{"resources":{"gitlab":{"id":"gitlab","fields":{"group":{"name":"group","type":"\u001bgitlab.group","title":"GitLab Group","desc":"Namespace that owns projects, members, and subgroups, together with the security controls applied across them. Group-level settings include two-factor authentication enforcement, membership locking, restrictions on forking projects outside the group, allowed IP address ranges, and the default branch-protection policy inherited by new projects. Also queryable are the group's members and their roles, CI/CD variables inherited by every project, access and deploy tokens, webhooks, push rules, SAML group links, and audit events (the last two on Premium and Ultimate). Vulnerabilities, packages, and container registry repositories aggregate across the group and all of its subgroups.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"member":{"name":"member","type":"\u001bgitlab.member","title":"GitLab group or project membership","desc":"Membership record pairing a user account with the access level that governs what they can do in a group or project (Guest, Reporter, Developer, Maintainer, or Owner). Review memberships to find over-privileged accounts, stale grants past their expiration, or custom roles that elevate a member beyond their base access level. The `role` and `accessLevel` fields report the effective permission tier, `memberRole` resolves any custom role in effect, and `isUsingSeat` indicates whether the member consumes a billable seat.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"memberRole":{"name":"memberRole","type":"\u001bgitlab.memberRole","title":"GitLab custom member role","desc":"A custom role layered on a base access level that grants granular administrative permissions. Examine the permission flags to find roles that elevate holders beyond their base access level, such as a Reporter based role that can manage project access tokens or administer CI/CD variables. Select a role by `id` from a group's `memberRoles`.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"metadata":{"name":"metadata","type":"\u001bgitlab.metadata","title":"GitLab Instance Metadata","desc":"Version, revision, and edition of the GitLab instance under scan. The version is what a published advisory is matched against, and `enterprise` records whether the instance runs a licensed edition, which decides whether an empty result from a Premium or Ultimate only collection means the instance is clean or simply not licensed for the feature. Readable with any authenticated token, unlike gitlab.settings, which needs an administrator.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"namespace":{"name":"namespace","type":"\u001bgitlab.namespace","title":"GitLab Namespace","desc":"Container that scopes groups and user projects in GitLab. The `kind` field distinguishes group namespaces from user namespaces. Subscription fields (`plan`, `trial`, `trialEndsOn`, `maxSeatsUsed`, `seatsInUse`, `billableMembersCount`) reflect the GitLab.com plan attached to the namespace, and `membersCountWithDescendants` counts members across the namespace hierarchy.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"project":{"name":"project","type":"\u001bgitlab.project","title":"GitLab Project","desc":"A GitLab project: the repository together with its CI/CD configuration, feature toggles, and access controls. Projects hold source code, issues, merge requests, pipelines, and packages, so a project is the primary unit for auditing GitLab's security posture: who the code is visible to, whether merges require passing pipelines and resolved discussions, how branches and tags are protected, how approvals and push rules are enforced, and which members, access tokens, deploy keys, and integrations can reach the code. Computed collections also surface confirmed vulnerabilities, audit events, and container-registry and package protection rules. Select a project by its full path with namespace, for example `gitlab.project(fullPath: \"mondoohq/test-project\")`.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"protectedBranch":{"name":"protectedBranch","type":"\u001bgitlab.protectedBranch","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"settings":{"name":"settings","type":"\u001bgitlab.settings","title":"GitLab Instance Application Settings","desc":"Instance-wide security and configuration settings for a self-managed GitLab deployment, readable only with an admin token. These settings govern the whole instance rather than any single project or group, which makes them the primary control surface for hardening audits: two-factor enforcement and grace periods, web and Git password authentication, new-user registration and admin approval, sign-up domain allow/deny lists, password-complexity minimums, token and SSH key expiration enforcement, default project and group visibility, and SSRF-relevant toggles that let hooks and integrations reach the local network. It also covers the credential lifecycle policy (token expiry ceilings, runner token rotation, and the SSH key algorithms and sizes the instance will accept), sign-in hardening (lockout thresholds, concurrent sign-in IP limits, and whether users linked to an identity provider keep a local password fallback), the instance-wide CI job token allowlist enforcement, and the instance-scope CI/CD variables, system hooks, and OAuth applications registered on it.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"user":{"name":"user","type":"\u001bgitlab.user","title":"GitLab user","desc":"User account on a GitLab instance, keyed by numeric id (for example `gitlab.user(id: 42)`). Covers basic identity (username, name, email, avatar), account state (locked, bot, twoFactorEnabled), profile metadata (jobTitle, organization, location), linked SSO identities and SSH keys, and admin-scoped fields such as isAdmin, isAuditor, external, the sign-in and activity timestamps, and note. The admin-scoped fields require the calling token to be able to read `/users/:id`. With a non-admin token they return zero values rather than failing the resource graph, and a one-time warning is emitted at runtime when this fallback is hit.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true}},"is_extension":true},"gitlab.group":{"id":"gitlab.group","name":"gitlab.group","fields":{"accessRequest":{"name":"accessRequest","type":"\u001bgitlab.group.accessRequest","title":"GitLab group access request","desc":"Pending or resolved request to join the group. Requests sit in the queue until an owner acts on them, so `requestedAt` combined with a `state` of `pending` finds access decisions nobody has made. `accessLevel` is the level the requester asked for.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"accessRequests":{"name":"accessRequests","type":"\u0019\u001bgitlab.group.accessRequest","title":"Requests to join the group","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"accessToken":{"name":"accessToken","type":"\u001bgitlab.group.accessToken","title":"GitLab group access token","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"accessTokens":{"name":"accessTokens","type":"\u0019\u001bgitlab.group.accessToken","title":"Access tokens for the group","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"allowedEmailDomainsList":{"name":"allowedEmailDomainsList","type":"\u0007","is_mandatory":true,"title":"List of allowed email domains for the group","min_provider_version":"11.1.107","provider":"go.mondoo.com/mql/providers/gitlab"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"auditEvent":{"name":"auditEvent","type":"\u001bgitlab.group.auditEvent","title":"GitLab group audit event","desc":"Records a security-relevant action against the group. Available on Premium and Ultimate tiers via /groups/:id/audit_events.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"auditEvents":{"name":"auditEvents","type":"\u0019\u001bgitlab.group.auditEvent","title":"Audit events for the group (Premium/Ultimate)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"autoDevopsEnabled":{"name":"autoDevopsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Auto DevOps is enabled by default for projects in the group","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"containerRegistryRepositories":{"name":"containerRegistryRepositories","type":"\u0019\u001bgitlab.project.containerRegistryRepository","title":"Container registry repositories across all projects in the group and its subgroups","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Create date of the group","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"defaultBranchProtection":{"name":"defaultBranchProtection","type":"\n","is_mandatory":true,"title":"Default branch-protection policy inherited by new projects","desc":"A dict with allowForcePush, developerCanInitialPush, codeOwnerApprovalRequired, allowedToPush, and allowedToMerge keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"deployToken":{"name":"deployToken","type":"\u001bgitlab.group.deployToken","title":"GitLab group deploy token","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"deployTokens":{"name":"deployTokens","type":"\u0019\u001bgitlab.group.deployToken","title":"Deploy tokens for the group","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Group description","provider":"go.mondoo.com/mql/providers/gitlab"},"emailsEnabled":{"name":"emailsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether group email notifications are enabled","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"enterpriseAccessToken":{"name":"enterpriseAccessToken","type":"\u001bgitlab.group.enterpriseAccessToken","title":"GitLab enterprise user access token","desc":"Personal access token belonging to an enterprise user of the group. These tokens are created by individuals rather than by the group, so they sit outside the group's own token inventory while carrying the user's full permissions. `scopes` shows how much of the API the token reaches, `expiresAt` whether it ever lapses, and `lastUsedAt` whether it is still in service. The secret value itself is never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"enterpriseAccessTokens":{"name":"enterpriseAccessTokens","type":"\u0019\u001bgitlab.group.enterpriseAccessToken","title":"Personal access tokens held by enterprise users of the group","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"enterpriseSshKey":{"name":"enterpriseSshKey","type":"\u001bgitlab.group.enterpriseSshKey","title":"GitLab enterprise user SSH key","desc":"SSH key belonging to an enterprise user of the group, usable for Git access to every project the user can reach. `expiresAt` and `lastUsedAt` separate keys still in service from long-forgotten ones, and `usageType` records whether the key authenticates, signs, or both.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"enterpriseSshKeys":{"name":"enterpriseSshKeys","type":"\u0019\u001bgitlab.group.enterpriseSshKey","title":"SSH keys held by enterprise users of the group","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Complete group name including namespace","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"fullPath":{"name":"fullPath","type":"\u0007","is_mandatory":true,"title":"Complete URL path including parent groups","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Group ID","provider":"go.mondoo.com/mql/providers/gitlab"},"ipRestrictionRanges":{"name":"ipRestrictionRanges","type":"\u0007","is_mandatory":true,"title":"Allowed IP address ranges (CIDR) for accessing the group; empty when unrestricted","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"label":{"name":"label","type":"\u001bgitlab.group.label","title":"GitLab group label","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"labels":{"name":"labels","type":"\u0019\u001bgitlab.group.label","title":"List of labels for the group","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"ldapAccess":{"name":"ldapAccess","type":"\u0005","is_mandatory":true,"title":"Access level granted to members synced from the LDAP group","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"ldapCn":{"name":"ldapCn","type":"\u0007","is_mandatory":true,"title":"Common Name of the LDAP group synced to this group; empty when none","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"ldapGroupLinks":{"name":"ldapGroupLinks","type":"\u0019\n","is_mandatory":true,"title":"LDAP group links mapping directory groups to access levels","desc":"Each entry is a dict with cn, filter, provider, and groupAccess keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"lfsEnabled":{"name":"lfsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the group has Large File Storage (LFS) enabled","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"markedForDeletionOn":{"name":"markedForDeletionOn","type":"\t","is_mandatory":true,"title":"Date when the group is scheduled for deletion","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"memberRoles":{"name":"memberRoles","type":"\u0019\u001bgitlab.memberRole","title":"Custom member roles defined in the group","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"members":{"name":"members","type":"\u0019\u001bgitlab.member","title":"List of members in the group with their roles","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"membershipLock":{"name":"membershipLock","type":"\u0004","is_mandatory":true,"title":"Whether membership in the group is locked - members can only be added by administrators","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"mentionsDisabled":{"name":"mentionsDisabled","type":"\u0004","is_mandatory":true,"title":"Whether group mentions within issues and merge requests are disabled","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/gitlab"},"namespace":{"name":"namespace","type":"\u001bgitlab.namespace","title":"Namespace associated with this group","min_provider_version":"11.2.1","provider":"go.mondoo.com/mql/providers/gitlab"},"packages":{"name":"packages","type":"\u0019\u001bgitlab.project.package","title":"Packages published across all projects in the group and its subgroups","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"parentGroup":{"name":"parentGroup","type":"\u001bgitlab.group","title":"Parent group, or null when this is a top-level group","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Group path","provider":"go.mondoo.com/mql/providers/gitlab"},"preventForkingOutsideGroup":{"name":"preventForkingOutsideGroup","type":"\u0004","is_mandatory":true,"title":"Whether forking projects outside this group is forbidden","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"projectCreationLevel":{"name":"projectCreationLevel","type":"\u0007","is_mandatory":true,"title":"Minimum role that can create projects in the group (noone, maintainer, developer)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"projects":{"name":"projects","type":"\u0019\u001bgitlab.project","title":"List of all projects that belong to the group","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedBranch":{"name":"protectedBranch","type":"\u001bgitlab.group.protectedBranch","title":"GitLab group protected branch","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"protectedBranches":{"name":"protectedBranches","type":"\u0019\u001bgitlab.group.protectedBranch","title":"Protected branches at the group level","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"pushRule":{"name":"pushRule","type":"\u001bgitlab.group.pushRule","title":"GitLab group push rules","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"pushRules":{"name":"pushRules","type":"\u001bgitlab.group.pushRule","title":"Push rules for the group","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"requestAccessEnabled":{"name":"requestAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether users can request membership to the group","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"requireTwoFactorAuthentication":{"name":"requireTwoFactorAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether all users in this group are required to set up two-factor authentication","provider":"go.mondoo.com/mql/providers/gitlab"},"samlGroupLink":{"name":"samlGroupLink","type":"\u001bgitlab.group.samlGroupLink","title":"GitLab SAML group link","desc":"Maps an external SAML group/claim value to a GitLab access level. Available on Premium and Ultimate tiers via /groups/:id/saml_group_links.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"samlGroupLinks":{"name":"samlGroupLinks","type":"\u0019\u001bgitlab.group.samlGroupLink","title":"SAML group links mapping SAML claim values to group access levels (Premium/Ultimate)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"scimIdentities":{"name":"scimIdentities","type":"\u0019\u001bgitlab.group.scimIdentity","title":"Identity provider links for group members","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"scimIdentity":{"name":"scimIdentity","type":"\u001bgitlab.group.scimIdentity","title":"GitLab group SCIM identity","desc":"Link between a group member and the identity provider account that provisioned them. A member with no SCIM identity was created outside the identity provider and survives deprovisioning there, so comparing this list against the group's members finds accounts that offboarding will not reach. `active` reports whether the provider still considers the identity live.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"serviceAccount":{"name":"serviceAccount","type":"\u001bgitlab.group.serviceAccount","title":"GitLab group service account","desc":"Non-human identity created at group scope to run automation. Service accounts hold group membership like any other user but have no owner to notice a compromise, so `accessTokens` is the field that matters: it lists the credentials the account authenticates with, their scopes, and whether they expire.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bgitlab.group.serviceAccount","title":"Service accounts created at group scope","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"shareWithGroupLock":{"name":"shareWithGroupLock","type":"\u0004","is_mandatory":true,"title":"Whether sharing this group's projects with other groups is locked","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sharedRunnersSetting":{"name":"sharedRunnersSetting","type":"\u0007","is_mandatory":true,"title":"Shared-runner policy for the group (enabled, disabled_and_overridable, disabled_and_unoverridable)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sharedWithGroups":{"name":"sharedWithGroups","type":"\u0019\n","is_mandatory":true,"title":"Groups this group is shared with and their access levels","desc":"Each entry is a dict with groupId, groupName, groupFullPath, and groupAccessLevel keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sshCertificate":{"name":"sshCertificate","type":"\u001bgitlab.group.sshCertificate","title":"GitLab group SSH certificate authority","desc":"Public key of a certificate authority the group trusts to authenticate Git access. Anyone able to sign with the matching private key can reach the group's repositories without registering an individual SSH key, which makes the set of trusted authorities worth reviewing.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"sshCertificates":{"name":"sshCertificates","type":"\u0019\u001bgitlab.group.sshCertificate","title":"Certificate authorities trusted for SSH access to the group","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"subGroupCreationLevel":{"name":"subGroupCreationLevel","type":"\u0007","is_mandatory":true,"title":"Minimum role that can create subgroups in the group (owner, maintainer)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"subgroups":{"name":"subgroups","type":"\u0019\u001bgitlab.group","title":"List of subgroups that belong to this group","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"twoFactorGracePeriod":{"name":"twoFactorGracePeriod","type":"\u0005","is_mandatory":true,"title":"Time (in hours) users are allowed to skip forced 2FA configuration before being locked out","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"variable":{"name":"variable","type":"\u001bgitlab.group.variable","title":"GitLab group CI/CD variable","desc":"CI/CD variable defined at the group level. Group variables are inherited by every project in the group, so an unmasked or unprotected secret here is exposed to all of that group's pipelines. Use `masked` to find values printed in job logs and `protected` to find values available on unprotected branches.