GitLab Install

Nullify integrates with GitLab.com (SaaS) and self-managed GitLab. Connecting Nullify requires two things: an access token so Nullify can call the GitLab API, and a webhook so GitLab streams repository events to Nullify.

Please reach out to our team to assist with your group setup.

Install Nullify

1. Create an access token

Nullify uses a GitLab access token to resolve the group that owns each project, read diffs, and post merge-request reviews. Create either a group access token (recommended, so coverage applies to every project in the group) or a personal access token for a service account.

1. In GitLab, navigate to your group's Settings → Access tokens (or Edit profile → Access tokens for a personal access token).

2. Create a token with the api scope and the Maintainer role.

3. Provide the token to your Nullify representative. Nullify stores it encrypted and uses it for all GitLab API calls.

For self-managed GitLab, also share your instance base URL (e.g. https://gitlab.your-company.com) so Nullify targets the correct API host.

2. Add the webhook

Nullify ingests GitLab events at a single endpoint. Add a webhook so GitLab delivers events to it. A group webhook covers every project in the group; a project webhook covers one project.

1. Navigate to Settings → Webhooks for your group (or project).

2. Set the URL to your Nullify webhook endpoint:

   https://api.<your-organization>.nullify.ai/core/gitlab/webhook

   Your Nullify representative will confirm the exact host for your stack.

3. Set the Secret token to the value provided by your Nullify representative. GitLab sends this in the X-Gitlab-Token header and Nullify verifies it on every delivery.

4. Under Trigger, enable the following events:

   • Push events

   • Comments

   • Merge request events

   • Pipeline events

5. Keep SSL verification enabled and click Add webhook.

Nullify acknowledges deliveries it does not act on (for example pushes with no new commits) with a success response, so unrelated webhook deliveries will still show as delivered in GitLab.

3. Final steps

1. Wait for your stack to be provisioned by the Nullify team.

2. Once provisioned, you'll receive confirmation and can begin using Nullify to assess your GitLab projects. Open a merge request or push to a branch to trigger the first scan.

Support

If you encounter any issues during the installation process, please contact our support team for assistance.

Autofix merge requests

For supported findings, Nullify can create a fix branch, push changes, and open a GitLab merge request. It can update and rebase the MR as the review progresses. Reviewer selection resolves eligible GitLab users before requesting review; ownership data and project access affect who can be assigned. A human reviews and merges the change.