GitLab Integration
Authorize Vygl on GitLab.com or your self-hosted GitLab instance to discover projects, register webhooks, and post merge-request comments. The integration uses standard OAuth 2.0 with automatic token refresh.
Install
Section titled “Install”-
Open Settings → Connections in Vygl.
-
Click Connect GitLab. You’re redirected to GitLab’s authorization page.
-
Authorize. Approve the requested scopes —
read_apiandwrite_repository. -
Pick projects. GitLab redirects back to Vygl. Select the projects you want scanned.
Webhooks register automatically. Pushes and merge requests trigger scans.
Scopes
Section titled “Scopes”| Scope | Why |
|---|---|
read_api | Read project metadata, list branches, fetch source for scanning |
write_repository | Post comments on merge requests, set commit pipeline status |
GitLab tokens have expiries; Vygl refreshes them transparently in the background.
What happens on a push or MR
Section titled “What happens on a push or MR”- GitLab fires a webhook with the push/MR event. Vygl verifies the HMAC signature.
- Vygl clones the project at the new commit.
- Scan engines run server-side.
- Findings appear in the dashboard, deduplicated against history.
- For merge requests, Vygl posts (or updates) the summary comment and pipeline status.
Branch filtering
Section titled “Branch filtering”Each project can specify a branch filter regex. Merge-request scans always run; push scans on non-matching branches are skipped.
Self-hosted GitLab
Section titled “Self-hosted GitLab”Self-hosted GitLab Community and Enterprise editions both work. The integration reads the API base URL from your OAuth app configuration; nothing additional is needed beyond pointing the OAuth back to your instance.
Removing access
Section titled “Removing access”Revoke from GitLab (User Settings → Applications) at any time. Webhook events stop immediately. Existing data is retained — remove the connection in Vygl’s Settings → Connections to stop showing the integration.