Gitlab add groups support (#1041)

* add groups secret for gitlab

Signed-off-by: Alexander Kulikov <askripe@gmail.com>

* Update GitLab secrets section in README

Clarified GitLab secrets section with examples for project and group variables.

Signed-off-by: Alexander Kulikov <askripe@gmail.com>

* Update pkg/providers/gitlab/gitlab.go

Signed-off-by: Alexander Kulikov <askripe@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Signed-off-by: Alexander Kulikov <askripe@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: askripe

README.md

@@ -864,12 +864,26 @@ Examples:
 
 For this provider to work you require an [access token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html) exported as the environment variable `GITLAB_TOKEN`.
 
+- `ref+gitlab://my-gitlab-server.com/[projects/|groups/]id/secret_name?[ssl_verify=false&scheme=https&api_version=v4]`
 
-- `ref+gitlab://my-gitlab-server.com/project_id/secret_name?[ssl_verify=false&scheme=https&api_version=v4]`
+* `Project variables`
+
+Fetches a CI/CD variable `password` from a `project`. Both forms are equivalent:
+
+- `ref+gitlab://gitlab.com/11111/password`
+- `ref+gitlab://gitlab.com/projects/11111/password`
+
+* `Group variables`
+
+Fetches a CI/CD variable `password` from a `group`:
+
+- `ref+gitlab://gitlab.com/groups/2222/password`
 
 Examples:
 
 - `ref+gitlab://gitlab.com/11111/password`
+- `ref+gitlab://gitlab.com/projects/11111/password`
+- `ref+gitlab://gitlab.com/groups/2222/password`
 - `ref+gitlab://my-gitlab.org/11111/password?ssl_verify=true&scheme=https`
 
 ### 1Password

pkg/providers/gitlab/gitlab.go

@@ -51,20 +51,51 @@ func New(cfg api.StaticConfig) *provider {
 	return p
 }
 
+// buildURL constructs the GitLab API URL based on the key path.
+//
+// Supported formats:
+//   - host/id/varname           → projects (legacy, 2-component path after host)
+//   - host/projects/id/varname  → projects (explicit)
+//   - host/groups/id/varname    → groups
+func (p *provider) buildURL(key string) (string, error) {
+	splits := strings.SplitN(key, "/", 4)
+
+	switch len(splits) {
+	case 3:
+		// legacy: host/project_id/varname → treated as projects
+		host, id, varName := splits[0], splits[1], splits[2]
+		return fmt.Sprintf("%s://%s/api/%s/projects/%s/variables/%s",
+			p.Scheme, host, p.APIVersion, id, varName), nil
+
+	case 4:
+		host, kind, id, varName := splits[0], splits[1], splits[2], splits[3]
+		switch kind {
+		case "projects":
+			return fmt.Sprintf("%s://%s/api/%s/projects/%s/variables/%s",
+				p.Scheme, host, p.APIVersion, id, varName), nil
+		case "groups":
+			return fmt.Sprintf("%s://%s/api/%s/groups/%s/variables/%s",
+				p.Scheme, host, p.APIVersion, id, varName), nil
+		default:
+			return "", fmt.Errorf("unsupported resource type %q: must be 'projects' or 'groups'", kind)
+		}
+
+	default:
+		return "", fmt.Errorf("invalid key format %q: expected host/id/var or host/projects|groups/id/var", key)
+	}
+}
+
 // Get gets secret from GitLab API
 func (p *provider) GetString(key string) (string, error) {
-	splits := strings.Split(key, "/")
 	gitlabToken, ok := os.LookupEnv("GITLAB_TOKEN")
 	if !ok {
-		return "", errors.New("Missing GITLAB_TOKEN environment variable")
+		return "", errors.New("missing GITLAB_TOKEN environment variable")
 	}
 
-	url := fmt.Sprintf("%s://%s/api/%s/projects/%s/variables/%s",
-		p.Scheme,
-		splits[0],
-		p.APIVersion,
-		splits[1],
-		splits[2])
+	url, err := p.buildURL(key)
+	if err != nil {
+		return "", err
+	}
 
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: p.SSLVerify},