Connect gitlab.com or a self-managed GitLab so Safeguard can check group security settings, branch protection and merge request reviews.

Connect GitLab

Safeguard reads your GitLab groups and projects with read-only access: two-factor and SSO enforcement, members and administrators, branch protection, merge request approvals, pipelines, and security scanning settings.

There are three cards:

GitLab: gitlab.com, or a self-managed instance if you fill in its Base URL.
GitLab Self-Managed: your own GitLab instance.
GitLab Issues: GitLab used as a ticket tracker.

What the credential can see

Safeguard reads every top-level group the credential's user is a member of. A user in no group is judged on the projects they own. Some reads need more than membership:

Setting	Needs
Groups, projects, members, two-factor requirement, "pipelines must succeed"	The `read_api` scope and any membership
Protected branches	Developer role on the project (Maintainer on older GitLab versions)
Pipelines and their jobs on private projects	Reporter role on the project
Merge request approval rules	GitLab Premium
Secret push protection	GitLab Ultimate

On a plan without a feature, the setting does not exist, and the check says so instead of failing.

Option A: personal access token (recommended)

In GitLab, open your avatar menu › Edit profile › Access tokens and add a new token.
Select only the read_api scope, and set an expiry that fits your policy.
Create it as a user who is a member of the groups you want checked, with the roles above.
In Safeguard, open Compliance › Connectors, search for GitLab and click Connect. Choose API token:

Field	What to enter
Base URL (self-hosted)	Leave empty for gitlab.com. For a self-managed instance, its `https://` address.
API token / PAT	The token

A self-managed instance must be reachable at a public https:// address. Safeguard refuses private and reserved addresses.

Option B: OAuth (gitlab.com only)

Choose OAuth on the GitLab card and approve the sign-in. GitLab's OAuth sign-in asks for the api and read_user scopes; api also permits writes, though Safeguard only reads. For a strictly read-only connection, use a token with read_api.

OAuth signs in to gitlab.com only. Connect a self-managed instance with a token.

Several self-managed instances

GitLab Self-Managed can be connected more than once, one connection per instance. When multiple accounts are switched on for your workspace, open the connected card and choose Add another account. A second group on gitlab.com is not a separate account: one gitlab.com connection already covers every group its user belongs to.

What Safeguard checks

Two-factor authentication required for the group, and SSO enforced
Administrators and how many there are, outside collaborators, and whether admins are exempt from rules
Default branch protection: no direct pushes and no force pushes
Merge request approvals required, no self-approval, stale approvals dismissed, code owner review
Required pipeline checks, and merged changes that were reviewed
Secret detection and push protection, dependency scanning alerts and their age, code scanning, and fork restrictions

Troubleshooting

Not working, naming a scope or role: give the token read_api, or give its user the role the message names on that project.
A group is missing: the token's user is not a member of that group.