GitLab
Overview
Connect Nullify to your GitLab instance to assess your projects, review merge requests, and scan every push. Nullify works with GitLab.com (SaaS) and self-managed GitLab. Installation steps are documented in the Enterprise Tier section.
Nullify posts updates asynchronously so developers stay inside their existing workflow.
What Nullify does with GitLab
Merge request reviews. When a merge request is opened, reopened, or updated, Nullify scans the changed code and posts its findings back to the merge request. When a merge request is merged or closed, Nullify reconciles the state of any of its own autofix merge requests and records the outcome.
Push scanning. Every push to a branch triggers a scan. Pushes to the project's default branch additionally update the repository's baseline so dashboards and finding counts stay current. Pushes that introduce no new commits are ignored.
Comment-driven discussion. Replies on a Nullify merge request thread are routed back to Nullify so it can respond in-line, keeping the review conversation in GitLab.
Pipeline awareness. Nullify tracks the result of pipelines associated with a merge request, mapping success/failure back to the corresponding scan so the CI/PR gate can act on it.
How it connects
Nullify connects to GitLab through two mechanisms set up during install (see the Enterprise Tier guide):
An access token that lets Nullify call the GitLab API — resolving the group that owns a project, posting merge-request reviews, and reading diffs. The token is stored encrypted by the Nullify platform.
A project (or group) webhook that delivers events to Nullify's ingestion endpoint at
/core/gitlab/webhook. Each delivery carries a secret token in theX-Gitlab-Tokenheader, which Nullify verifies before processing the event.
Events handled
Nullify subscribes to the following GitLab webhook events:
Push events
Branch push scanning; default-branch pushes refresh the baseline
Merge request events
Merge request scans on open/reopen/update; state reconciliation on merge/close
Comments (note events)
Routing replies on Nullify merge-request threads
Pipeline events
Mapping merge-request pipeline results back to scans
Pushes that introduce no new commits are ignored. Nullify does not currently act on tag-push, deployment, issue, or job events.
Settings such as the CI/PR gate, ticketing thresholds, and notification targets are configured in the Nullify dashboard under Configure, not in a file in your repository.
Support
If you encounter any issues, please contact our support team for assistance.
Last updated