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"variables":{"name":"variables","type":"\u0019\u001bgitlab.group.variable","title":"CI/CD variables defined at the group level (inherited by every project in the group)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"visibility":{"name":"visibility","type":"\u0007","is_mandatory":true,"title":"The group's visibility level: private, internal, or public","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerabilities":{"name":"vulnerabilities","type":"\u0019\u001bgitlab.project.vulnerability","title":"Confirmed vulnerabilities across all projects in the group and its subgroups (Ultimate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"URL of the group","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"webhook":{"name":"webhook","type":"\u001bgitlab.group.webhook","title":"GitLab group webhook","desc":"Webhook registered at the group level. Group webhooks fire for events across every project in the group, making a misconfigured endpoint a broad data-egress and inbound-trigger surface. `sslVerification` reflects whether TLS certificates are validated (disabling it permits man-in-the- middle interception of payloads). The event flags show which categories of activity are forwarded.  Note: GitLab's API never returns the configured secret token in list/get responses (write-only field), so its presence cannot be exposed directly.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001bgitlab.group.webhook","title":"Webhooks registered at the group level","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"wikiAccessLevel":{"name":"wikiAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the group wiki (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab Group","desc":"Namespace that owns projects, members, and subgroups, together with the security controls applied across them. Group-level settings include two-factor authentication enforcement, membership locking, restrictions on forking projects outside the group, allowed IP address ranges, and the default branch-protection policy inherited by new projects. Also queryable are the group's members and their roles, CI/CD variables inherited by every project, access and deploy tokens, webhooks, push rules, SAML group links, and audit events (the last two on Premium and Ultimate). Vulnerabilities, packages, and container registry repositories aggregate across the group and all of its subgroups.","min_provider_version":"9.0.0","defaults":"name visibility webURL","provider":"go.mondoo.com/mql/providers/gitlab","root":true},"gitlab.group.accessRequest":{"id":"gitlab.group.accessRequest","name":"gitlab.group.accessRequest","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Access level requested","desc":"10 Guest, 15 Planner, 20 Reporter, 30 Developer, 40 Maintainer, or 50 Owner.","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the requesting account was created","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"User ID of the requester","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name of the requester","provider":"go.mondoo.com/mql/providers/gitlab"},"requestedAt":{"name":"requestedAt","type":"\t","is_mandatory":true,"title":"Time access was requested","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Where the request stands","desc":"One of `pending`, `approved`, or `denied`.","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User making the request","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username of the requester","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group access request","desc":"Pending or resolved request to join the group. Requests sit in the queue until an owner acts on them, so `requestedAt` combined with a `state` of `pending` finds access decisions nobody has made. `accessLevel` is the level the requester asked for.","private":true,"min_provider_version":"13.5.6","defaults":"username state requestedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.accessToken":{"id":"gitlab.group.accessToken","name":"gitlab.group.accessToken","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Access level granted by the token","provider":"go.mondoo.com/mql/providers/gitlab"},"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the token is active","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Token creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Token expiration date","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Last time the token was used","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Token scopes (api, read_api, read_repository, write_repository, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"Bot user the token authenticates as, or null when it cannot be resolved","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group access token","private":true,"min_provider_version":"11.1.138","defaults":"id name active expiresAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.auditEvent":{"id":"gitlab.group.auditEvent","name":"gitlab.group.auditEvent","fields":{"author":{"name":"author","type":"\u001bgitlab.user","title":"User who performed the action (null if the author cannot be resolved)","provider":"go.mondoo.com/mql/providers/gitlab"},"authorClass":{"name":"authorClass","type":"\u0007","is_mandatory":true,"title":"Class of the author (User, DeployToken, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"authorEmail":{"name":"authorEmail","type":"\u0007","is_mandatory":true,"title":"Email of the author","provider":"go.mondoo.com/mql/providers/gitlab"},"authorId":{"name":"authorId","type":"\u0005","is_mandatory":true,"title":"ID of the user who performed the action","provider":"go.mondoo.com/mql/providers/gitlab"},"authorName":{"name":"authorName","type":"\u0007","is_mandatory":true,"title":"Display name of the author","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the event occurred","provider":"go.mondoo.com/mql/providers/gitlab"},"customMessage":{"name":"customMessage","type":"\u0007","is_mandatory":true,"title":"Description of the change","provider":"go.mondoo.com/mql/providers/gitlab"},"entityGroup":{"name":"entityGroup","type":"\u001bgitlab.group","title":"Group entity targeted by this audit event when entityType is \"Group\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityId":{"name":"entityId","type":"\u0005","is_mandatory":true,"title":"ID of the entity the event applies to","provider":"go.mondoo.com/mql/providers/gitlab"},"entityPath":{"name":"entityPath","type":"\u0007","is_mandatory":true,"title":"Path of the entity within the group hierarchy","provider":"go.mondoo.com/mql/providers/gitlab"},"entityProject":{"name":"entityProject","type":"\u001bgitlab.project","title":"Project entity targeted by this audit event when entityType is \"Project\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityType":{"name":"entityType","type":"\u0007","is_mandatory":true,"title":"Entity type (Group, User, Project, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityUser":{"name":"entityUser","type":"\u001bgitlab.user","title":"User entity targeted by this audit event when entityType is \"User\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"eventName":{"name":"eventName","type":"\u0007","is_mandatory":true,"title":"Name of the event (e.g., user_added_to_group)","provider":"go.mondoo.com/mql/providers/gitlab"},"eventType":{"name":"eventType","type":"\u0007","is_mandatory":true,"title":"Event type","provider":"go.mondoo.com/mql/providers/gitlab"},"failedLogin":{"name":"failedLogin","type":"\u0007","is_mandatory":true,"title":"Login method reported on a failed sign-in event (for example STANDARD), empty for other event types","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Audit event ID","provider":"go.mondoo.com/mql/providers/gitlab"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IP address the action originated from","provider":"go.mondoo.com/mql/providers/gitlab"},"targetDetails":{"name":"targetDetails","type":"\u0007","is_mandatory":true,"title":"Target details","provider":"go.mondoo.com/mql/providers/gitlab"},"targetType":{"name":"targetType","type":"\u0007","is_mandatory":true,"title":"Type of the target object","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group audit event","desc":"Records a security-relevant action against the group. Available on Premium and Ultimate tiers via /groups/:id/audit_events.","private":true,"min_provider_version":"13.0.8","defaults":"id eventName createdAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.deployToken":{"id":"gitlab.group.deployToken","name":"gitlab.group.deployToken","fields":{"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the token has expired","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Token expiration time","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Deploy token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deploy token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Token scopes (read_repository, read_registry, write_registry, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Deploy token username","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group deploy token","private":true,"min_provider_version":"11.1.138","defaults":"id name expired revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.enterpriseAccessToken":{"id":"gitlab.group.enterpriseAccessToken","name":"gitlab.group.enterpriseAccessToken","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the token can currently authenticate","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the token was created","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable note recorded with the token","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the token expires","desc":"Null when the token never expires.","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the token was last used to authenticate","desc":"Null when the token has never been used.","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"API access the token grants","desc":"One or more of `api`, `read_api`, `read_user`, `read_repository`, `write_repository`, `read_registry`, `write_registry`, `create_runner`, `manage_runner`, `ai_features`, `k8s_proxy`, `self_rotate`, `read_service_ping`, and `sudo`.","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User the token authenticates as","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab enterprise user access token","desc":"Personal access token belonging to an enterprise user of the group. These tokens are created by individuals rather than by the group, so they sit outside the group's own token inventory while carrying the user's full permissions. `scopes` shows how much of the API the token reaches, `expiresAt` whether it ever lapses, and `lastUsedAt` whether it is still in service. The secret value itself is never exposed.","private":true,"min_provider_version":"13.5.6","defaults":"name active expiresAt lastUsedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.enterpriseSshKey":{"id":"gitlab.group.enterpriseSshKey","name":"gitlab.group.enterpriseSshKey","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the key was added","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the key expires","desc":"Null when the key never expires.","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the key was last used","desc":"Null when the key has never been used.","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Key title","provider":"go.mondoo.com/mql/providers/gitlab"},"usageType":{"name":"usageType","type":"\u0007","is_mandatory":true,"title":"What the key may be used for","desc":"One of `auth`, `signing`, or `auth_and_signing`.","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User the key belongs to","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab enterprise user SSH key","desc":"SSH key belonging to an enterprise user of the group, usable for Git access to every project the user can reach. `expiresAt` and `lastUsedAt` separate keys still in service from long-forgotten ones, and `usageType` records whether the key authenticates, signs, or both.","private":true,"min_provider_version":"13.5.6","defaults":"title expiresAt lastUsedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.label":{"id":"gitlab.group.label","name":"gitlab.group.label","fields":{"closedIssuesCount":{"name":"closedIssuesCount","type":"\u0005","is_mandatory":true,"title":"Count of closed issues with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"color":{"name":"color","type":"\u0007","is_mandatory":true,"title":"Label color (hex notation with leading '#')","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Label description","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Label ID","provider":"go.mondoo.com/mql/providers/gitlab"},"isProjectLabel":{"name":"isProjectLabel","type":"\u0004","is_mandatory":true,"title":"Whether this is a project label (vs. group label)","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Label name","provider":"go.mondoo.com/mql/providers/gitlab"},"openIssuesCount":{"name":"openIssuesCount","type":"\u0005","is_mandatory":true,"title":"Count of open issues with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"openMergeRequestsCount":{"name":"openMergeRequestsCount","type":"\u0005","is_mandatory":true,"title":"Count of open merge requests with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Label priority (higher priority labels appear first)","provider":"go.mondoo.com/mql/providers/gitlab"},"subscribed":{"name":"subscribed","type":"\u0004","is_mandatory":true,"title":"Whether the authenticated user is subscribed","provider":"go.mondoo.com/mql/providers/gitlab"},"textColor":{"name":"textColor","type":"\u0007","is_mandatory":true,"title":"Text color for label display","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group label","private":true,"min_provider_version":"11.1.129","defaults":"name color","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.protectedBranch":{"id":"gitlab.group.protectedBranch","name":"gitlab.group.protectedBranch","fields":{"allowForcePush":{"name":"allowForcePush","type":"\u0004","is_mandatory":true,"title":"Whether force push is allowed","provider":"go.mondoo.com/mql/providers/gitlab"},"codeOwnerApprovalRequired":{"name":"codeOwnerApprovalRequired","type":"\u0004","is_mandatory":true,"title":"Whether code owner approval is required","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Protected branch ID","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeAccessLevels":{"name":"mergeAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to merge into the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Branch name or pattern","provider":"go.mondoo.com/mql/providers/gitlab"},"pushAccessLevels":{"name":"pushAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to push directly to the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"unprotectAccessLevels":{"name":"unprotectAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to remove protection from the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group protected branch","private":true,"min_provider_version":"11.1.138","defaults":"name allowForcePush","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.pushRule":{"id":"gitlab.group.pushRule","name":"gitlab.group.pushRule","fields":{"authorEmailRegex":{"name":"authorEmailRegex","type":"\u0007","is_mandatory":true,"title":"Regex for allowed author emails","provider":"go.mondoo.com/mql/providers/gitlab"},"branchNameRegex":{"name":"branchNameRegex","type":"\u0007","is_mandatory":true,"title":"Regex for branch names","provider":"go.mondoo.com/mql/providers/gitlab"},"commitCommitterCheck":{"name":"commitCommitterCheck","type":"\u0004","is_mandatory":true,"title":"Whether the committer must be a verified GitLab user","provider":"go.mondoo.com/mql/providers/gitlab"},"commitCommitterNameCheck":{"name":"commitCommitterNameCheck","type":"\u0004","is_mandatory":true,"title":"Whether the committer name must match the GitLab user name","provider":"go.mondoo.com/mql/providers/gitlab"},"commitMessageNegativeRegex":{"name":"commitMessageNegativeRegex","type":"\u0007","is_mandatory":true,"title":"Regex for commit messages to reject","provider":"go.mondoo.com/mql/providers/gitlab"},"commitMessageRegex":{"name":"commitMessageRegex","type":"\u0007","is_mandatory":true,"title":"Regex for commit messages","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Push rule creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"denyDeleteTag":{"name":"denyDeleteTag","type":"\u0004","is_mandatory":true,"title":"Whether deleting tags is denied","provider":"go.mondoo.com/mql/providers/gitlab"},"fileNameRegex":{"name":"fileNameRegex","type":"\u0007","is_mandatory":true,"title":"Regex for disallowed file names","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Push rule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"maxFileSize":{"name":"maxFileSize","type":"\u0005","is_mandatory":true,"title":"Maximum allowed file size in MB","provider":"go.mondoo.com/mql/providers/gitlab"},"memberCheck":{"name":"memberCheck","type":"\u0004","is_mandatory":true,"title":"Whether commits must be from a group member","provider":"go.mondoo.com/mql/providers/gitlab"},"preventSecrets":{"name":"preventSecrets","type":"\u0004","is_mandatory":true,"title":"Whether known secrets are prevented from being pushed","provider":"go.mondoo.com/mql/providers/gitlab"},"rejectNonDCOCommits":{"name":"rejectNonDCOCommits","type":"\u0004","is_mandatory":true,"title":"Whether non-DCO commits are rejected","provider":"go.mondoo.com/mql/providers/gitlab"},"rejectUnsignedCommits":{"name":"rejectUnsignedCommits","type":"\u0004","is_mandatory":true,"title":"Whether unsigned commits are rejected","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group push rules","private":true,"min_provider_version":"11.1.138","defaults":"preventSecrets rejectUnsignedCommits commitCommitterCheck","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.samlGroupLink":{"id":"gitlab.group.samlGroupLink","name":"gitlab.group.samlGroupLink","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"GitLab access level granted (10=Guest, 20=Reporter, 30=Developer, 40=Maintainer, 50=Owner)","provider":"go.mondoo.com/mql/providers/gitlab"},"memberRoleId":{"name":"memberRoleId","type":"\u0005","is_mandatory":true,"title":"Member role ID for custom roles (0 if not used)","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the SAML group / claim value","provider":"go.mondoo.com/mql/providers/gitlab"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"SAML provider name (when using multiple providers)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab SAML group link","desc":"Maps an external SAML group/claim value to a GitLab access level. Available on Premium and Ultimate tiers via /groups/:id/saml_group_links.","private":true,"min_provider_version":"13.0.8","defaults":"name accessLevel provider","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.scimIdentity":{"id":"gitlab.group.scimIdentity","name":"gitlab.group.scimIdentity","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the identity provider still considers the identity active","provider":"go.mondoo.com/mql/providers/gitlab"},"externalUid":{"name":"externalUid","type":"\u0007","is_mandatory":true,"title":"Identifier the identity provider knows the user by","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"Group member the identity is linked to","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group SCIM identity","desc":"Link between a group member and the identity provider account that provisioned them. A member with no SCIM identity was created outside the identity provider and survives deprovisioning there, so comparing this list against the group's members finds accounts that offboarding will not reach. `active` reports whether the provider still considers the identity live.","private":true,"min_provider_version":"13.5.6","defaults":"externalUid active","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.serviceAccount":{"id":"gitlab.group.serviceAccount","name":"gitlab.group.serviceAccount","fields":{"accessTokens":{"name":"accessTokens","type":"\u0019\u001bgitlab.group.enterpriseAccessToken","title":"Access tokens issued to the service account","provider":"go.mondoo.com/mql/providers/gitlab"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address recorded for the account","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Service account user ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Account username","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group service account","desc":"Non-human identity created at group scope to run automation. Service accounts hold group membership like any other user but have no owner to notice a compromise, so `accessTokens` is the field that matters: it lists the credentials the account authenticates with, their scopes, and whether they expire.","private":true,"min_provider_version":"13.5.6","defaults":"username