GitLab
Merge request rules and project access. Prerequisites, setup steps and troubleshooting.
What it does
GitLab evidence covers protected branches, merge-request approval rules and project membership, which is what change-management controls ask for.
Prerequisites
- A cSquare GRC workspace where you are an owner or admin.
- Connection method: API key or token.
- Access needed at GitLab: Read-only. read_api scope, or Reporter on the in-scope projects.
Set up
Open Settings > Integrations in the app, find GitLab, then:
- Select Connect and authorize cSquare at GitLab, or paste a project access token under Advanced.
- Use an account that can read the groups and projects you want monitored.
- Confirm the connection shows as Connected under Active connections.
Verify the connection
- Back in Settings > Integrations, GitLab should show Connected with a recent sync time.
- Open Evidence and filter by source GitLab. The first sync can take a few minutes.
- Open a control that depends on GitLab and confirm the new evidence is linked.
AI prompts
Paste these into Fibo in the app, or into any assistant connected through MCP.
I just connected GitLab to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from GitLab.
Which controls in my programs could be covered by GitLab evidence but still have no current evidence? Group them by framework and suggest what to collect.
Troubleshooting
invalid_client when the popup opens
The cSquare-owned GitLab app is not registered yet. A platform administrator sets it in Super Admin, Integration credentials.
Self-managed GitLab is not reachable
Set the base URL to your own GitLab host. The default points at gitlab.com.
Test connection fails immediately
Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.
The connector is quarantined
Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.
Connected, but no evidence appears
Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.
Still stuck?
My GitLab connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.