@@ -78,7 +78,7 @@ fi
 cecho b "Starting GitLab..."
 # run GitLab with root password pre-set and as many unnecessary features disabled to speed up the startup
 docker run --detach \
-    --hostname gitlab.foobar.com \
+    --hostname localhost \
     --env GITLAB_OMNIBUS_CONFIG="$gitlab_omnibus_config" \
     --publish 443:443 --publish 80:80 --publish 2022:22 \
     --name gitlab \
 
@@ -67,50 +67,6 @@ def get_branch_access_levels(self, project_and_group_name, branch):
             "projects/%s/protected_branches/%s", (project_and_group_name, branch)
         )
 
-    def get_only_branch_access_levels(self, project_and_group_name, branch):
-        try:
-            result = self._make_requests_to_api(
-                "projects/%s/protected_branches/%s", (project_and_group_name, branch)
-            )
-
-            push_access_levels = set()
-            merge_access_levels = set()
-            push_access_user_ids = set()
-            merge_access_user_ids = set()
-            unprotect_access_level = None
-
-            if "push_access_levels" in result:
-                for push_access in result["push_access_levels"]:
-                    if not push_access["user_id"]:
-                        push_access_levels.add(push_access["access_level"])
-                    else:
-                        push_access_user_ids.add(push_access["user_id"])
-
-            if "merge_access_levels" in result:
-                for merge_access in result["merge_access_levels"]:
-                    if not merge_access["user_id"]:
-                        merge_access_levels.add(merge_access["access_level"])
-                    else:
-                        merge_access_user_ids.add(merge_access["user_id"])
-
-            if (
-                "unprotect_access_levels" in result
-                and len(result["unprotect_access_levels"]) == 1
-            ):
-                unprotect_access_level = result["unprotect_access_levels"][0][
-                    "access_level"
-                ]
-
-            return (
-                sorted(push_access_levels),
-                sorted(merge_access_levels),
-                sorted(push_access_user_ids),
-                sorted(merge_access_user_ids),
-                unprotect_access_level,
-            )
-        except NotFoundException:
-            return None, None, None, None, None
-
     def create_branch(
         self, project_and_group_name, new_branch_name, create_branch_from_ref
     ):
 
@@ -98,10 +98,6 @@ def _get_project_id(self, project_and_group):
         result = self.get_project(project_and_group)
         return str(result["id"])
 
-    def has_no_license(self):
-        license = self._make_requests_to_api("license")
-        return not license or license["expired"]
-
     def _make_requests_to_api(
         self,
         path_as_format_string,
 
@@ -122,11 +122,6 @@ def put_group_settings(self, project_and_group_name, group_settings):
             "groups/%s", project_and_group_name, "PUT", group_settings
         )
 
-    def get_group_shared_with(self, group):
-        group = self.get_group_case_insensitive(group)
-
-        return group["shared_with_groups"]
-
     def add_share_to_group(
         self, group, share_with_group_name, group_access, expires_at=None
     ):
 
@@ -9,12 +9,6 @@ def get_project_members(self, project_and_group_name, all=False):
 
         return self._make_requests_to_api(url_template, project_and_group_name)
 
-    def get_shared_with_groups(self, project_and_group_name):
-        # a dict with groups that this project has been shared with
-        return self._make_requests_to_api("projects/%s", project_and_group_name)[
-            "shared_with_groups"
-        ]
-
     def add_member_to_project(
         self,
         project_and_group_name,
 
@@ -7,20 +7,6 @@ def get_tags(self, project_and_group_name):
             "projects/%s/repository/tags", project_and_group_name
         )
 
-    def create_tag(self, project_and_group_name, tag_name, ref, message=None):
-        data = {
-            "tag_name": tag_name,
-            "ref": ref,
-            "message": message,
-        }
-        return self._make_requests_to_api(
-            "projects/%s/repository/tags",
-            project_and_group_name,
-            method="POST",
-            data=data,
-            expected_codes=201,
-        )
-
     def delete_tag(self, project_and_group_name, tag_name):
         self._make_requests_to_api(
             "projects/%s/repository/tags/%s",
 
