GitLab connects through OAuth. Once a project is connected it is a repository like any other, and every scan, finding, branch, commit, and fix behaves identically.
Connect the account
- 1Open the repositories page
Go to cefense.com/app and choose GitLab.
- 2Authorise
GitLab shows what is being requested and asks you to confirm. Signing in happens on GitLab, not in Cefense.
- 3Pick a project
The projects your account can reach are listed. Connecting one queues its first scan.
Self-managed instances
A self-managed GitLab is connected the same way, against your own instance rather than gitlab.com. The instance has to be reachable from Cefense for scans to fetch anything, so an instance behind a private network needs a route before this will work.
Group access
Cefense sees the projects your GitLab account can see. Access granted through a group applies, and access your account loses is lost here too, at the next look.
What works, and the one thing that is GitHub only
| Capability | GitLab |
|---|---|
| Scanning, findings, branches, commits | Yes |
| Fix generation, merge requests, and merging | Yes |
| Connecting a project from the workspace | Yes |
Connecting a project with cf repo connect --provider gitlab | Yes |
| Authorising the GitLab account itself | In a browser, as with every host |
cf scan --url | GitHub only. Connect the project, then cf scan. |
Troubleshooting
A project I can see in GitLab is missing
The token was granted before you gained access to it. Disconnect and reconnect the account to refresh what Cefense can see.
The connection stopped working
Reconnect from the workspace. GitLab tokens expire, and a revoked authorisation cannot be renewed silently.
Have a correction or need help?
Email the docs team