Skip to Content
IntegrationsGitLab

Connect GitLab.com

CodeStax integrates with GitLab.com for OAuth authentication, repository import, private-repository scanning, merge-request review, CI/CD templates, provider comments, and commit-status delivery.

Connect GitLab.com

During Signup

Click Continue with GitLab on the signup page. This authorizes CodeStax with the required OAuth scopes and connects your GitLab account automatically.

After Signup

  1. Open Integrations from the dashboard sidebar.
  2. Select GitLab.
  3. Click Connect GitLab
  4. Authorize the CodeStax application on GitLab

Permissions

The configured GitLab OAuth application requests the profile and API access needed for the features you authorize. The signup and Integrations pages show GitLab only when the provider is enabled for the deployment.

Features

Repository Import

Once connected, you can import personal and group-owned GitLab.com projects visible to the authorized account. CodeStax paginates the provider project list and lets you select which projects to scan.

Automated merge-request reviews

When you open or update a merge request, CodeStax can:

  1. Analyze the MR diff for security issues
  2. Score the MR risk level (0-100)
  3. Post findings as MR notes/comments
  4. Set commit status (pass/fail)

Scan Support

All scan types work with GitLab repositories:

  • SAST - Static analysis of source code
  • SCA - Dependency vulnerability scanning
  • Secrets - Secret detection in code history
  • IaC - Infrastructure-as-code scanning (Terraform, Kubernetes)
  • Dockerfile - container and Dockerfile best-practice analysis

Token management

CodeStax stores GitLab credentials encrypted. When the provider supplies a refresh token, CodeStax refreshes it before expiry; otherwise reauthorize the connection when GitLab rejects the credential.

CI/CD Integration

You can integrate CodeStax into your GitLab CI pipeline. Go to Reviews > CI/CD in the dashboard and select GitLab to generate a .gitlab-ci.yml template that runs CodeStax quality gate checks on every merge request.

GitLab host support

Repository checkout, branch lookup, merge-request review, status delivery, and dependency-fix merge requests currently target gitlab.com. Self-managed GitLab hosts are not supported by these customer workflows.

Quality-Gate Commit Status

When a quality gate is configured + the GitLab OAuth is connected, every completed scan posts a commit status on the scanned commit:

  • Status name/context: codestax/quality-gate
  • State mapping:
Gate statusBlock-merge-on-fail OFF (default)Block-merge-on-fail ON
passedsuccess ✓success ✓
failedsuccess (visible, non-blocking)failed ✗
not_configuredcanceledcanceled

GitLab commit statuses are visible in the MR pipeline view + commit detail. Target URL links to the full CodeStax scan detail.

Making the Status Required

  1. Enable Block merge on fail under Settings → Policies, or open Settings → Quality Gates.
  2. GitLab → Project Settings → Merge Requests → Pipelines must succeed + add codestax/quality-gate to required checks

Quality-Gate MR Note

CodeStax posts a top-level MR note with violations + per-rule fix hints. Upserted by marker - re-scans update the existing note, no timeline spam.

Disable globally with SCANNER_PR_COMMENT_ENABLED=0 on the scanner server.

GitHubBitbucket