name","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.sshCertificate":{"id":"gitlab.group.sshCertificate","name":"gitlab.group.sshCertificate","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the certificate authority was added","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Certificate authority ID","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Public key of the certificate authority","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Certificate authority title","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group SSH certificate authority","desc":"Public key of a certificate authority the group trusts to authenticate Git access. Anyone able to sign with the matching private key can reach the group's repositories without registering an individual SSH key, which makes the set of trusted authorities worth reviewing.","private":true,"min_provider_version":"13.5.6","defaults":"title createdAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.variable":{"id":"gitlab.group.variable","name":"gitlab.group.variable","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Variable description","provider":"go.mondoo.com/mql/providers/gitlab"},"environmentScope":{"name":"environmentScope","type":"\u0007","is_mandatory":true,"title":"Environment scope for the variable","provider":"go.mondoo.com/mql/providers/gitlab"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the variable is hidden","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Variable key/name","provider":"go.mondoo.com/mql/providers/gitlab"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the variable value is masked in job logs","provider":"go.mondoo.com/mql/providers/gitlab"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the variable is protected (only available on protected branches/tags)","provider":"go.mondoo.com/mql/providers/gitlab"},"raw":{"name":"raw","type":"\u0004","is_mandatory":true,"title":"Whether the variable is raw (not expanded)","provider":"go.mondoo.com/mql/providers/gitlab"},"variableType":{"name":"variableType","type":"\u0007","is_mandatory":true,"title":"Variable type (env_var or file)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group CI/CD variable","desc":"CI/CD variable defined at the group level. Group variables are inherited by every project in the group, so an unmasked or unprotected secret here is exposed to all of that group's pipelines. Use `masked` to find values printed in job logs and `protected` to find values available on unprotected branches.","private":true,"min_provider_version":"13.4.2","defaults":"key masked protected","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.group.webhook":{"id":"gitlab.group.webhook","name":"gitlab.group.webhook","fields":{"alertStatus":{"name":"alertStatus","type":"\u0007","is_mandatory":true,"title":"Alert status of the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"branchFilterStrategy":{"name":"branchFilterStrategy","type":"\u0007","is_mandatory":true,"title":"Strategy used to filter branches for push events: all_branches, wildcard, or regex","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialIssuesEvents":{"name":"confidentialIssuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential issues events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialNoteEvents":{"name":"confidentialNoteEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential note events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Webhook creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"customHeaders":{"name":"customHeaders","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom HTTP headers sent with the webhook request (values may be redacted by GitLab)","provider":"go.mondoo.com/mql/providers/gitlab"},"customWebhookTemplate":{"name":"customWebhookTemplate","type":"\u0007","is_mandatory":true,"title":"Custom webhook payload template configured for this hook (empty when default payload is used)","provider":"go.mondoo.com/mql/providers/gitlab"},"deploymentEvents":{"name":"deploymentEvents","type":"\u0004","is_mandatory":true,"title":"Whether deployment events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Webhook description","provider":"go.mondoo.com/mql/providers/gitlab"},"emojiEvents":{"name":"emojiEvents","type":"\u0004","is_mandatory":true,"title":"Whether emoji events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"featureFlagEvents":{"name":"featureFlagEvents","type":"\u0004","is_mandatory":true,"title":"Whether feature flag events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"group":{"name":"group","type":"\u001bgitlab.group","title":"The group this webhook is registered against","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Webhook ID","provider":"go.mondoo.com/mql/providers/gitlab"},"issuesEvents":{"name":"issuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether issues events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"jobEvents":{"name":"jobEvents","type":"\u0004","is_mandatory":true,"title":"Whether job events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"memberEvents":{"name":"memberEvents","type":"\u0004","is_mandatory":true,"title":"Whether member events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsEvents":{"name":"mergeRequestsEvents","type":"\u0004","is_mandatory":true,"title":"Whether merge request events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"milestoneEvents":{"name":"milestoneEvents","type":"\u0004","is_mandatory":true,"title":"Whether milestone events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Webhook display name","provider":"go.mondoo.com/mql/providers/gitlab"},"noteEvents":{"name":"noteEvents","type":"\u0004","is_mandatory":true,"title":"Whether note (comment) events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelineEvents":{"name":"pipelineEvents","type":"\u0004","is_mandatory":true,"title":"Whether pipeline events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"projectEvents":{"name":"projectEvents","type":"\u0004","is_mandatory":true,"title":"Whether project events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEvents":{"name":"pushEvents","type":"\u0004","is_mandatory":true,"title":"Whether push events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEventsBranchFilter":{"name":"pushEventsBranchFilter","type":"\u0007","is_mandatory":true,"title":"Branch filter for push events","provider":"go.mondoo.com/mql/providers/gitlab"},"releasesEvents":{"name":"releasesEvents","type":"\u0004","is_mandatory":true,"title":"Whether release events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"repositoryUpdateEvents":{"name":"repositoryUpdateEvents","type":"\u0004","is_mandatory":true,"title":"Whether repository update events trigger the webhook","desc":"Always null. Group webhooks have no repository update trigger, and the GitLab API does not return this attribute for them. Read the same field on gitlab.project.webhook, where the trigger exists.","provider":"go.mondoo.com/mql/providers/gitlab","maturity":"deprecated"},"resourceAccessTokenEvents":{"name":"resourceAccessTokenEvents","type":"\u0004","is_mandatory":true,"title":"Whether resource access token events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"sslVerification":{"name":"sslVerification","type":"\u0004","is_mandatory":true,"title":"Whether SSL verification is enabled - disabling permits man-in-the-middle interception of webhook payloads","provider":"go.mondoo.com/mql/providers/gitlab"},"subGroupEvents":{"name":"subGroupEvents","type":"\u0004","is_mandatory":true,"title":"Whether subgroup events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"tagPushEvents":{"name":"tagPushEvents","type":"\u0004","is_mandatory":true,"title":"Whether tag push events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"tokenPresent":{"name":"tokenPresent","type":"\u0004","is_mandatory":true,"title":"Whether a secret token is configured on the webhook","desc":"The receiver uses that token to confirm a payload really came from GitLab. Without one, anything that learns the webhook URL can post a payload the receiver treats as genuine. The token value is write-only and is never returned. Null on instances that do not report token presence.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Webhook URL","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerabilityEvents":{"name":"vulnerabilityEvents","type":"\u0004","is_mandatory":true,"title":"Whether vulnerability events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"},"wikiPageEvents":{"name":"wikiPageEvents","type":"\u0004","is_mandatory":true,"title":"Whether wiki page events trigger the webhook","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group webhook","desc":"Webhook registered at the group level. Group webhooks fire for events across every project in the group, making a misconfigured endpoint a broad data-egress and inbound-trigger surface. `sslVerification` reflects whether TLS certificates are validated (disabling it permits man-in-the- middle interception of payloads). The event flags show which categories of activity are forwarded.  Note: GitLab's API never returns the configured secret token in list/get responses (write-only field), so its presence cannot be exposed directly.","private":true,"min_provider_version":"13.4.2","defaults":"url sslVerification","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.member":{"id":"gitlab.member","name":"gitlab.member","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Numeric access level backing the role","desc":"One of 0 No access, 5 Minimal Access, 10 Guest, 15 Planner, 20 Reporter, 30 Developer, 40 Maintainer, 50 Owner, or 60 Admin.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the membership was created","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"createdBy":{"name":"createdBy","type":"\u001bgitlab.user","title":"User who granted this membership, or null when GitLab does not report it","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"When the membership expires; null if it never expires","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Member ID","provider":"go.mondoo.com/mql/providers/gitlab"},"isUsingSeat":{"name":"isUsingSeat","type":"\u0004","is_mandatory":true,"title":"Whether this member consumes a billable seat","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"memberRole":{"name":"memberRole","type":"\u001bgitlab.memberRole","title":"Custom role assigned to this member, or null when the member holds only a standard role","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role name derived from the numeric access level","desc":"One of No access, Minimal Access, Guest, Planner, Reporter, Developer, Maintainer, Owner, or Admin. Unknown is reported for any access level the provider does not recognize.","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Membership state (for example active or awaiting)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","is_mandatory":true,"title":"User associated with this membership","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab group or project membership","desc":"Membership record pairing a user account with the access level that governs what they can do in a group or project (Guest, Reporter, Developer, Maintainer, or Owner). Review memberships to find over-privileged accounts, stale grants past their expiration, or custom roles that elevate a member beyond their base access level. The `role` and `accessLevel` fields report the effective permission tier, `memberRole` resolves any custom role in effect, and `isUsingSeat` indicates whether the member consumes a billable seat.","private":true,"min_provider_version":"11.1.129","defaults":"user role","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.memberRole":{"id":"gitlab.memberRole","name":"gitlab.memberRole","fields":{"adminCicdVariables":{"name":"adminCicdVariables","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer CI/CD variables","provider":"go.mondoo.com/mql/providers/gitlab"},"adminComplianceFramework":{"name":"adminComplianceFramework","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer compliance frameworks","provider":"go.mondoo.com/mql/providers/gitlab"},"adminGroupMembers":{"name":"adminGroupMembers","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer group members","provider":"go.mondoo.com/mql/providers/gitlab"},"adminMergeRequests":{"name":"adminMergeRequests","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer merge requests","provider":"go.mondoo.com/mql/providers/gitlab"},"adminPushRules":{"name":"adminPushRules","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer push rules","provider":"go.mondoo.com/mql/providers/gitlab"},"adminTerraformState":{"name":"adminTerraformState","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer Terraform state","provider":"go.mondoo.com/mql/providers/gitlab"},"adminVulnerability":{"name":"adminVulnerability","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer vulnerabilities","provider":"go.mondoo.com/mql/providers/gitlab"},"adminWebHook":{"name":"adminWebHook","type":"\u0004","is_mandatory":true,"title":"Whether the role can administer webhooks","provider":"go.mondoo.com/mql/providers/gitlab"},"archiveProject":{"name":"archiveProject","type":"\u0004","is_mandatory":true,"title":"Whether the role can archive projects","provider":"go.mondoo.com/mql/providers/gitlab"},"baseAccessLevel":{"name":"baseAccessLevel","type":"\u0005","is_mandatory":true,"title":"Base access level the custom permissions are layered onto (10 Guest, 20 Reporter, 30 Developer, 40 Maintainer, 50 Owner)","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the role","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Member role ID","provider":"go.mondoo.com/mql/providers/gitlab"},"manageDeployTokens":{"name":"manageDeployTokens","type":"\u0004","is_mandatory":true,"title":"Whether the role can manage deploy tokens","provider":"go.mondoo.com/mql/providers/gitlab"},"manageGroupAccessTokens":{"name":"manageGroupAccessTokens","type":"\u0004","is_mandatory":true,"title":"Whether the role can manage group access tokens","provider":"go.mondoo.com/mql/providers/gitlab"},"manageMergeRequestSettings":{"name":"manageMergeRequestSettings","type":"\u0004","is_mandatory":true,"title":"Whether the role can manage merge request settings","provider":"go.mondoo.com/mql/providers/gitlab"},"manageProjectAccessTokens":{"name":"manageProjectAccessTokens","type":"\u0004","is_mandatory":true,"title":"Whether the role can manage project access tokens","provider":"go.mondoo.com/mql/providers/gitlab"},"manageSecurityPolicyLink":{"name":"manageSecurityPolicyLink","type":"\u0004","is_mandatory":true,"title":"Whether the role can manage security policy links","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the role","provider":"go.mondoo.com/mql/providers/gitlab"},"readCode":{"name":"readCode","type":"\u0004","is_mandatory":true,"title":"Whether the role can read repository code","provider":"go.mondoo.com/mql/providers/gitlab"},"readDependency":{"name":"readDependency","type":"\u0004","is_mandatory":true,"title":"Whether the role can read dependency information","provider":"go.mondoo.com/mql/providers/gitlab"},"readRunners":{"name":"readRunners","type":"\u0004","is_mandatory":true,"title":"Whether the role can view runners","provider":"go.mondoo.com/mql/providers/gitlab"},"readVulnerability":{"name":"readVulnerability","type":"\u0004","is_mandatory":true,"title":"Whether the role can read vulnerability information","provider":"go.mondoo.com/mql/providers/gitlab"},"removeGroup":{"name":"removeGroup","type":"\u0004","is_mandatory":true,"title":"Whether the role can remove groups","provider":"go.mondoo.com/mql/providers/gitlab"},"removeProject":{"name":"removeProject","type":"\u0004","is_mandatory":true,"title":"Whether the role can remove projects","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab custom member role","desc":"A custom role layered on a base access level that grants granular administrative permissions. Examine the permission flags to find roles that elevate holders beyond their base access level, such as a Reporter based role that can manage project access tokens or administer CI/CD variables. Select a role by `id` from a group's `memberRoles`.","private":true,"min_provider_version":"13.3.9","defaults":"name baseAccessLevel","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.metadata":{"id":"gitlab.metadata","name":"gitlab.metadata","fields":{"enterprise":{"name":"enterprise","type":"\u0004","is_mandatory":true,"title":"Whether the instance runs a licensed Enterprise Edition build","desc":"False means Community Edition, where Premium and Ultimate features are absent rather than merely unconfigured.","provider":"go.mondoo.com/mql/providers/gitlab"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Revision of the build the instance runs","provider":"go.mondoo.com/mql/providers/gitlab"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"GitLab version the instance runs","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab Instance Metadata","desc":"Version, revision, and edition of the GitLab instance under scan. The version is what a published advisory is matched against, and `enterprise` records whether the instance runs a licensed edition, which decides whether an empty result from a Premium or Ultimate only collection means the instance is clean or simply not licensed for the feature. Readable with any authenticated token, unlike gitlab.settings, which needs an administrator.","min_provider_version":"13.6.2","defaults":"version enterprise","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.namespace":{"id":"gitlab.namespace","name":"gitlab.namespace","fields":{"billableMembersCount":{"name":"billableMembersCount","type":"\u0005","is_mandatory":true,"title":"Number of billable members","provider":"go.mondoo.com/mql/providers/gitlab"},"fullPath":{"name":"fullPath","type":"\u0007","is_mandatory":true,"title":"Full URL path","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Namespace ID","provider":"go.mondoo.com/mql/providers/gitlab"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Namespace kind (group or user)","provider":"go.mondoo.com/mql/providers/gitlab"},"maxSeatsUsed":{"name":"maxSeatsUsed","type":"\u0005","is_mandatory":true,"title":"Maximum seats used","provider":"go.mondoo.com/mql/providers/gitlab"},"membersCountWithDescendants":{"name":"membersCountWithDescendants","type":"\u0005","is_mandatory":true,"title":"Number of members including descendants","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Namespace name","provider":"go.mondoo.com/mql/providers/gitlab"},"parentId":{"name":"parentId","type":"\u0005","is_mandatory":true,"title":"Parent namespace ID","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Namespace path","provider":"go.mondoo.com/mql/providers/gitlab"},"plan":{"name":"plan","type":"\u0007","is_mandatory":true,"title":"Subscription plan (free, premium, ultimate)","provider":"go.mondoo.com/mql/providers/gitlab"},"seatsInUse":{"name":"seatsInUse","type":"\u0005","is_mandatory":true,"title":"Seats currently in use","provider":"go.mondoo.com/mql/providers/gitlab"},"trial":{"name":"trial","type":"\u0004","is_mandatory":true,"title":"Whether the namespace is on a trial","provider":"go.mondoo.com/mql/providers/gitlab"},"trialEndsOn":{"name":"trialEndsOn","type":"\t","is_mandatory":true,"title":"Trial end date","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Web URL","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab Namespace","desc":"Container that scopes groups and user projects in GitLab. The `kind` field distinguishes group namespaces from user namespaces. Subscription fields (`plan`, `trial`, `trialEndsOn`, `maxSeatsUsed`, `seatsInUse`, `billableMembersCount`) reflect the GitLab.com plan attached to the namespace, and `membersCountWithDescendants` counts members across the namespace hierarchy.","min_provider_version":"11.2.1","defaults":"name kind plan","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project":{"id":"gitlab.project","name":"gitlab.project","fields":{"accessRequest":{"name":"accessRequest","type":"\u001bgitlab.project.accessRequest","title":"GitLab project access request","desc":"Pending or resolved request to join the project, with the same meaning as its group counterpart: a `state` of `pending` alongside an old `requestedAt` marks an access decision nobody has made.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"accessRequests":{"name":"accessRequests","type":"\u0019\u001bgitlab.project.accessRequest","title":"Requests to join the project","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"accessToken":{"name":"accessToken","type":"\u001bgitlab.project.accessToken","title":"GitLab project access token","desc":"Project-scoped credential that authenticates automation and CI/CD workloads as a dedicated bot user rather than a human account. Review these tokens to catch over-privileged scopes, tokens that never expire, revoked-but-lingering credentials, and tokens that have not been used in a long time. The `scopes` and `accessLevel` fields together define what a token can do, `expiresAt` and `lastUsedAt` gauge exposure over time, and `revoked` and `active` report whether it can still be used.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"accessTokens":{"name":"accessTokens","type":"\u0019\u001bgitlab.project.accessToken","title":"Access tokens for the project","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"allowMergeOnSkippedPipeline":{"name":"allowMergeOnSkippedPipeline","type":"\u0004","is_mandatory":true,"title":"Whether merging merge requests is allowed when a pipeline is skipped","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"approvalRule":{"name":"approvalRule","type":"\u001bgitlab.project.approvalRule","title":"GitLab project approval rule","desc":"A single approval rule that gates merging into the project. The rule's `ruleType` distinguishes `any_approver` (any user with write access can approve), `regular` (a defined list of users and/or groups), `code_owner` (the relevant CODEOWNERS entries must approve), and `report_approver` (a security or license-scanning report must pass, with `reportType` narrowing this further to `license_scanning`, `code_coverage`, or `scan_finding`). `approvalsRequired` is the number of approvals the rule demands. The `users`, `eligibleApprovers`, `groups`, and `protectedBranches` accessors resolve the approvers and the branches the rule applies to. `appliesToAllProtectedBranches` is true when the rule covers every protected branch on the project rather than a named subset. `containsHiddenGroups` flags rules that reference groups the caller cannot see.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"approvalRules":{"name":"approvalRules","type":"\u0019\u001bgitlab.project.approvalRule","title":"Approval rules for the project","min_provider_version":"11.1.12","provider":"go.mondoo.com/mql/providers/gitlab"},"approvalSetting":{"name":"approvalSetting","type":"\u001bgitlab.project.approvalSetting","title":"Merge-request approval settings for a GitLab project","desc":"The project's approval-enforcement configuration: how many approvals a merge request needs before it can merge, whether those approvals are reset when new commits are pushed, and who is trusted to grant them. The boolean controls surface common weakenings of code review, such as authors or committers approving their own changes (mergeRequestsAuthorApproval, mergeRequestsDisableCommittersApproval), reviewers overriding the configured approvers per merge request (disableOverridingApproversPerMergeRequest), and whether a password is required to approve (requirePasswordToApprove). The approvers and approverGroups lists name the users and groups configured as default approvers on the project.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"approvalSettings":{"name":"approvalSettings","type":"\u001bgitlab.project.approvalSetting","title":"Approval settings for the project","min_provider_version":"11.1.15","provider":"go.mondoo.com/mql/providers/gitlab"},"archived":{"name":"archived","type":"\u0004","is_mandatory":true,"title":"Whether the project is archived","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"auditEvent":{"name":"auditEvent","type":"\u001bgitlab.project.auditEvent","title":"GitLab project audit event","desc":"Security-relevant action recorded against the project, such as a member being added or removed, a deploy token created, or a protected-branch setting changed. Available on Premium and Ultimate tiers through the project audit events API. Useful for change tracking and forensic investigation of who did what, when, and from which IP address.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"auditEvents":{"name":"auditEvents","type":"\u0019\u001bgitlab.project.auditEvent","title":"Audit events recorded for the project (Premium/Ultimate)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"autoDevopsEnabled":{"name":"autoDevopsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Auto DevOps feature is enabled","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"autoDuoCodeReviewEnabled":{"name":"autoDuoCodeReviewEnabled","type":"\u0004","is_mandatory":true,"title":"Whether GitLab Duo automatically reviews merge requests","desc":"Reads false when the project's GitLab instance does not support or has not enabled Duo.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"autocloseReferencedIssues":{"name":"autocloseReferencedIssues","type":"\u0004","is_mandatory":true,"title":"Whether the project has autoclose referenced issues enabled","min_provider_version":"11.1.107","provider":"go.mondoo.com/mql/providers/gitlab"},"buildsAccessLevel":{"name":"buildsAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the CI/CD builds feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"ciAllowForkPipelinesToRunInParentProject":{"name":"ciAllowForkPipelinesToRunInParentProject","type":"\u0004","title":"Whether pipelines for a merge request from a fork run in this project","desc":"True lets a merge request opened from an untrusted fork execute in this project's CI context, where it reaches the project's protected variables and runners. Null when the token cannot read the project's CI/CD settings.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ciIdTokenSubClaimComponents":{"name":"ciIdTokenSubClaimComponents","type":"\u0019\u0007","title":"Components that make up the subject claim of the CI/CD ID token","desc":"GitLab mints an OIDC token for each job whose subject claim is built from these components, and a cloud trust policy grants access by matching on it. The default set is project_path, ref_type, and ref. Adding components narrows what a pipeline of this project can assume, and removing them widens it. Null when the token cannot read the project's CI/CD settings.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ciJobTokenScopeEnabled":{"name":"ciJobTokenScopeEnabled","type":"\u0004","is_mandatory":true,"title":"Whether CI job tokens are scoped to an allowlist of projects","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"clusterAgent":{"name":"clusterAgent","type":"\u001bgitlab.project.clusterAgent","title":"GitLab agent for Kubernetes","desc":"Registration that connects a Kubernetes cluster to the project, letting CI jobs and GitOps workflows act against that cluster. An agent is a path from source control into a running cluster, so `configProject` (the project holding the agent configuration, which decides which other projects may use the agent) and `tokens` (the credentials the in-cluster agent authenticates with) are the fields that establish who can reach the cluster.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"clusterAgents":{"name":"clusterAgents","type":"\u0019\u001bgitlab.project.clusterAgent","title":"Kubernetes clusters connected to the project","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"codeowners":{"name":"codeowners","type":"\u001bgitlab.project.codeowners","title":"CODEOWNERS file resolved from the default branch (use `present` to detect a missing file)","provider":"go.mondoo.com/mql/providers/gitlab"},"complianceFrameworks":{"name":"complianceFrameworks","type":"\u0019\u0007","is_mandatory":true,"title":"Compliance frameworks applied to the project","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"containerExpirationPolicy":{"name":"containerExpirationPolicy","type":"\u001bgitlab.project.containerExpirationPolicy","title":"Tag-retention policy for the project's container registry","provider":"go.mondoo.com/mql/providers/gitlab"},"containerRegistryAccessLevel":{"name":"containerRegistryAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the container registry feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"containerRegistryProtectionRule":{"name":"containerRegistryProtectionRule","type":"\u001bgitlab.project.containerRegistryProtectionRule","title":"Container registry protection rule","desc":"Push and delete protection for container repositories whose path matches `repositoryPathPattern`. The two minimum-access-level fields enforce who in the project can perform each action: one of `maintainer`, `owner`, or `admin`. An empty value means the action is not protected.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"containerRegistryProtectionRules":{"name":"containerRegistryProtectionRules","type":"\u0019\u001bgitlab.project.containerRegistryProtectionRule","title":"Container registry protection rules gating who can push and delete repositories","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"containerRegistryRepositories":{"name":"containerRegistryRepositories","type":"\u0019\u001bgitlab.project.containerRegistryRepository","title":"Container registry repositories published from the project","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"containerRegistryRepository":{"name":"containerRegistryRepository","type":"\u001bgitlab.project.containerRegistryRepository","title":"Container registry repository in a GitLab project","desc":"Docker or OCI image repository published to the project's container registry. Each repository carries `name`, `path` (the pull path prefix), and `location` (the full pull URL). `tagsCount` is a fast snapshot; iterate `tags` for the full list of pushed tags with digests and sizes for tag-pinning and vulnerability-correlation audits. `cleanupPolicyStartedAt` shows when the project's `containerExpirationPolicy` last ran against this repository. `status` is empty for healthy repositories or one of `delete_scheduled`, `delete_ongoing`, or `delete_failed` when a delete is in flight.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Create date of the project","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"defaultBranch":{"name":"defaultBranch","type":"\u0007","is_mandatory":true,"title":"Default Git branch","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"deployKey":{"name":"deployKey","type":"\u001bgitlab.project.deployKey","title":"GitLab project deploy key","desc":"SSH public key that grants a machine or automation access to a project's repository without a user account. Deploy keys are a common supply-chain exposure: `canPush` reports whether the key has write access (not just read), `key` is the raw public key material, `fingerprint` and `fingerprintSHA256` identify it, and `expiresAt` shows whether the key ever stops being valid. Audit these to find long-lived or push-capable keys that widen the project's attack surface.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"deployKeys":{"name":"deployKeys","type":"\u0019\u001bgitlab.project.deployKey","title":"Deploy keys for the project","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"deployToken":{"name":"deployToken","type":"\u001bgitlab.project.deployToken","title":"GitLab project deploy token","desc":"Long-lived credential scoped to a single project that grants clients (CI runners, external systems) read or write access to the project's Git repository and its container and package registries. Auditing deploy tokens surfaces standing credentials that bypass user authentication: check `expired` and `revoked` to find inactive entries and `scopes` to confirm each token is limited to the access it actually needs.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"deployTokens":{"name":"deployTokens","type":"\u0019\u001bgitlab.project.deployToken","title":"Deploy tokens for the project","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Project description","provider":"go.mondoo.com/mql/providers/gitlab"},"emailsEnabled":{"name":"emailsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether project email notifications are enabled","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"emptyRepo":{"name":"emptyRepo","type":"\u0004","is_mandatory":true,"title":"Whether the repo is empty","min_provider_version":"11.1.36","provider":"go.mondoo.com/mql/providers/gitlab"},"file":{"name":"file","type":"\u001bgitlab.project.file","title":"GitLab project repository file","desc":"File tracked in a GitLab project's repository, listed recursively from the project's default branch. Reading `content` returns the decoded file text, which lets you audit tracked files for committed secrets, credentials, or insecure configuration. The `path` field is the file's full path within the repository and serves as the selection key.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"forkedFromProject":{"name":"forkedFromProject","type":"\u001bgitlab.project","title":"Project this project was forked from, or null when it is not a fork","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"forkingAccessLevel":{"name":"forkingAccessLevel","type":"\u0007","is_mandatory":true,"title":"Who can fork the project (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"forksCount":{"name":"forksCount","type":"\u0005","is_mandatory":true,"title":"Number of project forks","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"The full name of the project, including the namespace","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"fullPath":{"name":"fullPath","type":"\u0007","is_mandatory":true,"title":"Path with namespace","desc":"Full path including the namespace (e.g., `mondoohq/test-project`), used as the project's stable identifier across GitLab APIs.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"groupRunnersEnabled":{"name":"groupRunnersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the project is enabled for group runners","min_provider_version":"11.1.36","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Project ID","provider":"go.mondoo.com/mql/providers/gitlab"},"integration":{"name":"integration","type":"\u001bgitlab.project.integration","title":"GitLab project integration","desc":"External service wired into a project, such as Slack, Jira, or a generic webhook-style service. The `slug` field identifies the integration type and the per-event boolean flags show which project events are forwarded to the service. Because integrations push project activity outward and can accept inbound triggers, they are a data-egress and inbound-trigger surface worth auditing.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"integrations":{"name":"integrations","type":"\u0019\u001bgitlab.project.integration","title":"Active integrations (external services) configured for the project","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"issue":{"name":"issue","type":"\u001bgitlab.project.issue","title":"GitLab project issue","desc":"Single issue tracked in a project, exposing its state, author, labels, milestone, and due date. The confidential flag marks issues restricted to project members, and state distinguishes opened from closed work. Useful for auditing unresolved confidential reports or stale open items, and for confirming that sensitive issues stay marked confidential.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"issues":{"name":"issues","type":"\u0019\u001bgitlab.project.issue","title":"List of issues for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"issuesAccessLevel":{"name":"issuesAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the issues feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"jobTokenScope":{"name":"jobTokenScope","type":"\u001bgitlab.project.jobTokenScope","title":"CI/CD job-token access scope for the project","provider":"go.mondoo.com/mql/providers/gitlab"},"label":{"name":"label","type":"\u001bgitlab.project.label","title":"GitLab project label","desc":"Label defined on a GitLab project, used to categorize and triage issues and merge requests. Fields cover the label's display appearance (color, textColor), its description, and the counts of open and closed issues and open merge requests carrying the label, which help audit how labels are applied across a project. The priority field orders labels within the project, and isProjectLabel distinguishes a label scoped to this project from a group label inherited across the group's projects.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"labels":{"name":"labels","type":"\u0019\u001bgitlab.project.label","title":"List of labels for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"lastActivityAt":{"name":"lastActivityAt","type":"\t","is_mandatory":true,"title":"Last activity timestamp for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"lfsEnabled":{"name":"lfsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the project has LFS enabled","min_provider_version":"11.1.107","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeMethod":{"name":"mergeMethod","type":"\u0007","title":"Merge methods for the project","min_provider_version":"11.1.12","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequest":{"name":"mergeRequest","type":"\u001bgitlab.project.mergeRequest","title":"GitLab project merge request","desc":"Proposed set of changes from a source branch into a target branch, identified by internalId (the project-scoped merge request number). Merge requests are where code review and merge gating happen, so they are central to auditing change control: state and detailedMergeStatus show whether a change merged and whether it satisfied gating rules, blockingDiscussionsResolved and reviewers reveal review coverage, and mergeWhenPipelineSucceeds, forceRemoveSourceBranch, and allowMaintainerToPush expose the merge automation and source-branch settings in effect. The author, mergeUser, and closedBy accessors attribute who opened, merged, and closed each request.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"mergeRequests":{"name":"mergeRequests","type":"\u0019\u001bgitlab.project.mergeRequest","title":"List of merge requests for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsAccessLevel":{"name":"mergeRequestsAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the merge requests feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"milestone":{"name":"milestone","type":"\u001bgitlab.project.milestone","title":"GitLab project milestone","desc":"Milestone defined on a GitLab project, used to group issues and merge requests toward a shared goal or release. Tracks the milestone title, description, and scheduling window (startDate and dueDate), along with its state (active or closed) and whether it has passed its due date (expired). The internalId is the project-scoped number shown in the GitLab UI, while id is the globally unique identifier.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"milestones":{"name":"milestones","type":"\u0019\u001bgitlab.project.milestone","title":"List of milestones for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"mirror":{"name":"mirror","type":"\u0004","is_mandatory":true,"title":"Whether the project is a mirror","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"mirrorTriggerBuilds":{"name":"mirrorTriggerBuilds","type":"\u0004","is_mandatory":true,"title":"Whether mirrored branches trigger CI pipelines","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"modelExperimentsAccessLevel":{"name":"modelExperimentsAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the machine-learning model experiments feature","desc":"One of disabled, private, or enabled; empty on instances that do not report it.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"modelRegistryAccessLevel":{"name":"modelRegistryAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the machine-learning model registry feature","desc":"One of disabled, private, or enabled; empty on instances that do not report it.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Project name","provider":"go.mondoo.com/mql/providers/gitlab"},"onlyAllowMergeIfAllDiscussionsAreResolved":{"name":"onlyAllowMergeIfAllDiscussionsAreResolved","type":"\u0004","is_mandatory":true,"title":"Whether merging merge requests is allowed only if all discussions are resolved","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"onlyAllowMergeIfPipelineSucceeds":{"name":"onlyAllowMergeIfPipelineSucceeds","type":"\u0004","is_mandatory":true,"title":"Whether merging merge requests is allowed only if the pipelines succeed","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"onlyMirrorProtectedBranches":{"name":"onlyMirrorProtectedBranches","type":"\u0004","is_mandatory":true,"title":"Whether mirroring is limited to protected branches","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"package":{"name":"package","type":"\u001bgitlab.project.package","title":"Package published to a GitLab project's package registry","desc":"Single package version in the project's package registry. `packageType` distinguishes the package format (`maven`, `npm`, `conan`, `nuget`, `pypi`, `composer`, `generic`, `golang`, `debian`, `helm`, `terraform_module`, `rubygems`, `ml_model`) and `status` its lifecycle state (`default`, `hidden`, `processing`, `error`, `pending_destruction`). Auditing the registry reveals what artifacts a project publishes; `files` holds the contained artifacts with their SHA-256/SHA-1/MD5 checksums for tamper detection.