# glab repo clone: Clone GitLab Repos in CI

> glab repo clone clones a GitLab project (or a whole group) using your token. Reference for group cloning, --preserve-namespace, and the auth and host errors in CI.

Source: https://latchkey.dev/learn/command-reference/glab-repo-clone-ci  
Updated: 2026-06-30

glab repo clone clones a GitLab project by path, or every project under a group, authenticating with your token.

When a job needs another GitLab repo, glab repo clone uses the same token as the rest of the CLI, so you avoid embedding credentials in a git URL.

## What it does

glab repo clone clones a project given its path (group/project). Given just a group or username it clones all accessible projects underneath. It uses the authenticated token, so private repos clone without hardcoding credentials in the remote URL.

## Common usage

```Terminal
# clone a single project
glab repo clone mygroup/myproject
# clone every project in a group, keeping the namespace layout
glab repo clone mygroup --preserve-namespace
# pass extra git flags after --
glab repo clone mygroup/myproject -- --depth 1
```

## Options

| Flag | What it does |
| --- | --- |
| <group/project> | Path of the project to clone |
| <group> | Clone all accessible projects under the group |
| --preserve-namespace | Recreate the group directory structure |
| --paginate | Fetch all pages when cloning many projects |
| -- <git args> | Pass flags straight through to git clone |

## In CI

glab repo clone relies on GITLAB_TOKEN (and GITLAB_HOST for self-managed), so authenticate once and reuse it. Add -- --depth 1 for a shallow clone to speed up jobs. For self-managed hosts set GITLAB_HOST or the clone resolves against gitlab.com.

## Common errors in CI

"authentication required" means GITLAB_TOKEN is unset. "404 Project Not Found" means the path is wrong or the token cannot see it. "fatal: could not read Username for \"https://gitlab.com\"" means glab fell back to a plain git clone without a token; confirm glab is authenticated. A wrong GITLAB_HOST gives "no such host".

## Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

```.github/workflows/ci.yml
- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached
```

> `git rev-parse --abbrev-ref HEAD` returns the literal string `HEAD` on a detached checkout rather than a branch name. On GitHub Actions read `github.ref_name` instead; the git command cannot know what it was checked out for.

## FAQ

### glab repo clone: Clone GitLab Repos in CI?

When a job needs another GitLab repo, glab repo clone uses the same token as the rest of the CLI, so you avoid embedding credentials in a git URL.

### What it does?

glab repo clone clones a project given its path (group/project). Given just a group or username it clones all accessible projects underneath. It uses the authenticated token, so private repos clone without hardcoding credentials in the remote URL.

### In CI?

glab repo clone relies on GITLAB_TOKEN (and GITLAB_HOST for self-managed), so authenticate once and reuse it. Add -- --depth 1 for a shallow clone to speed up jobs. For self-managed hosts set GITLAB_HOST or the clone resolves against gitlab.com.

### Common errors in CI?

"authentication required" means GITLAB_TOKEN is unset. "404 Project Not Found" means the path is wrong or the token cannot see it. "fatal: could not read Username for \"https://gitlab.com\"" means glab fell back to a plain git clone without a token; confirm glab is authenticated. A wrong GITLAB_HOST gives "no such host".

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt