=gitlab
• Sandbox runtime — uses generic VCS_HOST/VCS_CLONE_USERNAME/VCS_CLONE_TOKEN, works for GitLab automatically
• Web URL utilities — getScmRepoUrl/getScmBranchUrl are provider-aware
• Documentation — ADR, provider checklist, env var docs all in place
• Route wiring — GITLAB_ACCESS_TOKEN and GITLAB_NAMESPACE read from env and passed to provider

Remaining Gaps

Blocking

• No GitLab OAuth login — packages/web/src/lib/auth.ts is hardcoded to GitHubProvider from next-auth. Need to add a GitLab OAuth provider and make the login flow provider-aware.
• "Sign in with GitHub" UI — packages/web/src/components/sidebar-layout.tsx has signIn("github") hardcoded. Login button text and provider must be dynamic based on NEXT_PUBLIC_SCM_PROVIDER.

Cosmetic / Minor

• "View in GitHub" label — packages/web/src/components/action-bar.tsx still shows GitHub-specific text in the PR dropdown.
• Avatar URLs — packages/control-plane/src/session/participant-service.ts getAvatarUrl() returns undefined for GitLab users (only generates GitHub avatar URLs).
• JWT field naming — auth.ts uses githubUserId/githubLogin field names in the JWT, which is misleading for GitLab deployments.

Feature Gaps

• Reviewer assignment — gitlab-provider.ts logs a console.warn because GitLab requires numeric reviewer_ids (username→ID resolution not implemented).
• Self-hosted GitLab — GITLAB_API_BASE is hardcoded to https://gitlab.com/api/v4. No support for self-hosted instances.

Operational Gaps

• Terraform variables — No GITLAB_ACCESS_TOKEN, GITLAB_NAMESPACE, or SCM_PROVIDER variables in terraform/environments/production/. Must be set manually in Modal secrets.
• Modal still requires GitHub App secrets — packages/modal-infra/src/app.py has github_app_secrets as a required Modal secret even for GitLab-only deployments. GitLab deployments need dummy GitHub App secrets to pass validation.

Suggested Priority

1. GitLab OAuth login + provider-aware sign-in UI (unblocks GitLab deployments)
2. Cosmetic fixes ("View in GitHub", avatars, JWT field names)
3. Terraform variable support
4. Decouple Modal from GitHub App secrets requirement
5. Self-hosted GitLab + reviewer assignment (future enhancements)

[ColeMurray]

@duboff few remaining pieces to get this operational