@@ -17,11 +17,3 @@ def get_user_by_name(self, username, user_id=None):
         if not user_id:
             user_id = self._get_user_id(username)
         return self._make_requests_to_api("users/%s", str(user_id), "GET")
-
-    def delete_user(self, username, user_id=None):
-        if not user_id:
-            user_id = self._get_user_id(username)
-        # 404 means that the user does not exist anymore, so let's accept it for idempotency
-        return self._make_requests_to_api(
-            "users/%s", str(user_id), method="DELETE", expected_codes=[204, 404]
-        )
@@ -60,6 +60,7 @@ def get_version_file_path():
     extras_require={
         "test": [
             "pytest==7.2.0",
+            "python-gitlab==3.11.0",
             "xkcdpass==1.19.3",
             "pre-commit==2.20.0",  # not really for tests, but for development
             "coverage==6.5.0",
 
@@ -1,11 +1,13 @@
 import os
 import textwrap
+from contextlib import contextmanager
+from typing import Union, TYPE_CHECKING
 
+import gitlab
+from gitlab.v4.objects import Group, Project
 from xkcdpass import xkcd_password as xp
 
 from gitlabform import GitLabForm
-from gitlabform.gitlab import GitLab, AccessLevel
-from gitlabform.gitlab.core import NotFoundException, UnexpectedResponseException
 
 CONFIG = """
 config_version: 3
@@ -38,7 +40,25 @@
             else:
                 print(f"{file_path} doesn't exist.")
 
-gl = GitLab(config_string=CONFIG)
+gl = gitlab.Gitlab(
+    os.getenv("GITLAB_URL"), private_token=os.getenv("GITLAB_TOKEN"), per_page=100
+)
+
+
+@contextmanager
+def allowed_codes(codes: Union[int, list[int]]):
+    """
+    A context manager that allows failures on specific response status codes
+    when gitlab.Gitlab objects.
+    """
+    if isinstance(codes, int):
+        codes = [codes]
+
+    try:
+        yield
+    except gitlab.GitlabOperationError as e:
+        if e.response_code not in codes:
+            raise e
 
 
 def get_random_name(entity: str) -> str:
@@ -54,108 +74,127 @@ def get_random_suffix():
     return xp.generate_xkcdpassword(wordlist=my_words, numwords=1, delimiter="_")
 
 
-def get_gitlab():
-    return gl
-
-
-def create_group(group_name, parent_id=None):
-    gl.create_group(group_name, group_name, parent_id=parent_id, visibility="internal")
+def create_group(group_name, parent_id=None) -> Group:
+    with allowed_codes(404):
+        group = gl.groups.create(
+            {
+                "name": group_name,
+                "path": group_name,
+                "parent_id": parent_id,
+                "visibility": "internal",
+            }
+        )
+    if TYPE_CHECKING:
+        assert isinstance(group, Group)
+    return group
 
 
 def create_groups(group_base_name, no_of_groups):
     groups = []
     for group_no in range(1, no_of_groups + 1):
         group_name = group_base_name + str(group_no)
         try:
-            gl.get_group_case_insensitive(group_name)
-        except NotFoundException:
-            gl.create_group(group_name, group_name)
-        groups.append(group_name)
+            group = gl.groups.get(group_name)
+        except gitlab.GitlabGetError:
+            group = create_group(group_name)
+        groups.append(group)
     return groups
 
 
 def delete_groups(group_base_name, no_of_groups):
     for group_no in range(1, no_of_groups + 1):
         group_name = group_base_name + str(group_no)
-        gl.delete_group(group_name)
-
-
-def create_project(group_name, project_name):
-    group = gl.get_group(group_name)
-    gl.create_project(
-        project_name,
-        project_name,
-        group["id"],
-        default_branch="main",
-        wait_if_still_being_deleted=True,
+        with allowed_codes(404):
+            gl.groups.delete(group_name)
+
+
+def create_project(group: Group, project_name) -> Project:
+    project = gl.projects.create(
+        {
+            "name": project_name,
+            "path": project_name,
+            "namespace_id": group.id,
+            "default_branch": "main",
+        }
     )
 
