> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/connectors/gitlab.md).

# GitLab

## Overview

Connect Nullify to your GitLab instance to assess your projects, review merge requests, and scan every push. Nullify works with GitLab.com (SaaS) and self-managed GitLab. Installation steps are documented in the Enterprise Tier section.

Nullify posts updates asynchronously so developers stay inside their existing workflow.

## What Nullify does with GitLab

* **Merge request reviews.** When a merge request is opened, reopened, or updated, Nullify scans the changed code and posts its findings back to the merge request. When a merge request is merged or closed, Nullify reconciles the state of any of its own autofix merge requests and records the outcome.
* **Push scanning.** Every push to a branch triggers a scan. Pushes to the project's default branch additionally update the repository's baseline so dashboards and finding counts stay current. Pushes that introduce no new commits are ignored.
* **Comment-driven discussion.** Replies on a Nullify merge request thread are routed back to Nullify so it can respond in-line, keeping the review conversation in GitLab.
* **Pipeline awareness.** Nullify tracks the result of pipelines associated with a merge request, mapping success/failure back to the corresponding scan so the CI/PR gate can act on it.

## How it connects

Nullify connects to GitLab through two mechanisms set up during install (see the Enterprise Tier guide):

1. **An access token** that lets Nullify call the GitLab API — resolving the group that owns a project, posting merge-request reviews, and reading diffs. The token is stored encrypted by the Nullify platform.
2. **A project (or group) webhook** that delivers events to Nullify's ingestion endpoint at `/core/gitlab/webhook`. Each delivery carries a secret token in the `X-Gitlab-Token` header, which Nullify verifies before processing the event.

## Events handled

Nullify subscribes to the following GitLab webhook events:

| GitLab event           | Used for                                                                       |
| ---------------------- | ------------------------------------------------------------------------------ |
| Push events            | Branch push scanning; default-branch pushes refresh the baseline               |
| Merge request events   | Merge request scans on open/reopen/update; state reconciliation on merge/close |
| Comments (note events) | Routing replies on Nullify merge-request threads                               |
| Pipeline events        | Mapping merge-request pipeline results back to scans                           |

Pushes that introduce no new commits are ignored. Nullify does not currently act on tag-push, deployment, issue, or job events.

{% hint style="info" %}
Settings such as the CI/PR gate, ticketing thresholds, and notification targets are configured in the Nullify dashboard under **Configure**, not in a file in your repository.
{% endhint %}

## Support

If you encounter any issues, please contact our support team for assistance.