GitLab

GitLab accepts two kinds of credential, and both work with gitlab.com and with a self-managed GitLab.

	OAuth application	Personal access token
Belongs to	An application you register on GitLab	One person’s account
Tokens	Access token refreshed automatically	Valid until the token’s own expiry
Scopes	api, read_user, read_repository	api (full use) or read_api (read-only)

Connecting

1. Credentials → Add credential → GitLab.
2. Choose where GitLab lives: gitlab.com (Cloud) or Self-hosted. For self-hosted, enter the instance URL, e.g. https://gitlab.acme.com (no trailing path).
3. Choose how AppArch authenticates: Register an application or Paste a token.

OAuth application

1. In GitLab open User Settings → Applications and create an application.
2. Paste the Redirect URI the wizard shows, exactly as shown.
3. Tick the scopes api, read_user, read_repository.
4. Copy the Application ID and Secret into the wizard and save. A group name is optional.
5. Finish the authorization with Connect with GitLab on the credential.

Personal access token

1. In GitLab create a personal access token with api or read_api.
2. Paste it into the wizard. A group name is optional.

Before the token is stored, AppArch reads its scopes and expiry from GitLab. A token without api or read_api is refused. A read_api token is accepted with a read-only warning: scanning and reports work, but ArchPilot cannot write comments with it.

What it enables

• ArchPilot comments on merge requests.
• ArchScan / ArchSecurity results from CI runs appear in the panel.

CI

Add the runner job to your GitLab CI pipeline:

# Image pulls are authorized with your INSTALLATION credential, not the project token
# (Settings → CI/CD → Variables):
#   DOCKER_AUTH_CONFIG = {"auths":{"hub.apparch.io":{"auth":"base64(<installation-id>:<installation-key>)"}}}
archpilot:
  image: hub.apparch.io/collectors/dotnet:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    APPARCH_Collector__Token: "$APPARCH_TOKEN"
    APPARCH_Collector__ApiUrl: "https://api.yourdomain.com"
  script:
    # Optional flags: --modules archpilot,archscan (pin what runs)
    #                 --fail-on critical (fail this step when findings at/above the level exist)
    - apparch "$CI_PROJECT_DIR"

More CI examples and token setup: Add the runner to CI.