fix(gitlab): merge request details report their head commit

[ScottN-PV]

Problem

Generating a review guide for any GitLab merge request fails with "This host did not report the pull request's head commit." The guide service reads the head commit from the pull request detail, and the GitLab detail decoder (gitLabMergeRequestJson.ts) dropped the merge request's sha.

Change

The raw merge request schema now reads GitLab's top-level sha, the source branch's head commit, and toDetail passes it on as headSha. When GitLab sends none, headSha is left out. GitLabPullRequestProvider.getChangeRequest already spreads the decoded detail, so the provider needs no change. This is the GitLab counterpart of the Forgejo fix in #18463 and the Bitbucket fix in #18402.

The fix reads sha rather than diff_refs.head_sha because GitLab fills in diff_refs only after it computes the diff, so it can be null on a new merge request. The list mapper is unchanged.

The pull request watch also reads the detail's headSha, so it can now tell when a watched GitLab merge request's head moves, as it already does for GitHub and Forgejo.

Scope and approval

Fixes the bug confirmed in the maintainer triage: #18592 (comment)

Closes #18592

Verification

Agent-run on Linux. No person tested this.

Live run in headless Chromium (1280×800 viewport, shots cropped) against a Linux dev server signed in to gitlab.com with a read-only token, on two open gitlab-org/cli merge requests. Nothing was written to GitLab.

	Main	This branch
!4064
!4089 (fork)

On main, Write guide shows "Could not start a review guide / This host did not report the pull request's head commit." and no run starts. On this branch the guide is written, and the head commit it stores matches GitLab's sha for each merge request (772a4f2 and afce4da). !4089's source branch is in a fork, and the guide still checked out its head. Its shot is from Rewrite guide, because a guide already existed there. The guides shown were written by Claude Sonnet 5.5.

Main, !4064:

18592-main-4064-toast.mp4

This branch, !4064:

18592-fix-4064-guide.mp4

• vp test run in packages/source-control-gitlab: 136 passed. The new case ("reads the head commit, and says nothing where GitLab omitted it") fails on main, where headSha is undefined.
• vp lint and vp fmt --check on the two changed files, and the source-control-gitlab and server typechecks, pass.

Model: Claude Opus 5.5 (implementation and review), GPT-6-Astra (review). Harness: Claude Code, Codex.

[macroscopeapp]

Approvability

Verdict: Approved at 328e80c

Macroscope's review found this PR approvable — This is a narrowly scoped GitLab decoder bug fix that propagates the existing merge request head SHA into already-implemented review-guide and watch behavior, with regression tests for missing and partial API responses. It does not change defaults, schemas, deployment configuration, or static-analysis settings.

Notes:

• Diff unchanged. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 328e80c

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: bf2cbad5-0728-4811-8717-90e6c64ba7c5

---

📥 Commits

Reviewing files that changed from the base of the PR and between 58d2532 and 328e80c.

---

📒 Files selected for processing (2)

• packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
• packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The GitLab merge-request detail decoder now reads the source head commit from optional sha, trims it, and omits headSha when empty. Tests cover valid SHA values and absent, null, or whitespace-only values, including cases with null diff_refs and zero merge_commit_sha.

Changes

GitLab head SHA

Layer / File(s)	Summary
Decode and expose the head SHA packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts, packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts	The raw merge-request schema accepts an optional nullable sha. The detail decoder sets headSha to the trimmed value when it is non-empty. Tests cover valid and omitted values.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

---

Merge Risk | ⚪ Minimal · up to 328e8

Merge Risk: ⚪ Minimal · up to 328e8

GitLab review-guide generation and pull-request watching receive the head SHA when GitLab provides it. No actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 328e8

The change preserves repository checks and safeguards against concurrent or outdated review runs. No security regression was established, but the permissions used during guide generation and unusual missing-commit transitions were not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The traced effects concern explicitly requested guides for the project's repository and existing watches on linked pull requests. Guides now send GitLab change context to the configured generation provider. The provider's complete sandbox and credential exposure remain unverified.

Trust Boundaries and Controls

• observed — Guide generation requires matching host and repository identity. Commit fetching uses the project's primary remote and argument arrays rather than shell text. The newly accepted sha is trimmed but has no explicit hexadecimal validation at the decoder or inspected checkout boundary.

Resilience and Maintainability Implications

• observed — Watch synchronization matches pull-request identity and watch start time, rejecting updates from stopped or replaced watches and wakes for inactive threads. Read failures are bounded, while closed or merged pull requests terminate their watches.

Hardening Proposals

• proposed — Consider validating host-reported commit identifiers at the shared checkout boundary before passing them to Git. This would make reliance on trusted host SHA syntax explicit; it is not an observed exploit through ordinary merge-request content.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: GitLab merge request details now report the head commit.
Description check		The description includes all required sections. It explains the problem, implementation, scope approval, issue link, focused verification, observed results, limitations, and the agent model and harnes…
Linked Issues check		Issue #18592 requires GitLab merge-request guide generation to receive the source branch head commit. The decoder now accepts GitLab's top-level sha, trims it, and maps it to optional headSha. It …
Out of Scope Changes check		The changes are limited to GitLab merge-request detail decoding and focused automated tests. The schema field, headSha mapping, and tests directly support issue #18592. No unrelated product behavior…

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}