-    gl.add_file(
-        f"{group_name}/{project_name}",
-        "main",
-        "README.md",
-        DEFAULT_README,
-        "Create README",
+    project.files.create(
+        {
+            "branch": "main",
+            "file_path": "README.md",
+            "content": DEFAULT_README,
+            "commit_message": "Create README",
+        }
     )
+    if TYPE_CHECKING:
+        assert isinstance(project, Project)
+    return project
 
 
 def create_users(user_base_name, no_of_users):
     users = []
     for user_no in range(1, no_of_users + 1):
         username = user_base_name + str(user_no)
+        existing = gl.users.list(username=username)
         try:
-            gl.get_user_by_name(username)
-        except NotFoundException:
-            gl.create_user(
-                username + "@example.com", username + " Example", username, "password"
+            user = existing[0]
+        except IndexError:
+            user = gl.users.create(
+                {
+                    "username": username,
+                    "email": username + "@example.com",
+                    "name": username + " Example",
+                    "password": username + "password",
+                }
             )
-        users.append(username)
+        users.append(user)
     return users
 
 
-def delete_users(user_base_name, no_of_users):
-    for user_no in range(1, no_of_users + 1):
-        username = user_base_name + str(user_no)
-        gl.delete_user(username)
+def get_only_branch_access_levels(project: Project, branch):
+    protected_branch = None
 
+    with allowed_codes(404):
+        protected_branch = project.protectedbranches.get(branch)
 
-def remove_users_from_project(user_base_name, no_of_users, project_and_group):
-    for user_no in range(1, no_of_users + 1):
-        username = user_base_name + str(user_no)
-        gl.remove_member_from_project(project_and_group, username)
+    if not protected_branch:
+        return None, None, None, None, None
 
+    push_access_levels = set()
+    merge_access_levels = set()
+    push_access_user_ids = set()
+    merge_access_user_ids = set()
+    unprotect_access_level = None
 
-def add_users_to_group(group_name, usernames, access_level=AccessLevel.DEVELOPER.value):
-    for username in usernames:
-        try:
-            gl.add_member_to_group(group_name, username, access_level)
-        except UnexpectedResponseException:
-            # this is fine - user is already in the group
-            pass
-
-
-def remove_users_from_group(group_name, usernames):
-    for username in usernames:
-        try:
-            gl.remove_member_from_group(group_name, username)
-        except NotFoundException:
-            # this is fine - user is removed from group
-            pass
-
-
-def delete_variables_from_group(group_name, variables):
-    for variable in variables:
-        try:
-            gl.delete_group_variable(group_name, variable)
-        except NotFoundException:
-            # this is fine - variable is removed from group
-            pass
-
+    if "push_access_levels" in protected_branch.attributes:
+        for push_access in protected_branch.push_access_levels:
+            if not push_access["user_id"]:
+                push_access_levels.add(push_access["access_level"])
+            else:
+                push_access_user_ids.add(push_access["user_id"])
 
-def delete_pipeline_schedules_from_project(project_and_group):
-    schedules = gl.get_all_pipeline_schedules(project_and_group)
-    for schedule in schedules:
-        gl.delete_pipeline_schedule(project_and_group, schedule["id"])
+    if "merge_access_levels" in protected_branch.attributes:
+        for merge_access in protected_branch.merge_access_levels:
+            if not merge_access["user_id"]:
+                merge_access_levels.add(merge_access["access_level"])
+            else:
+                merge_access_user_ids.add(merge_access["user_id"])
+
+    if (
+        "unprotect_access_levels" in protected_branch.attributes
+        and len(protected_branch.unprotect_access_levels) == 1
+    ):
+        unprotect_access_level = protected_branch.unprotect_access_levels[0][
+            "access_level"
+        ]
+
+    return (
+        sorted(push_access_levels),
+        sorted(merge_access_levels),
+        sorted(push_access_user_ids),
+        sorted(merge_access_user_ids),
+        unprotect_access_level,
+    )
 
 
 def run_gitlabform(config, target, include_archived_projects=True):
@@ -165,6 +204,12 @@ def run_gitlabform(config, target, include_archived_projects=True):
     # we don't want to repeat ourselves in the tests, so prefix the configs with this mandatory part here
     config = CONFIG + config
 
+    # allow passing in gitlab RESTObjects. assume full path string otherwise
+    if isinstance(target, Group):
+        target = target.full_path
+    elif isinstance(target, Project):
+        target = target.path_with_namespace
+
     gf = GitLabForm(
         include_archived_projects=include_archived_projects,
         config_string=config,