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"packageProtectionRule":{"name":"packageProtectionRule","type":"\u001bgitlab.project.packageProtectionRule","title":"Package protection rule","desc":"Access control that gates pushes and deletes against packages whose name matches `packageNamePattern` (with the format restricted to `packageType`). The two minimum-access-level fields enforce who can perform each action: one of `developer`, `maintainer`, `owner`, or `admin`. An empty value means the action is not protected.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"packageProtectionRules":{"name":"packageProtectionRules","type":"\u0019\u001bgitlab.project.packageProtectionRule","title":"Package protection rules gating who can push and delete packages","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"packages":{"name":"packages","type":"\u0019\u001bgitlab.project.package","title":"Packages published to the project's package registry","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"packagesEnabled":{"name":"packagesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the packages feature is enabled","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Project path","provider":"go.mondoo.com/mql/providers/gitlab"},"pipeline":{"name":"pipeline","type":"\u001bgitlab.project.pipeline","title":"GitLab CI/CD pipeline","desc":"A single CI/CD pipeline run for the project, covering how it was triggered and how it finished. The `status` field reports the run's outcome (success, failed, canceled, and so on) and `source` records what kicked it off (a push, a schedule, an API call, a merge request event). The `ref`, `sha`, and `user` fields tie the run to the branch or tag, commit, and account behind it, while `yamlErrors` surfaces invalid .gitlab-ci.yml configuration and `coverage` reports the measured test coverage. Useful for auditing build provenance, failed or skipped runs, and who is able to trigger pipelines.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"pipelineSchedule":{"name":"pipelineSchedule","type":"\u001bgitlab.project.pipelineSchedule","title":"GitLab pipeline schedule","desc":"Recurring pipeline run configured on the project, executing `ref` on the `cron` cadence with the permissions of `owner`. Schedules persist independently of the repository contents, so one created by an attacker keeps running after the offending commit is reverted. `variables` lists the names and types of the CI/CD variables the schedule injects into each run without revealing their values, and the `lastPipeline` fields report the outcome of the most recent execution.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"pipelineSchedules":{"name":"pipelineSchedules","type":"\u0019\u001bgitlab.project.pipelineSchedule","title":"Recurring pipeline runs and the variables they inject","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelineTrigger":{"name":"pipelineTrigger","type":"\u001bgitlab.project.pipelineTrigger","title":"GitLab pipeline trigger token","desc":"Standing credential that lets an external caller start a pipeline on the project over the API. Trigger tokens carry no expiration, so a token created for a one-off integration keeps working indefinitely unless it is deleted. `lastUsedAt` distinguishes tokens still in service from dormant ones that should be removed, `owner` names the user whose permissions the triggered pipeline inherits, and `createdAt` shows how long the credential has been outstanding. The secret value itself is never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"pipelineTriggers":{"name":"pipelineTriggers","type":"\u0019\u001bgitlab.project.pipelineTrigger","title":"Trigger tokens that let external callers start pipelines","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelines":{"name":"pipelines","type":"\u0019\u001bgitlab.project.pipeline","title":"List of CI/CD pipelines for the project","min_provider_version":"11.1.130","provider":"go.mondoo.com/mql/providers/gitlab"},"preReceiveSecretDetectionEnabled":{"name":"preReceiveSecretDetectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether server-side secret push protection is enabled","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"projectFiles":{"name":"projectFiles","type":"\u0019\u001bgitlab.project.file","title":"List of files in the project repository","min_provider_version":"11.1.13","provider":"go.mondoo.com/mql/providers/gitlab"},"projectMembers":{"name":"projectMembers","type":"\u0019\u001bgitlab.member","title":"List of members in the project with their roles","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedBranch":{"name":"protectedBranch","type":"\u001bgitlab.project.protectedBranch","title":"GitLab protected branch","desc":"Branch protection rules for a project, controlling who can push, merge, and remove protection on a given branch. Auditing these settings verifies that critical branches (such as the default branch) enforce review and prevent unauthorized or force pushes. Each branch is identified by `name`, and `pushAccessLevels`, `mergeAccessLevels`, and `unprotectAccessLevels` spell out exactly which roles, users, groups, or deploy keys hold each permission. The `allowForcePush` and `codeOwnerApproval` flags capture whether history-rewriting pushes are permitted and whether Code Owner sign-off is required before merging.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"protectedBranches":{"name":"protectedBranches","type":"\u0019\u001bgitlab.project.protectedBranch","title":"Protected branches settings for the project","min_provider_version":"11.1.12","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedEnvironment":{"name":"protectedEnvironment","type":"\u001bgitlab.project.protectedEnvironment","title":"GitLab protected environment","desc":"Deployment gates guarding a protected environment (such as production). The `name` field selects the environment or wildcard pattern it covers, for example `production` or `review/*`. `deployAccessLevels` restricts who may deploy, `requiredApprovalCount` sets how many approvals a deployment needs, and `approvalRules` names the approver groups and users. Weak or missing gates on a production environment let unreviewed changes reach it.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"protectedEnvironments":{"name":"protectedEnvironments","type":"\u0019\u001bgitlab.project.protectedEnvironment","title":"Protected environments and their deploy/approval gates","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedTag":{"name":"protectedTag","type":"\u001bgitlab.project.protectedTag","title":"GitLab protected tag","desc":"Protected tag rule and the access levels permitted to create tags matching it, so you can audit who can cut release tags on the project. The `name` is the tag name or wildcard pattern (for example `v*`). `createAccessLevels` lists each role, user, group, or deploy key allowed to create the tag.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"protectedTags":{"name":"protectedTags","type":"\u0019\u001bgitlab.project.protectedTag","title":"Protected tags and who may create them","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"publicJobs":{"name":"publicJobs","type":"\u0004","is_mandatory":true,"title":"Whether job logs and artifacts are visible to non-members","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"pushRule":{"name":"pushRule","type":"\u001bgitlab.project.pushRule","title":"GitLab project push rules","desc":"Server-side constraints GitLab enforces on every push to a project's repository. Push rules govern commit message formats, branch naming, author and committer identity, file names and sizes, secret-leak prevention, and commit-signature requirements. Query this to audit whether a project blocks known secrets (preventSecrets), rejects unsigned commits (rejectUnsignedCommits), and restricts commits to verified GitLab users (commitCommitterCheck).","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"pushRules":{"name":"pushRules","type":"\u001bgitlab.project.pushRule","title":"Push rules for the project","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"release":{"name":"release","type":"\u001bgitlab.project.release","title":"GitLab project release","desc":"A published or scheduled release of a project, keyed by its Git tag. Releases mark shippable versions and carry the release notes, the commit they point at, the downloadable assets (source archives and attached links), and any collected evidence. Use it to audit what was shipped, verify that releases reference the expected commits, and check release evidence for supply-chain integrity. The upcomingRelease field distinguishes scheduled-but-unpublished releases from live ones.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"releases":{"name":"releases","type":"\u0019\u001bgitlab.project.release","title":"List of releases for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"remoteMirror":{"name":"remoteMirror","type":"\u001bgitlab.project.remoteMirror","title":"GitLab project push mirror","desc":"Continuous replication of the project's repository to an external Git host. A push mirror moves source code out of GitLab on every update, so `url` records the destination the code is being sent to and `authMethod` how the mirror authenticates there. `onlyProtectedBranches` narrows what is replicated, and `keepDivergentRefs` decides whether the remote keeps refs that have diverged locally. GitLab redacts any password embedded in `url`.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"remoteMirrors":{"name":"remoteMirrors","type":"\u0019\u001bgitlab.project.remoteMirror","title":"Push mirrors replicating the repository to external Git hosts","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"removeSourceBranchAfterMerge":{"name":"removeSourceBranchAfterMerge","type":"\u0004","is_mandatory":true,"title":"Whether the merge request source brand is removed after merge","min_provider_version":"11.1.107","provider":"go.mondoo.com/mql/providers/gitlab"},"repositoryAccessLevel":{"name":"repositoryAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the repository (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"requirementsEnabled":{"name":"requirementsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the requirements feature is enabled","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"runner":{"name":"runner","type":"\u001bgitlab.project.runner","title":"GitLab CI/CD runner","desc":"CI/CD runner registered for a GitLab project  GitLab Runner that executes CI/CD jobs for the project, covering project-specific runners as well as shared instance or group runners visible to the project. Beyond inventory (type, paused, shared, online, status), it exposes security-relevant settings used to audit job exposure: whether the runner picks up untagged jobs, whether it is locked to its associated projects, and the access level governing whether it may run on non-protected refs. Use it to find untagged shared-runner exposure, runners that are not restricted to protected refs, and stale runners that have not checked in.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"runners":{"name":"runners","type":"\u0019\u001bgitlab.project.runner","title":"List of runners available to the project","min_provider_version":"11.1.130","provider":"go.mondoo.com/mql/providers/gitlab"},"secureFile":{"name":"secureFile","type":"\u001bgitlab.project.secureFile","title":"GitLab project secure file","desc":"Certificate, keystore, or provisioning profile stored in the project and mounted into CI jobs at run time. Secure files hold signing material that outlives any single pipeline, so `expiresAt` and the certificate fields matter for spotting credentials that are about to lapse or that were issued by an unexpected authority. `checksum` and `checksumAlgorithm` pin the exact bytes GitLab is serving to jobs.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"secureFiles":{"name":"secureFiles","type":"\u0019\u001bgitlab.project.secureFile","title":"Certificates and keystores mounted into CI jobs","min_provider_version":"13.5.6","provider":"go.mondoo.com/mql/providers/gitlab"},"securityAndComplianceAccessLevel":{"name":"securityAndComplianceAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the Security \u0026 Compliance feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"securityAndComplianceEnabled":{"name":"securityAndComplianceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Security \u0026 Compliance feature is enabled","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"securitySetting":{"name":"securitySetting","type":"\u001bgitlab.project.securitySetting","title":"GitLab project security settings","desc":"Project-level toggles that govern GitLab's built-in security scanning and remediation features. `secretPushProtectionEnabled` blocks commits that contain detected secrets before they reach the repository, and `continuousVulnerabilityScansEnabled` re-scans existing dependencies as new advisories are published. The `autoFix*` flags control whether GitLab opens automatic merge requests to remediate findings from SAST, DAST, dependency scanning, and container scanning, and `containerScanningForRegistryEnabled` extends container scanning to images already stored in the project's registry. Audit these to confirm a project enforces the scanning coverage its compliance policy expects. Most fields require a GitLab tier that includes the corresponding scanner.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"securitySettings":{"name":"securitySettings","type":"\u001bgitlab.project.securitySetting","title":"Security settings for the project","min_provider_version":"11.1.138","provider":"go.mondoo.com/mql/providers/gitlab"},"serviceDeskEnabled":{"name":"serviceDeskEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Service Desk feature is enabled","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"sharedRunnersEnabled":{"name":"sharedRunnersEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the project is enabled for shared runners","min_provider_version":"11.1.36","provider":"go.mondoo.com/mql/providers/gitlab"},"sharedWithGroups":{"name":"sharedWithGroups","type":"\u0019\n","is_mandatory":true,"title":"Groups the project is shared with and their access levels","desc":"Each entry is a dict with groupId, groupName, groupFullPath, and groupAccessLevel keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"snippetsAccessLevel":{"name":"snippetsAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the snippets feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"starCount":{"name":"starCount","type":"\u0005","is_mandatory":true,"title":"Number of project stars","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"variable":{"name":"variable","type":"\u001bgitlab.project.variable","title":"GitLab project CI/CD variable","desc":"A single CI/CD variable exposed to a project's pipelines, holding a key/value pair that jobs read as an environment variable or file. These variables frequently carry secrets (deploy tokens, cloud credentials, API keys), so they are a common audit target: `masked` reports whether the value is hidden in job logs, `protected` restricts it to jobs on protected branches and tags, and `environmentScope` limits which deployment environments can use it. A variable is identified by its `key` together with its `environmentScope`, so the same key can exist with different values per environment.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"variables":{"name":"variables","type":"\u0019\u001bgitlab.project.variable","title":"List of CI/CD variables for the project","min_provider_version":"11.1.129","provider":"go.mondoo.com/mql/providers/gitlab"},"visibility":{"name":"visibility","type":"\u0007","is_mandatory":true,"title":"The project's visibility level: private, internal, or public","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerabilities":{"name":"vulnerabilities","type":"\u0019\u001bgitlab.project.vulnerability","title":"Confirmed vulnerabilities across all scanners (Ultimate)","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerability":{"name":"vulnerability","type":"\u001bgitlab.project.vulnerability","title":"Security scanner finding from a GitLab project","desc":"Confirmed vulnerabilities surfaced by GitLab's built-in security scanners: SAST, DAST, dependency scanning, secret detection, and container scanning. Filter by `severity`, `state`, or `reportType` to drive audit queries: open CRITICAL findings, undismissed secrets in commits, or unresolved CVEs in dependencies. Use `scanner` to attribute a finding to the tool that produced it and `identifiers` to look up the corresponding CVE, CWE, or OWASP entry.  Requires GitLab Ultimate; on lower tiers the resource returns an empty list.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"vulnerabilityCountsBySeverity":{"name":"vulnerabilityCountsBySeverity","type":"\u001a\u0007\u0005","title":"Counts of confirmed vulnerabilities by severity","desc":"Keyed by CRITICAL, HIGH, MEDIUM, LOW, INFO, and UNKNOWN.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"URL of the project","min_provider_version":"9.0.1","provider":"go.mondoo.com/mql/providers/gitlab"},"webhook":{"name":"webhook","type":"\u001bgitlab.project.webhook","title":"GitLab project webhook","desc":"HTTP callback registered against a project that GitLab invokes to deliver event payloads to an external endpoint whenever selected activity occurs, such as pushes, merge requests, or pipeline runs. Audit webhooks to confirm payloads reach only trusted destinations over a verified TLS connection: url is the delivery target and sslVerification reports whether the receiver's certificate is validated. The per-event boolean fields (pushEvents, mergeRequestsEvents, pipelineEvents, and the rest) show which activity is sent to that endpoint. The configured secret token is never returned by the API, so its presence cannot be read here; confirm token configuration through the GitLab UI or audit logs.