GitLab
Connect gitlab.com or a self-managed instance over OAuth or a token.
Vetoo reviews merge requests on GitLab the same way it reviews pull requests on GitHub. Each review posts inline findings, a severity on each finding, and one verdict. Connect gitlab.com or a self-managed instance in one of two ways.
OAuth is the fastest route for gitlab.com. It also suits a self-managed instance where you registered a Vetoo OAuth application. You must own the group you connect.
Choose GitLab in the connect flow. Select OAuth. Approve the access on GitLab. Choose which of the group's projects Vetoo reviews. Vetoo then adds a bot user to each project with Developer access, the least access it needs. The connection is live when you return to Vetoo.
Personal access token setup
Create a dedicated bot identity
Use a GitLab service account (free, no seat) or a new user for the token. Don't use your own account. Vetoo posts reviews and comments as whoever the token belongs to.
Add the bot to the project
Give it the Developer role. That's the least GitLab allows for approvals and commit statuses.
Create the access token
On the bot's account, create a personal access token with the api scope and an expiry. read_api is not enough and Vetoo rejects it.
Only a workspace owner or admin can connect or disconnect a GitLab instance.
Vetoo rotates the credential on a schedule, so your token does not expire without notice. If the rotation fails, the connection moves to Needs reconnect in the app. An admin who revokes the access on GitLab has the same effect.
Self-managed instances
Enter your instance's URL during the connect flow. Every later step matches gitlab.com. OAuth needs a Vetoo OAuth application on the instance first. A personal access token needs no such application, which makes the token route simpler for a private instance. The instance must answer over https at a public host. Vetoo cannot connect an address that resolves only on your private network.
Keep the token scoped to api and no wider. If the token leaks, revoke it in your GitLab settings. Then enter a new token. Vetoo keeps the token private and uses it only to review your merge requests.