Skip to main content
Connect GitLab so Enclave can read your projects, review merge requests, and comment with verified findings. Works with GitLab.com and self-hosted GitLab 14 or newer.

​
Before you start

  • You need the Owner or Admin role in Enclave.
  • Enclave lists the GitLab groups where you have the Developer role or higher.
  • To add the webhook, you need the Maintainer role on each project, or the Owner role on the group. Group webhooks need GitLab Premium or Ultimate.
  • For self-hosted GitLab, the access token needs the api scope and the Maintainer role.
Without the webhook, Enclave can’t see new commits or merge requests, and the connection stays pending.

​
Connect GitLab

1

Open integrations

Open Settings → Integrations in app.enclave.ai. Click Connect next to GitLab.
2

Authorize GitLab

Choose GitLab.com, sign in to your GitLab account, and authorize the Enclave application.
GitLab’s OAuth grants Enclave the api scope. GitLab has no narrower scope that allows posting MR comments and managing webhooks. Enclave uses it to read projects and merge requests, post MR comments, and receive webhook events.
Using self-hosted GitLab? Choose Self-hosted GitLab. Enter your instance URL without /api/v4, and paste an access token with the api scope and the Maintainer role. Add a private CA bundle if your instance uses an internal certificate authority. Then click Validate & connect. If your plan doesn’t include self-hosted GitLab, Connect goes straight to GitLab.com.
3

Add the webhook

Enclave shows a Webhook URL and a Secret token. Copy both. The secret is shown only once.In GitLab, open your project (or group, for self-hosted) and go to Settings → Webhooks. Paste the URL and secret token, enable Push events and Merge request events, and click Add webhook. Click Test to send a delivery.The connection stays pending until the first event arrives.
4

Choose which projects get MR reviews

Automatic reviews are on by default for every GitLab project. To turn them off for a project, use its PR Reviews switch in Coverage → Repositories. See PR and dependency analysis.

​
Tips

  • Create a dedicated GitLab account for Enclave so MR comments are clearly attributed. For self-hosted GitLab, a service-account token is best, then a group access token. A personal token works, but every comment appears under your name.
  • Connect every project in a system. Enclave finds cross-service issues only when it can see both the service and the APIs it calls.

​
Troubleshooting

For self-hosted GitLab, Validate & connect checks your URL and token first:
  • Enclave requires GitLab 14 or newer: upgrade your instance.
  • GitLab rejected the token or The token must include the ‘api’ scope: issue a new token with the api scope.
  • The token authenticated but cannot see any projects: add the token to a group or project first.
  • We refused to call that URL: the hostname resolved to a private or internal address. Enclave doesn’t connect to those.
  • We could not reach your GitLab instance: check the URL and your firewall rules.
To rotate a self-hosted token, connect again with a new token for the same instance. Enclave updates the existing connection and keeps your webhook working. Revoke the old token in GitLab afterward.