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001bgitlab.project.webhook","title":"List of webhooks for the project","min_provider_version":"11.1.13","provider":"go.mondoo.com/mql/providers/gitlab"},"wikiAccessLevel":{"name":"wikiAccessLevel","type":"\u0007","is_mandatory":true,"title":"Visibility of the wiki feature (disabled, private, enabled)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab Project","desc":"A GitLab project: the repository together with its CI/CD configuration, feature toggles, and access controls. Projects hold source code, issues, merge requests, pipelines, and packages, so a project is the primary unit for auditing GitLab's security posture: who the code is visible to, whether merges require passing pipelines and resolved discussions, how branches and tags are protected, how approvals and push rules are enforced, and which members, access tokens, deploy keys, and integrations can reach the code. Computed collections also surface confirmed vulnerabilities, audit events, and container-registry and package protection rules. Select a project by its full path with namespace, for example `gitlab.project(fullPath: \"mondoohq/test-project\")`.","min_provider_version":"9.0.0","defaults":"fullName visibility webURL","provider":"go.mondoo.com/mql/providers/gitlab","root":true},"gitlab.project.accessRequest":{"id":"gitlab.project.accessRequest","name":"gitlab.project.accessRequest","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Access level requested","desc":"10 Guest, 15 Planner, 20 Reporter, 30 Developer, 40 Maintainer, or 50 Owner.","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the requesting account was created","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"User ID of the requester","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name of the requester","provider":"go.mondoo.com/mql/providers/gitlab"},"requestedAt":{"name":"requestedAt","type":"\t","is_mandatory":true,"title":"Time access was requested","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Where the request stands","desc":"One of `pending`, `approved`, or `denied`.","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User making the request","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username of the requester","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project access request","desc":"Pending or resolved request to join the project, with the same meaning as its group counterpart: a `state` of `pending` alongside an old `requestedAt` marks an access decision nobody has made.","private":true,"min_provider_version":"13.5.6","defaults":"username state requestedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.accessToken":{"id":"gitlab.project.accessToken","name":"gitlab.project.accessToken","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Access level granted by the token","desc":"Numeric GitLab membership level the token acts with: 10 (Guest), 20 (Reporter), 30 (Developer), 40 (Maintainer), or 50 (Owner). Higher values grant broader project permissions.","provider":"go.mondoo.com/mql/providers/gitlab"},"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the token is active","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Token creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Token expiration date","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Last time the token was used","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Token scopes (api, read_api, read_repository, write_repository, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"Bot user the token authenticates as, or null when it cannot be resolved","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project access token","desc":"Project-scoped credential that authenticates automation and CI/CD workloads as a dedicated bot user rather than a human account. Review these tokens to catch over-privileged scopes, tokens that never expire, revoked-but-lingering credentials, and tokens that have not been used in a long time. The `scopes` and `accessLevel` fields together define what a token can do, `expiresAt` and `lastUsedAt` gauge exposure over time, and `revoked` and `active` report whether it can still be used.","private":true,"min_provider_version":"11.1.138","defaults":"id name active expiresAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.approvalRule":{"id":"gitlab.project.approvalRule","name":"gitlab.project.approvalRule","fields":{"appliesToAllProtectedBranches":{"name":"appliesToAllProtectedBranches","type":"\u0004","is_mandatory":true,"title":"Whether the rule applies to all protected branches","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"approvalsRequired":{"name":"approvalsRequired","type":"\u0005","is_mandatory":true,"title":"Number of approvals required","provider":"go.mondoo.com/mql/providers/gitlab"},"containsHiddenGroups":{"name":"containsHiddenGroups","type":"\u0004","is_mandatory":true,"title":"Whether the rule references groups the caller cannot see","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"eligibleApprovers":{"name":"eligibleApprovers","type":"\u0019\u001bgitlab.user","is_mandatory":true,"title":"All eligible approvers (named users plus the members of each linked group)","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"groups":{"name":"groups","type":"\u0019\n","is_mandatory":true,"title":"Groups whose members are eligible approvers","desc":"Each entry exposes the group's `id`, `name`, `fullPath`, `visibility`, and `description`.","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule name","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedBranches":{"name":"protectedBranches","type":"\u0019\u001bgitlab.project.protectedBranch","is_mandatory":true,"title":"Protected branches the rule applies to","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"reportType":{"name":"reportType","type":"\u0007","is_mandatory":true,"title":"Report type for report_approver rules","desc":"One of license_scanning, code_coverage, or scan_finding. Empty for non-report rules.","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"ruleType":{"name":"ruleType","type":"\u0007","is_mandatory":true,"title":"Rule type","desc":"One of any_approver, regular, code_owner, or report_approver.","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"users":{"name":"users","type":"\u0019\u001bgitlab.user","is_mandatory":true,"title":"Named users explicitly designated as approvers","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project approval rule","desc":"A single approval rule that gates merging into the project. The rule's `ruleType` distinguishes `any_approver` (any user with write access can approve), `regular` (a defined list of users and/or groups), `code_owner` (the relevant CODEOWNERS entries must approve), and `report_approver` (a security or license-scanning report must pass, with `reportType` narrowing this further to `license_scanning`, `code_coverage`, or `scan_finding`). `approvalsRequired` is the number of approvals the rule demands. The `users`, `eligibleApprovers`, `groups`, and `protectedBranches` accessors resolve the approvers and the branches the rule applies to. `appliesToAllProtectedBranches` is true when the rule covers every protected branch on the project rather than a named subset. `containsHiddenGroups` flags rules that reference groups the caller cannot see.","private":true,"min_provider_version":"11.1.12","defaults":"name ruleType approvalsRequired","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.approvalSetting":{"id":"gitlab.project.approvalSetting","name":"gitlab.project.approvalSetting","fields":{"approvalsBeforeMerge":{"name":"approvalsBeforeMerge","type":"\u0005","is_mandatory":true,"title":"Number of approvals before merge","provider":"go.mondoo.com/mql/providers/gitlab"},"approverGroups":{"name":"approverGroups","type":"\u0019\u001bgitlab.group","is_mandatory":true,"title":"Groups configured as default approvers on the project","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"approvers":{"name":"approvers","type":"\u0019\u001bgitlab.user","is_mandatory":true,"title":"Users configured as default approvers on the project","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"disableOverridingApproversPerMergeRequest":{"name":"disableOverridingApproversPerMergeRequest","type":"\u0004","is_mandatory":true,"title":"Whether users are prevented from overriding an approver per merge request","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsAuthorApproval":{"name":"mergeRequestsAuthorApproval","type":"\u0004","is_mandatory":true,"title":"Whether author of merge request can approve","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsDisableCommittersApproval":{"name":"mergeRequestsDisableCommittersApproval","type":"\u0004","is_mandatory":true,"title":"Whether users are prevented from overriding a committer's approval for merge request","provider":"go.mondoo.com/mql/providers/gitlab"},"requirePasswordToApprove":{"name":"requirePasswordToApprove","type":"\u0004","is_mandatory":true,"title":"Whether a password is required to approve","provider":"go.mondoo.com/mql/providers/gitlab"},"resetApprovalsOnPush":{"name":"resetApprovalsOnPush","type":"\u0004","is_mandatory":true,"title":"Whether all approvals are removed when new commits are pushed","provider":"go.mondoo.com/mql/providers/gitlab"},"selectiveCodeOwnerRemovals":{"name":"selectiveCodeOwnerRemovals","type":"\u0004","is_mandatory":true,"title":"Whether approvals are reset from Code Owners if their files changed","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Merge-request approval settings for a GitLab project","desc":"The project's approval-enforcement configuration: how many approvals a merge request needs before it can merge, whether those approvals are reset when new commits are pushed, and who is trusted to grant them. The boolean controls surface common weakenings of code review, such as authors or committers approving their own changes (mergeRequestsAuthorApproval, mergeRequestsDisableCommittersApproval), reviewers overriding the configured approvers per merge request (disableOverridingApproversPerMergeRequest), and whether a password is required to approve (requirePasswordToApprove). The approvers and approverGroups lists name the users and groups configured as default approvers on the project.","private":true,"min_provider_version":"11.1.15","defaults":"approvalsBeforeMerge requirePasswordToApprove","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.auditEvent":{"id":"gitlab.project.auditEvent","name":"gitlab.project.auditEvent","fields":{"author":{"name":"author","type":"\u001bgitlab.user","title":"User who performed the action (null if the author cannot be resolved)","provider":"go.mondoo.com/mql/providers/gitlab"},"authorClass":{"name":"authorClass","type":"\u0007","is_mandatory":true,"title":"Class of the author (User, DeployToken, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"authorEmail":{"name":"authorEmail","type":"\u0007","is_mandatory":true,"title":"Email of the author","provider":"go.mondoo.com/mql/providers/gitlab"},"authorId":{"name":"authorId","type":"\u0005","is_mandatory":true,"title":"ID of the user who performed the action","provider":"go.mondoo.com/mql/providers/gitlab"},"authorName":{"name":"authorName","type":"\u0007","is_mandatory":true,"title":"Display name of the author","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the event occurred","provider":"go.mondoo.com/mql/providers/gitlab"},"customMessage":{"name":"customMessage","type":"\u0007","is_mandatory":true,"title":"Description of the change","provider":"go.mondoo.com/mql/providers/gitlab"},"entityGroup":{"name":"entityGroup","type":"\u001bgitlab.group","title":"Group entity targeted by this audit event when entityType is \"Group\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityId":{"name":"entityId","type":"\u0005","is_mandatory":true,"title":"ID of the entity the event applies to","provider":"go.mondoo.com/mql/providers/gitlab"},"entityPath":{"name":"entityPath","type":"\u0007","is_mandatory":true,"title":"Path of the entity the event applies to","provider":"go.mondoo.com/mql/providers/gitlab"},"entityProject":{"name":"entityProject","type":"\u001bgitlab.project","title":"Project entity targeted by this audit event when entityType is \"Project\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityType":{"name":"entityType","type":"\u0007","is_mandatory":true,"title":"Entity type (Project, User, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"entityUser":{"name":"entityUser","type":"\u001bgitlab.user","title":"User entity targeted by this audit event when entityType is \"User\" (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"eventName":{"name":"eventName","type":"\u0007","is_mandatory":true,"title":"Name of the event (e.g., project_deploy_token_created)","provider":"go.mondoo.com/mql/providers/gitlab"},"eventType":{"name":"eventType","type":"\u0007","is_mandatory":true,"title":"Event type","provider":"go.mondoo.com/mql/providers/gitlab"},"failedLogin":{"name":"failedLogin","type":"\u0007","is_mandatory":true,"title":"Login method reported on a failed sign-in event (for example STANDARD), empty for other event types","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Audit event ID","provider":"go.mondoo.com/mql/providers/gitlab"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"IP address the action originated from","provider":"go.mondoo.com/mql/providers/gitlab"},"targetDetails":{"name":"targetDetails","type":"\u0007","is_mandatory":true,"title":"Target details","provider":"go.mondoo.com/mql/providers/gitlab"},"targetType":{"name":"targetType","type":"\u0007","is_mandatory":true,"title":"Type of the target object","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project audit event","desc":"Security-relevant action recorded against the project, such as a member being added or removed, a deploy token created, or a protected-branch setting changed. Available on Premium and Ultimate tiers through the project audit events API. Useful for change tracking and forensic investigation of who did what, when, and from which IP address.","private":true,"min_provider_version":"13.3.9","defaults":"id eventName createdAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.clusterAgent":{"id":"gitlab.project.clusterAgent","name":"gitlab.project.clusterAgent","fields":{"configProject":{"name":"configProject","type":"\u001bgitlab.project","title":"Project holding the agent configuration","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the agent was registered","provider":"go.mondoo.com/mql/providers/gitlab"},"createdBy":{"name":"createdBy","type":"\u001bgitlab.user","title":"User who registered the agent","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Agent ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Agent name","provider":"go.mondoo.com/mql/providers/gitlab"},"token":{"name":"token","type":"\u001bgitlab.project.clusterAgent.token","title":"GitLab agent for Kubernetes token","desc":"Credential an in-cluster agent presents to authenticate back to GitLab. Tokens remain listed after revocation, so `status` separates live credentials from retired ones, and `lastUsedAt` identifies active tokens that were provisioned but never connected. The secret value itself is never exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"tokens":{"name":"tokens","type":"\u0019\u001bgitlab.project.clusterAgent.token","title":"Credentials the in-cluster agent authenticates with","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab agent for Kubernetes","desc":"Registration that connects a Kubernetes cluster to the project, letting CI jobs and GitOps workflows act against that cluster. An agent is a path from source control into a running cluster, so `configProject` (the project holding the agent configuration, which decides which other projects may use the agent) and `tokens` (the credentials the in-cluster agent authenticates with) are the fields that establish who can reach the cluster.","private":true,"min_provider_version":"13.5.6","defaults":"id name","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.clusterAgent.token":{"id":"gitlab.project.clusterAgent.token","name":"gitlab.project.clusterAgent.token","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the token was created","provider":"go.mondoo.com/mql/providers/gitlab"},"createdBy":{"name":"createdBy","type":"\u001bgitlab.user","title":"User who created the token","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable note recorded with the token","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Agent token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the token last authenticated to GitLab","desc":"Null when the token has never been used.","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/gitlab"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the token is live","desc":"Either `active` or `revoked`.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab agent for Kubernetes token","desc":"Credential an in-cluster agent presents to authenticate back to GitLab. Tokens remain listed after revocation, so `status` separates live credentials from retired ones, and `lastUsedAt` identifies active tokens that were provisioned but never connected. The secret value itself is never exposed.","private":true,"min_provider_version":"13.5.6","defaults":"id name status lastUsedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.codeowners":{"id":"gitlab.project.codeowners","name":"gitlab.project.codeowners","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Raw file content (empty when `present` is false)","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Repository path the file was loaded from (e.g. \"CODEOWNERS\", \".gitlab/CODEOWNERS\", \"docs/CODEOWNERS\"); empty when `present` is false","provider":"go.mondoo.com/mql/providers/gitlab"},"present":{"name":"present","type":"\u0004","is_mandatory":true,"title":"Whether a CODEOWNERS file exists on the default branch","provider":"go.mondoo.com/mql/providers/gitlab"},"rule":{"name":"rule","type":"\u001bgitlab.project.codeowners.rule","title":"GitLab CODEOWNERS rule","desc":"Single rule extracted from a CODEOWNERS file. The `pattern` is the path glob the rule applies to; `owners` lists the user/group identifiers (with the leading `@` preserved); `section` carries the name of the `[Section]` header the rule appears under (empty for rules outside any section); `required` is true when the section was declared as `[Section]` (without a leading `^`); `optional` is true when the section was declared as `^[Section]`. The `approvalsRequired` field captures the section-level override (e.g. `[Section][2]`); it is 0 when no override is set. The `lineNumber` is preserved so audit reports can cite the file location.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bgitlab.project.codeowners.rule","is_mandatory":true,"title":"Parsed rules in the order they appear in the file","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project CODEOWNERS file","desc":"CODEOWNERS file for a project, resolved from the default branch in this order: `CODEOWNERS`, `.gitlab/CODEOWNERS`, `docs/CODEOWNERS`. The `present` flag reports whether any CODEOWNERS file exists at all, `path` gives the location it was found at, `content` is the raw text, and `rules` holds the parsed entries. Use this to audit code-review coverage gaps (paths with no required owners), section overrides (`[Section][Approvals=N]`), and any `^` optional sections that weaken default required-review enforcement.","private":true,"min_provider_version":"13.2.3","defaults":"path present","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.codeowners.rule":{"id":"gitlab.project.codeowners.rule","name":"gitlab.project.codeowners.rule","fields":{"approvalsRequired":{"name":"approvalsRequired","type":"\u0005","is_mandatory":true,"title":"Section-level override of the number of required approvals; 0 when no override is set","provider":"go.mondoo.com/mql/providers/gitlab"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number of the rule within the file (1-indexed)","provider":"go.mondoo.com/mql/providers/gitlab"},"optional":{"name":"optional","type":"\u0004","is_mandatory":true,"title":"Whether the parent section is `^[Section]` (optional review)","provider":"go.mondoo.com/mql/providers/gitlab"},"owners":{"name":"owners","type":"\u0019\u0007","is_mandatory":true,"title":"Owners listed for the pattern (usernames prefixed with `@`, group paths prefixed with `@@`, or email addresses)","provider":"go.mondoo.com/mql/providers/gitlab"},"pattern":{"name":"pattern","type":"\u0007","is_mandatory":true,"title":"Path glob the rule applies to (e.g. \"*\", \"/db/\", \"/frontend/**/*.tsx\")","provider":"go.mondoo.com/mql/providers/gitlab"},"required":{"name":"required","type":"\u0004","is_mandatory":true,"title":"Whether the parent section enforces required review (the default, `[Section]`)","provider":"go.mondoo.com/mql/providers/gitlab"},"section":{"name":"section","type":"\u0007","is_mandatory":true,"title":"Section header the rule belongs to (empty for top-level rules)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab CODEOWNERS rule","desc":"Single rule extracted from a CODEOWNERS file. The `pattern` is the path glob the rule applies to; `owners` lists the user/group identifiers (with the leading `@` preserved); `section` carries the name of the `[Section]` header the rule appears under (empty for rules outside any section); `required` is true when the section was declared as `[Section]` (without a leading `^`); `optional` is true when the section was declared as `^[Section]`. The `approvalsRequired` field captures the section-level override (e.g. `[Section][2]`); it is 0 when no override is set. The `lineNumber` is preserved so audit reports can cite the file location.","private":true,"min_provider_version":"13.2.3","defaults":"pattern owners section","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.containerExpirationPolicy":{"id":"gitlab.project.containerExpirationPolicy","name":"gitlab.project.containerExpirationPolicy","fields":{"cadence":{"name":"cadence","type":"\u0007","is_mandatory":true,"title":"How often the policy runs","desc":"One of `1d`, `7d`, `14d`, `1month`, or `3month`.","provider":"go.mondoo.com/mql/providers/gitlab"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is active","provider":"go.mondoo.com/mql/providers/gitlab"},"keepN":{"name":"keepN","type":"\u0005","is_mandatory":true,"title":"Number of tags per repository to keep regardless of age","provider":"go.mondoo.com/mql/providers/gitlab"},"nameRegexDelete":{"name":"nameRegexDelete","type":"\u0007","is_mandatory":true,"title":"Regex matching tag names eligible for deletion","provider":"go.mondoo.com/mql/providers/gitlab"},"nameRegexKeep":{"name":"nameRegexKeep","type":"\u0007","is_mandatory":true,"title":"Regex matching tag names to always preserve","provider":"go.mondoo.com/mql/providers/gitlab"},"nextRunAt":{"name":"nextRunAt","type":"\t","is_mandatory":true,"title":"Next scheduled run","provider":"go.mondoo.com/mql/providers/gitlab"},"olderThan":{"name":"olderThan","type":"\u0007","is_mandatory":true,"title":"Minimum age before a tag becomes eligible for deletion","desc":"One of `7d`, `14d`, `30d`, `60d`, or `90d`.