GitLab

Setup

To set up the GitLab integration, navigate to the Integrations > Add integration > GitLab and click Continue.

An API key is required for the platform to access GitLab projects and group information. The following steps outline the process of creating a Group Access Token for the company’s root level group.

1. On GitLab open the left sidebar, select Search or go to and find your company’s root level group.
2. Select Settings > Access Tokens, select Add new token.
3. Enter a name and expiry date for the token.
4. Select the Reporter role for the token.
5. Select the read_api scope.
6. Select Create group access token.

Cloning over SSH

By default, Oneleet clones your repositories for code scanning over HTTPS using the access token above. If your group disables Git over HTTP(S) (Settings > General > Permissions and group features > Enabled Git access protocols set to Only SSH), enable Clone over SSH on the GitLab connection instead.

With SSH cloning enabled, Oneleet generates a dedicated SSH keypair for the connection and shows you the public key right after you connect. You can view the key again anytime via View SSH key in the connection’s menu on the Integrations page. Add it as a deploy key to each project that should be scanned:

1. In Gitlab, navigate to the project(s) that you would like to be scanned.
2. On the left sidebar, select Settings > Repository.
3. Expand the Deploy keys section and click Add new key.
4. Add the generated SSH public key to the Key section along with any name that you would like to use to identify this key.
5. Click Add key.

If you intend to scan more than a single project, you will need to enable this SSH key as a deploy key for each additional project.

1. In Gitlab, navigate to the project(s) that you would like to be scanned.
2. On the left sidebar, select Settings > Repository.
3. Expand the Deploy keys section and click Privately accessible deploy keys.
4. Click Enable for the name of the deploy key that you previously added.

Once the key is installed and enabled for a project, scans clone over SSH automatically. If you add another project later, enable the same deploy key for the project before scanning. Your access token is still required for everything else the integration does (project, group, and user monitoring), since GitLab’s SSH-only setting only affects the Git transport, not API access.