Gap

Generic (non-GitHub, non-ADO) git hosts -- GitLab, Gitea, Gogs, Bitbucket -- are routed through GenericGitBackend in src/apm_cli/deps/host_backends.py. Coverage today:

• Unit: tests/unit/deps/test_host_backends.py::TestGenericGitBackend (URL builders).
• Parse/canonicalize: tests/integration/test_generic_git_url_install.py exercises generic URL shapes (string and object form, HTTPS/SSH, gitlab.com/acme/standards shape) but does NOT perform a live install against a real gitlab.com repo.

No CI job verifies that apm install gitlab.com/<org>/<repo> actually clones, validates, and stamps a real public package.

Risk

Our code path delegates to git for non-GitHub/ADO hosts (no proprietary API). If git ls-remote semantics or URL builders silently drift, every GitLab/Gitea/Bitbucket consumer breaks with no test failing. This is a thin but high-blast-radius surface.

Suggested approach

Add an opt-in @pytest.mark.live_generic test that:

1. Reads a known stable public APM-shaped repo from gitlab.com (we can publish a tiny fixture at gitlab.com/microsoft-apm-fixtures/smoke-pkg or pick an existing public APM package).
2. Runs apm install gitlab.com/<that-repo> end-to-end.
3. Asserts: clone succeeded, package validated, lockfile entry has host: gitlab.com and a resolved commit SHA.

Skip by default; gate on a new CI job (nightly or weekly) so a flaky upstream doesn't block PRs.

Out of scope

Gitea/Gogs/Bitbucket smoke installs (separate follow-ups if appetite). gitlab.com is the dominant non-GitHub host and the highest-leverage signal.