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Container registry expiration (cleanup) policy","desc":"Cleanup policy that trims old tags from the project's container registry. The policy runs on a `cadence` and deletes tags older than `olderThan` whose names match `nameRegexDelete`, keeping at most `keepN` per repository and always preserving names matching `nameRegexKeep`. `enabled` reflects whether the policy is active; `nextRunAt` is the next scheduled run.","private":true,"min_provider_version":"13.3.1","defaults":"enabled cadence keepN olderThan","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.containerRegistryProtectionRule":{"id":"gitlab.project.containerRegistryProtectionRule","name":"gitlab.project.containerRegistryProtectionRule","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"minimumAccessLevelForDelete":{"name":"minimumAccessLevelForDelete","type":"\u0007","is_mandatory":true,"title":"Minimum project access level required to delete matching repositories","desc":"One of `maintainer`, `owner`, or `admin`; empty when delete is unprotected.","provider":"go.mondoo.com/mql/providers/gitlab"},"minimumAccessLevelForPush":{"name":"minimumAccessLevelForPush","type":"\u0007","is_mandatory":true,"title":"Minimum project access level required to push matching repositories","desc":"One of `maintainer`, `owner`, or `admin`; empty when push is unprotected.","provider":"go.mondoo.com/mql/providers/gitlab"},"repositoryPathPattern":{"name":"repositoryPathPattern","type":"\u0007","is_mandatory":true,"title":"Glob pattern matched against `\u003cproject_path\u003e/\u003crepository_name\u003e`","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Container registry protection rule","desc":"Push and delete protection for container repositories whose path matches `repositoryPathPattern`. The two minimum-access-level fields enforce who in the project can perform each action: one of `maintainer`, `owner`, or `admin`. An empty value means the action is not protected.","private":true,"min_provider_version":"13.3.1","defaults":"repositoryPathPattern minimumAccessLevelForPush minimumAccessLevelForDelete","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.containerRegistryRepository":{"id":"gitlab.project.containerRegistryRepository","name":"gitlab.project.containerRegistryRepository","fields":{"cleanupPolicyStartedAt":{"name":"cleanupPolicyStartedAt","type":"\t","is_mandatory":true,"title":"When the most recent cleanup policy run started for this repository","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the repository was created","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Repository ID","provider":"go.mondoo.com/mql/providers/gitlab"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Full pull URL (registry host + path)","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Repository name (last path segment)","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Repository path (project_path/repository_name)","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"Project that owns the repository","provider":"go.mondoo.com/mql/providers/gitlab"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Repository delete status","desc":"Empty for healthy repositories, otherwise one of `delete_scheduled`, `delete_ongoing`, or `delete_failed`.","provider":"go.mondoo.com/mql/providers/gitlab"},"tag":{"name":"tag","type":"\u001bgitlab.project.containerRegistryRepository.tag","title":"Container registry repository tag","desc":"A single tag in a container repository, what `docker pull` would resolve. Use `digest` for tag-pinning audits (a moving tag like `latest` can be re-pushed; the digest is immutable) and `totalSize` to spot oversized images. `location` is the full `registry/path:tag` pull string.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"tags":{"name":"tags","type":"\u0019\u001bgitlab.project.containerRegistryRepository.tag","title":"Tags pushed to the repository","provider":"go.mondoo.com/mql/providers/gitlab"},"tagsCount":{"name":"tagsCount","type":"\u0005","is_mandatory":true,"title":"Tag count snapshot","desc":"Null when the repository was reached through a group rollup, because the group-level registry listing has no tag-count parameter. Iterate tags for an exact count in that case.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Container registry repository in a GitLab project","desc":"Docker or OCI image repository published to the project's container registry. Each repository carries `name`, `path` (the pull path prefix), and `location` (the full pull URL). `tagsCount` is a fast snapshot; iterate `tags` for the full list of pushed tags with digests and sizes for tag-pinning and vulnerability-correlation audits. `cleanupPolicyStartedAt` shows when the project's `containerExpirationPolicy` last ran against this repository. `status` is empty for healthy repositories or one of `delete_scheduled`, `delete_ongoing`, or `delete_failed` when a delete is in flight.","private":true,"min_provider_version":"13.3.1","defaults":"path tagsCount status","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.containerRegistryRepository.tag":{"id":"gitlab.project.containerRegistryRepository.tag","name":"gitlab.project.containerRegistryRepository.tag","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the tag was pushed","provider":"go.mondoo.com/mql/providers/gitlab"},"digest":{"name":"digest","type":"\u0007","is_mandatory":true,"title":"Image manifest digest (immutable identifier for the tag's content)","provider":"go.mondoo.com/mql/providers/gitlab"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Full pull URL with tag","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tag name","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path including tag","provider":"go.mondoo.com/mql/providers/gitlab"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Commit revision recorded in the image (when the image was built from a Git commit)","provider":"go.mondoo.com/mql/providers/gitlab"},"shortRevision":{"name":"shortRevision","type":"\u0007","is_mandatory":true,"title":"Short commit revision","provider":"go.mondoo.com/mql/providers/gitlab"},"totalSize":{"name":"totalSize","type":"\u0005","is_mandatory":true,"title":"Total compressed size of the image in bytes","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Container registry repository tag","desc":"A single tag in a container repository, what `docker pull` would resolve. Use `digest` for tag-pinning audits (a moving tag like `latest` can be re-pushed; the digest is immutable) and `totalSize` to spot oversized images. `location` is the full `registry/path:tag` pull string.","private":true,"min_provider_version":"13.3.1","defaults":"name digest totalSize","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.deployKey":{"id":"gitlab.project.deployKey","name":"gitlab.project.deployKey","fields":{"canPush":{"name":"canPush","type":"\u0004","is_mandatory":true,"title":"Whether the key has push (write) access","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Key creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"daysOld":{"name":"daysOld","type":"\u0005","title":"Age of the deploy key in days since creation","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Key expiration time","provider":"go.mondoo.com/mql/providers/gitlab"},"fingerprint":{"name":"fingerprint","type":"\u0007","is_mandatory":true,"title":"MD5 fingerprint of the key","provider":"go.mondoo.com/mql/providers/gitlab"},"fingerprintSHA256":{"name":"fingerprintSHA256","type":"\u0007","is_mandatory":true,"title":"SHA256 fingerprint of the key","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Deploy key ID","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Public SSH key","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"The project this deploy key is registered against","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Deploy key title","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project deploy key","desc":"SSH public key that grants a machine or automation access to a project's repository without a user account. Deploy keys are a common supply-chain exposure: `canPush` reports whether the key has write access (not just read), `key` is the raw public key material, `fingerprint` and `fingerprintSHA256` identify it, and `expiresAt` shows whether the key ever stops being valid. Audit these to find long-lived or push-capable keys that widen the project's attack surface.","private":true,"min_provider_version":"11.1.138","defaults":"id title canPush","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.deployToken":{"id":"gitlab.project.deployToken","name":"gitlab.project.deployToken","fields":{"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the token has expired","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Token expiration time","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Deploy token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Deploy token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Access the token grants","desc":"One or more of read_repository, read_registry, write_registry, read_package_registry, and write_package_registry.","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Deploy token username","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project deploy token","desc":"Long-lived credential scoped to a single project that grants clients (CI runners, external systems) read or write access to the project's Git repository and its container and package registries. Auditing deploy tokens surfaces standing credentials that bypass user authentication: check `expired` and `revoked` to find inactive entries and `scopes` to confirm each token is limited to the access it actually needs.","private":true,"min_provider_version":"11.1.138","defaults":"id name expired revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.file":{"id":"gitlab.project.file","name":"gitlab.project.file","fields":{"content":{"name":"content","type":"\u0007","title":"Decoded file content","desc":"Raw text of the file at the project's default branch, fetched on access. Query it to scan tracked files for secrets, credentials, or insecure settings.","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"File name (final path segment)","provider":"go.mondoo.com/mql/providers/gitlab"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Full path of the file within the repository","provider":"go.mondoo.com/mql/providers/gitlab"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Repository tree entry type","desc":"Object type of the entry in the git tree. Only file blobs are listed, so this is always \"blob\" (directory \"tree\" entries are excluded).","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project repository file","desc":"File tracked in a GitLab project's repository, listed recursively from the project's default branch. Reading `content` returns the decoded file text, which lets you audit tracked files for committed secrets, credentials, or insecure configuration. The `path` field is the file's full path within the repository and serves as the selection key.","private":true,"min_provider_version":"11.1.13","defaults":"path type","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.integration":{"id":"gitlab.project.integration","name":"gitlab.project.integration","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the integration is active","provider":"go.mondoo.com/mql/providers/gitlab"},"alertEvents":{"name":"alertEvents","type":"\u0004","is_mandatory":true,"title":"Whether alert events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"commentOnEventEnabled":{"name":"commentOnEventEnabled","type":"\u0004","is_mandatory":true,"title":"Whether commenting on events is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"commitEvents":{"name":"commitEvents","type":"\u0004","is_mandatory":true,"title":"Whether commit events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialIssuesEvents":{"name":"confidentialIssuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential-issue events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialNoteEvents":{"name":"confidentialNoteEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential-note events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the integration was created","provider":"go.mondoo.com/mql/providers/gitlab"},"deploymentEvents":{"name":"deploymentEvents","type":"\u0004","is_mandatory":true,"title":"Whether deployment events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Integration ID","provider":"go.mondoo.com/mql/providers/gitlab"},"incidentEvents":{"name":"incidentEvents","type":"\u0004","is_mandatory":true,"title":"Whether incident events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the integration is inherited from the group or instance level","provider":"go.mondoo.com/mql/providers/gitlab"},"issuesEvents":{"name":"issuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether issue events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"jobEvents":{"name":"jobEvents","type":"\u0004","is_mandatory":true,"title":"Whether CI job events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsEvents":{"name":"mergeRequestsEvents","type":"\u0004","is_mandatory":true,"title":"Whether merge-request events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"noteEvents":{"name":"noteEvents","type":"\u0004","is_mandatory":true,"title":"Whether note (comment) events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelineEvents":{"name":"pipelineEvents","type":"\u0004","is_mandatory":true,"title":"Whether pipeline events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEvents":{"name":"pushEvents","type":"\u0004","is_mandatory":true,"title":"Whether push events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"slug":{"name":"slug","type":"\u0007","is_mandatory":true,"title":"Integration type slug (for example slack, jira, pipelines-email)","provider":"go.mondoo.com/mql/providers/gitlab"},"tagPushEvents":{"name":"tagPushEvents","type":"\u0004","is_mandatory":true,"title":"Whether tag-push events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable title","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the integration was last updated","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerabilityEvents":{"name":"vulnerabilityEvents","type":"\u0004","is_mandatory":true,"title":"Whether vulnerability events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"},"wikiPageEvents":{"name":"wikiPageEvents","type":"\u0004","is_mandatory":true,"title":"Whether wiki-page events are forwarded","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project integration","desc":"External service wired into a project, such as Slack, Jira, or a generic webhook-style service. The `slug` field identifies the integration type and the per-event boolean flags show which project events are forwarded to the service. Because integrations push project activity outward and can accept inbound triggers, they are a data-egress and inbound-trigger surface worth auditing.","private":true,"min_provider_version":"13.3.9","defaults":"title slug active","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.issue":{"id":"gitlab.project.issue","name":"gitlab.project.issue","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Issue author username","provider":"go.mondoo.com/mql/providers/gitlab"},"authorUser":{"name":"authorUser","type":"\u001bgitlab.user","title":"User who opened the issue, or null when the author cannot be resolved","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"closedAt":{"name":"closedAt","type":"\t","is_mandatory":true,"title":"Issue close time (if closed)","provider":"go.mondoo.com/mql/providers/gitlab"},"confidential":{"name":"confidential","type":"\u0004","is_mandatory":true,"title":"Whether the issue is confidential","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Issue creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Issue description","provider":"go.mondoo.com/mql/providers/gitlab"},"dueDate":{"name":"dueDate","type":"\t","is_mandatory":true,"title":"Issue due date","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Issue ID","provider":"go.mondoo.com/mql/providers/gitlab"},"internalId":{"name":"internalId","type":"\u0005","is_mandatory":true,"title":"Issue internal ID (project-scoped)","provider":"go.mondoo.com/mql/providers/gitlab"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Issue labels","provider":"go.mondoo.com/mql/providers/gitlab"},"milestone":{"name":"milestone","type":"\u001bgitlab.project.milestone","title":"Issue milestone","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Issue state (opened, closed)","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Issue title","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Issue update time","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Issue web URL","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project issue","desc":"Single issue tracked in a project, exposing its state, author, labels, milestone, and due date. The confidential flag marks issues restricted to project members, and state distinguishes opened from closed work. Useful for auditing unresolved confidential reports or stale open items, and for confirming that sensitive issues stay marked confidential.","private":true,"min_provider_version":"11.1.129","defaults":"internalId title state","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.jobTokenScope":{"id":"gitlab.project.jobTokenScope","name":"gitlab.project.jobTokenScope","fields":{"allowlistGroups":{"name":"allowlistGroups","type":"\u0019\u001bgitlab.group","title":"Groups whose CI job tokens are allowed to access this project","provider":"go.mondoo.com/mql/providers/gitlab"},"inboundAllowlistProjects":{"name":"inboundAllowlistProjects","type":"\u0019\u001bgitlab.project","title":"Projects whose CI job tokens are allowed to access this project","provider":"go.mondoo.com/mql/providers/gitlab"},"inboundEnabled":{"name":"inboundEnabled","type":"\u0004","is_mandatory":true,"title":"Whether inbound job-token access is limited to the allowlist","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"CI/CD job-token access scope","desc":"Inbound CI/CD job-token access controls for the project, governing which other projects and groups may use their job tokens to reach it. When `inboundEnabled` is true, only the projects in `inboundAllowlistProjects` and groups in `allowlistGroups` are permitted; when false, any project's job token may reach this project, a lateral-movement risk worth auditing.","private":true,"min_provider_version":"13.3.9","defaults":"inboundEnabled","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.label":{"id":"gitlab.project.label","name":"gitlab.project.label","fields":{"closedIssuesCount":{"name":"closedIssuesCount","type":"\u0005","is_mandatory":true,"title":"Count of closed issues with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"color":{"name":"color","type":"\u0007","is_mandatory":true,"title":"Label color (hex notation with leading '#')","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Label description","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Label ID","provider":"go.mondoo.com/mql/providers/gitlab"},"isProjectLabel":{"name":"isProjectLabel","type":"\u0004","is_mandatory":true,"title":"Whether this is a project label (vs. group label)","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Label name","provider":"go.mondoo.com/mql/providers/gitlab"},"openIssuesCount":{"name":"openIssuesCount","type":"\u0005","is_mandatory":true,"title":"Count of open issues with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"openMergeRequestsCount":{"name":"openMergeRequestsCount","type":"\u0005","is_mandatory":true,"title":"Count of open merge requests with this label","provider":"go.mondoo.com/mql/providers/gitlab"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Label priority (higher priority labels appear first)","provider":"go.mondoo.com/mql/providers/gitlab"},"subscribed":{"name":"subscribed","type":"\u0004","is_mandatory":true,"title":"Whether the authenticated user is subscribed","provider":"go.mondoo.com/mql/providers/gitlab"},"textColor":{"name":"textColor","type":"\u0007","is_mandatory":true,"title":"Text color for label