applications/gitlab

NOTE: The token used across all collectors needs at least the read_api scope. Some checks need more:

• Approval rules and audit events require a GitLab Premium or Ultimate subscription.
• Password policy reads instance application settings, which require an admin token on a self-hosted instance (not available on GitLab.com).

Checks that are unavailable are skipped with a warning; the rest still run.

audit.py — Unified GitLab Audit Tool

Runs all collectors against a GitLab group (including its subgroups) and writes a timestamped audit package to disk.

Setup

export GITLAB_TOKEN=your_token
export GITLAB_GROUP=your_group_id_or_path
# Self-hosted only:
export GITLAB_URL=https://gitlab.example.com/api/v4

Usage

# Basic run — uses GITLAB_TOKEN and GITLAB_GROUP from environment
python audit.py

# Override group, set output directory
python audit.py --group my-group --out ./output

# Point at a self-hosted instance
python audit.py --url https://gitlab.example.com/api/v4

The group may be a numeric ID (1234567) or a URL path (my-group/sub-group).

Output

Creates a directory: <out>/gitlab_audit_<group>_<YYYY-MM-DD>/

The per-project checks reuse a single enumeration of the group's projects, so the group is listed only once per run.