> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GitLab

> Discover AI workloads, tools, models, and configuration in GitLab repositories.

Forge scans GitLab projects for AI application code and configuration, then
projects each supported signal into Inventory with repository, revision, file,
and confidence evidence.

## Coverage

| Capability       | Implementation                                                       |
| ---------------- | -------------------------------------------------------------------- |
| Repository scope | GitLab group or user, with an optional project allowlist             |
| Hosting          | GitLab.com and HTTPS self-managed GitLab API endpoints               |
| Authentication   | Group, project, or service-account access token                      |
| Revision         | Default branch and resolved commit                                   |
| Output           | Inventory items, source references, confidence, and posture findings |

## Detection

| Asset class       | Examples                                                               |
| ----------------- | ---------------------------------------------------------------------- |
| AI applications   | Provider SDKs, agent frameworks, orchestration code, and AI endpoints  |
| Tooling           | MCP servers, function tools, code execution, and database capabilities |
| Infrastructure    | Containers, Terraform, deployment manifests, and model artifacts       |
| Configuration     | Gateway configuration, provider references, and environment key names  |
| Data dependencies | Vector stores, connectors, and referenced cloud data services          |

Signals that are ambiguous in isolation require corroborating repository
context. Every accepted observation retains the source path, line, content
fingerprint, evidence quality, and confidence.

## Scan contract

| Limit                | Behavior                                                                 |
| -------------------- | ------------------------------------------------------------------------ |
| Projects per run     | Up to 25                                                                 |
| Candidate files      | Up to 300 per project                                                    |
| File size            | Files larger than 256 KiB are skipped                                    |
| Exclusions           | Generated output, vendored dependencies, caches, lockfiles, and `.git`   |
| Repository selection | When no allowlist is supplied, Forge lists projects visible to the token |

## Connection

| Field          | Description                                                                                   |
| -------------- | --------------------------------------------------------------------------------------------- |
| Owner          | GitLab group or user used to enumerate projects                                               |
| Base URL       | GitLab API v4 endpoint; Forge appends `/api/v4` when required                                 |
| Authentication | `gitlab_group_access_token`, `gitlab_project_access_token`, or `gitlab_service_account_token` |
| Repositories   | Optional project allowlist                                                                    |

## Setup

1. Open **Settings → Integrations → GitLab** and save the namespace, API v4
   base URL, authentication mode, and token.
2. Leave the project list empty to enumerate projects visible to the token, or
   provide an explicit project allowlist.
3. Run a sync. Forge records success, `observationCount`,
   `canonicalInventoryCount`, and blockers for each project.

Changing the base URL after a credential has been saved requires token
rotation. Production endpoints must use HTTPS and cannot contain credentials,
query strings, fragments, or path traversal.

## Boundaries

GitLab scanning is static evidence. It does not establish live usage, user
identity at runtime, prompt or response content, tool execution, or enforcement.
Join it with endpoint, gateway, or cloud telemetry for runtime attribution.