display","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project label","desc":"Label defined on a GitLab project, used to categorize and triage issues and merge requests. Fields cover the label's display appearance (color, textColor), its description, and the counts of open and closed issues and open merge requests carrying the label, which help audit how labels are applied across a project. The priority field orders labels within the project, and isProjectLabel distinguishes a label scoped to this project from a group label inherited across the group's projects.","private":true,"min_provider_version":"11.1.129","defaults":"name color","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.mergeRequest":{"id":"gitlab.project.mergeRequest","name":"gitlab.project.mergeRequest","fields":{"allowMaintainerToPush":{"name":"allowMaintainerToPush","type":"\u0004","is_mandatory":true,"title":"Whether members of the target project can push to the source branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"assignees":{"name":"assignees","type":"\u0019\u001bgitlab.user","is_mandatory":true,"title":"Users assigned to the merge request","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Merge request author username","provider":"go.mondoo.com/mql/providers/gitlab"},"authorUser":{"name":"authorUser","type":"\u001bgitlab.user","title":"User who opened the merge request, or null when the author cannot be resolved","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"blockingDiscussionsResolved":{"name":"blockingDiscussionsResolved","type":"\u0004","is_mandatory":true,"title":"Whether all blocking discussions are resolved","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"closedAt":{"name":"closedAt","type":"\t","is_mandatory":true,"title":"When the merge request was closed (null when not closed)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"closedBy":{"name":"closedBy","type":"\u001bgitlab.user","title":"User who closed the merge request (null when not closed)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Merge request creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Merge request description","provider":"go.mondoo.com/mql/providers/gitlab"},"detailedMergeStatus":{"name":"detailedMergeStatus","type":"\u0007","is_mandatory":true,"title":"Detailed merge-readiness status (for example mergeable, ci_still_running, not_approved)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"discussionLocked":{"name":"discussionLocked","type":"\u0004","is_mandatory":true,"title":"Whether discussion on the merge request is locked","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"downvotes":{"name":"downvotes","type":"\u0005","is_mandatory":true,"title":"Number of downvotes","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"draft":{"name":"draft","type":"\u0004","is_mandatory":true,"title":"Whether the merge request is a draft","provider":"go.mondoo.com/mql/providers/gitlab"},"forceRemoveSourceBranch":{"name":"forceRemoveSourceBranch","type":"\u0004","is_mandatory":true,"title":"Whether the source branch is removed after merge","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"hasConflicts":{"name":"hasConflicts","type":"\u0004","is_mandatory":true,"title":"Whether the merge request has conflicts with the target branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Merge request ID","provider":"go.mondoo.com/mql/providers/gitlab"},"internalId":{"name":"internalId","type":"\u0005","is_mandatory":true,"title":"Merge request internal ID (project-scoped)","provider":"go.mondoo.com/mql/providers/gitlab"},"labels":{"name":"labels","type":"\u0019\u0007","is_mandatory":true,"title":"Merge request labels","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeCommitSha":{"name":"mergeCommitSha","type":"\u0007","is_mandatory":true,"title":"Merge commit SHA (empty until merged)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeUser":{"name":"mergeUser","type":"\u001bgitlab.user","title":"User who merged the merge request (null when not merged)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeWhenPipelineSucceeds":{"name":"mergeWhenPipelineSucceeds","type":"\u0004","is_mandatory":true,"title":"Whether the merge request auto-merges once the pipeline succeeds","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"mergedAt":{"name":"mergedAt","type":"\t","is_mandatory":true,"title":"Merge request merge time (if merged)","provider":"go.mondoo.com/mql/providers/gitlab"},"milestone":{"name":"milestone","type":"\u001bgitlab.project.milestone","title":"Merge request milestone","provider":"go.mondoo.com/mql/providers/gitlab"},"reviewers":{"name":"reviewers","type":"\u0019\u001bgitlab.user","is_mandatory":true,"title":"Users assigned to review the merge request","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sha":{"name":"sha","type":"\u0007","is_mandatory":true,"title":"Head commit SHA of the source branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sourceBranch":{"name":"sourceBranch","type":"\u0007","is_mandatory":true,"title":"Source branch name","provider":"go.mondoo.com/mql/providers/gitlab"},"squashCommitSha":{"name":"squashCommitSha","type":"\u0007","is_mandatory":true,"title":"Squash commit SHA when the merge request was squashed on merge","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Merge request state (opened, closed, merged, locked)","provider":"go.mondoo.com/mql/providers/gitlab"},"targetBranch":{"name":"targetBranch","type":"\u0007","is_mandatory":true,"title":"Target branch name","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Merge request title","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Merge request update time","provider":"go.mondoo.com/mql/providers/gitlab"},"upvotes":{"name":"upvotes","type":"\u0005","is_mandatory":true,"title":"Number of upvotes","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Merge request web URL","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project merge request","desc":"Proposed set of changes from a source branch into a target branch, identified by internalId (the project-scoped merge request number). Merge requests are where code review and merge gating happen, so they are central to auditing change control: state and detailedMergeStatus show whether a change merged and whether it satisfied gating rules, blockingDiscussionsResolved and reviewers reveal review coverage, and mergeWhenPipelineSucceeds, forceRemoveSourceBranch, and allowMaintainerToPush expose the merge automation and source-branch settings in effect. The author, mergeUser, and closedBy accessors attribute who opened, merged, and closed each request.","private":true,"min_provider_version":"11.1.129","defaults":"internalId title state","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.milestone":{"id":"gitlab.project.milestone","name":"gitlab.project.milestone","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Milestone description","provider":"go.mondoo.com/mql/providers/gitlab"},"dueDate":{"name":"dueDate","type":"\t","is_mandatory":true,"title":"Target completion date","provider":"go.mondoo.com/mql/providers/gitlab"},"expired":{"name":"expired","type":"\u0004","is_mandatory":true,"title":"Whether the milestone has passed its due date","desc":"Null when GitLab does not report the flag, which is not the same as the milestone being current.","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Milestone ID","provider":"go.mondoo.com/mql/providers/gitlab"},"internalId":{"name":"internalId","type":"\u0005","is_mandatory":true,"title":"Milestone internal ID (project-scoped)","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"Project this milestone belongs to","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"projectId":{"name":"projectId","type":"\u0005","is_mandatory":true,"title":"Project ID","provider":"go.mondoo.com/mql/providers/gitlab"},"startDate":{"name":"startDate","type":"\t","is_mandatory":true,"title":"Beginning date","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current status (active or closed)","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Milestone title","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last modification timestamp","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project milestone","desc":"Milestone defined on a GitLab project, used to group issues and merge requests toward a shared goal or release. Tracks the milestone title, description, and scheduling window (startDate and dueDate), along with its state (active or closed) and whether it has passed its due date (expired). The internalId is the project-scoped number shown in the GitLab UI, while id is the globally unique identifier.","private":true,"min_provider_version":"11.1.129","defaults":"internalId title state","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.package":{"id":"gitlab.project.package","name":"gitlab.project.package","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the package was published","provider":"go.mondoo.com/mql/providers/gitlab"},"file":{"name":"file","type":"\u001bgitlab.project.package.file","title":"File within a GitLab package","desc":"One artifact inside a package, such as a `.jar`, `.tgz`, or `.whl`. The SHA-256 checksum supports tamper detection and SBOM correlation; SHA-1 and MD5 are provided for legacy formats that publish them.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bgitlab.project.package.file","title":"Files contained in the package","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Package ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastDownloadedAt":{"name":"lastDownloadedAt","type":"\t","is_mandatory":true,"title":"When the package was most recently downloaded; null if never","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Package name","provider":"go.mondoo.com/mql/providers/gitlab"},"packageType":{"name":"packageType","type":"\u0007","is_mandatory":true,"title":"Package format","desc":"One of `maven`, `npm`, `conan`, `nuget`, `pypi`, `composer`, `generic`, `golang`, `debian`, `helm`, `terraform_module`, `rubygems`, or `ml_model`.","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"Project that owns the package","provider":"go.mondoo.com/mql/providers/gitlab"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Lifecycle status","desc":"One of `default`, `hidden`, `processing`, `error`, or `pending_destruction`.","provider":"go.mondoo.com/mql/providers/gitlab"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Distribution tags attached to this version (e.g. npm `latest`)","provider":"go.mondoo.com/mql/providers/gitlab"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Published version","provider":"go.mondoo.com/mql/providers/gitlab"},"webPath":{"name":"webPath","type":"\u0007","is_mandatory":true,"title":"Web UI path for the package version","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Package published to a GitLab project's package registry","desc":"Single package version in the project's package registry. `packageType` distinguishes the package format (`maven`, `npm`, `conan`, `nuget`, `pypi`, `composer`, `generic`, `golang`, `debian`, `helm`, `terraform_module`, `rubygems`, `ml_model`) and `status` its lifecycle state (`default`, `hidden`, `processing`, `error`, `pending_destruction`). Auditing the registry reveals what artifacts a project publishes; `files` holds the contained artifacts with their SHA-256/SHA-1/MD5 checksums for tamper detection.","private":true,"min_provider_version":"13.3.1","defaults":"name version packageType status","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.package.file":{"id":"gitlab.project.package.file","name":"gitlab.project.package.file","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the file was uploaded","provider":"go.mondoo.com/mql/providers/gitlab"},"fileMD5":{"name":"fileMD5","type":"\u0007","is_mandatory":true,"title":"MD5 checksum (when provided by the package format)","provider":"go.mondoo.com/mql/providers/gitlab"},"fileName":{"name":"fileName","type":"\u0007","is_mandatory":true,"title":"File name","provider":"go.mondoo.com/mql/providers/gitlab"},"fileSHA1":{"name":"fileSHA1","type":"\u0007","is_mandatory":true,"title":"SHA-1 checksum (when provided by the package format)","provider":"go.mondoo.com/mql/providers/gitlab"},"fileSHA256":{"name":"fileSHA256","type":"\u0007","is_mandatory":true,"title":"SHA-256 checksum","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"File ID","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelines":{"name":"pipelines","type":"\u0019\u001bgitlab.project.pipeline","is_mandatory":true,"title":"Pipelines that produced this package file (build provenance)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"size":{"name":"size","type":"\u0005","is_mandatory":true,"title":"File size in bytes","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"File within a GitLab package","desc":"One artifact inside a package, such as a `.jar`, `.tgz`, or `.whl`. The SHA-256 checksum supports tamper detection and SBOM correlation; SHA-1 and MD5 are provided for legacy formats that publish them.","private":true,"min_provider_version":"13.3.1","defaults":"fileName size fileSHA256","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.packageProtectionRule":{"id":"gitlab.project.packageProtectionRule","name":"gitlab.project.packageProtectionRule","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Rule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"minimumAccessLevelForDelete":{"name":"minimumAccessLevelForDelete","type":"\u0007","is_mandatory":true,"title":"Minimum project access level required to delete matching packages","desc":"One of `developer`, `maintainer`, `owner`, or `admin`; empty when delete is unprotected.","provider":"go.mondoo.com/mql/providers/gitlab"},"minimumAccessLevelForPush":{"name":"minimumAccessLevelForPush","type":"\u0007","is_mandatory":true,"title":"Minimum project access level required to push matching packages","desc":"One of `developer`, `maintainer`, `owner`, or `admin`; empty when push is unprotected.","provider":"go.mondoo.com/mql/providers/gitlab"},"packageNamePattern":{"name":"packageNamePattern","type":"\u0007","is_mandatory":true,"title":"Glob pattern matched against the package name","provider":"go.mondoo.com/mql/providers/gitlab"},"packageType":{"name":"packageType","type":"\u0007","is_mandatory":true,"title":"Package format the rule applies to","desc":"One of `maven`, `npm`, `conan`, `nuget`, `pypi`, `composer`, `generic`, `golang`, `debian`, `helm`, `terraform_module`, `rubygems`, or `ml_model`.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Package protection rule","desc":"Access control that gates pushes and deletes against packages whose name matches `packageNamePattern` (with the format restricted to `packageType`). The two minimum-access-level fields enforce who can perform each action: one of `developer`, `maintainer`, `owner`, or `admin`. An empty value means the action is not protected.","private":true,"min_provider_version":"13.3.1","defaults":"packageNamePattern packageType minimumAccessLevelForPush minimumAccessLevelForDelete","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.pipeline":{"id":"gitlab.project.pipeline","name":"gitlab.project.pipeline","fields":{"beforeSha":{"name":"beforeSha","type":"\u0007","title":"Commit SHA the pipeline ran against before the change","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"committedAt":{"name":"committedAt","type":"\t","title":"When the commit behind the pipeline was authored","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"coverage":{"name":"coverage","type":"\u0007","title":"Reported test coverage percentage as a string; empty when not reported","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Pipeline creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"detailedStatus":{"name":"detailedStatus","type":"\n","title":"Detailed status breakdown","desc":"A dict with icon, text, label, group, and tooltip keys describing the pipeline's status in richer terms than the plain `status` string.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"duration":{"name":"duration","type":"\u0005","title":"Total run duration in seconds","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"finishedAt":{"name":"finishedAt","type":"\t","title":"When the pipeline finished","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Pipeline ID","provider":"go.mondoo.com/mql/providers/gitlab"},"internalId":{"name":"internalId","type":"\u0005","is_mandatory":true,"title":"Pipeline internal ID (project-scoped)","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pipeline name","provider":"go.mondoo.com/mql/providers/gitlab"},"projectId":{"name":"projectId","type":"\u0005","is_mandatory":true,"title":"Project ID","provider":"go.mondoo.com/mql/providers/gitlab"},"queuedDuration":{"name":"queuedDuration","type":"\u0005","title":"Time spent queued before running, in seconds","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"ref":{"name":"ref","type":"\u0007","is_mandatory":true,"title":"Git reference (branch or tag name)","provider":"go.mondoo.com/mql/providers/gitlab"},"sha":{"name":"sha","type":"\u0007","is_mandatory":true,"title":"Git commit SHA","provider":"go.mondoo.com/mql/providers/gitlab"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Pipeline source","desc":"One of: push, web, trigger, schedule, api, external, pipeline, chat, webide, merge_request_event, external_pull_request_event, parent_pipeline, ondemand_dast_scan, ondemand_dast_validation.","provider":"go.mondoo.com/mql/providers/gitlab"},"startedAt":{"name":"startedAt","type":"\t","title":"When the pipeline started running","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Pipeline status (created, waiting_for_resource, preparing, pending, running, success, failed, canceled, skipped, manual, scheduled)","provider":"go.mondoo.com/mql/providers/gitlab"},"tag":{"name":"tag","type":"\u0004","title":"Whether the pipeline ran on a tag reference","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Pipeline last update time","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User who triggered the pipeline","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Pipeline web URL","provider":"go.mondoo.com/mql/providers/gitlab"},"yamlErrors":{"name":"yamlErrors","type":"\u0007","title":"CI configuration (.gitlab-ci.yml) parse errors; empty when the config is valid","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab CI/CD pipeline","desc":"A single CI/CD pipeline run for the project, covering how it was triggered and how it finished. The `status` field reports the run's outcome (success, failed, canceled, and so on) and `source` records what kicked it off (a push, a schedule, an API call, a merge request event). The `ref`, `sha`, and `user` fields tie the run to the branch or tag, commit, and account behind it, while `yamlErrors` surfaces invalid .gitlab-ci.yml configuration and `coverage` reports the measured test coverage. Useful for auditing build provenance, failed or skipped runs, and who is able to trigger pipelines.","private":true,"min_provider_version":"11.1.130","defaults":"id status ref","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.pipelineSchedule":{"id":"gitlab.project.pipelineSchedule","name":"gitlab.project.pipelineSchedule","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the schedule is currently active","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the schedule was created","provider":"go.mondoo.com/mql/providers/gitlab"},"cron":{"name":"cron","type":"\u0007","is_mandatory":true,"title":"Cron expression controlling the run cadence","provider":"go.mondoo.com/mql/providers/gitlab"},"cronTimezone":{"name":"cronTimezone","type":"\u0007","is_mandatory":true,"title":"Time zone the cron expression is evaluated in","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable label given to the schedule","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Pipeline schedule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastPipelineId":{"name":"lastPipelineId","type":"\u0005","title":"ID of the most recent pipeline started by this schedule","desc":"Zero when the schedule has never run.","provider":"go.mondoo.com/mql/providers/gitlab"},"lastPipelineRef":{"name":"lastPipelineRef","type":"\u0007","title":"Branch or tag the most recent scheduled pipeline ran against","provider":"go.mondoo.com/mql/providers/gitlab"},"lastPipelineSha":{"name":"lastPipelineSha","type":"\u0007","title":"Commit SHA the most recent scheduled pipeline ran against","provider":"go.mondoo.com/mql/providers/gitlab"},"lastPipelineStatus":{"name":"lastPipelineStatus","type":"\u0007","title":"Status of the most recent scheduled pipeline","desc":"One of `created`, `waiting_for_resource`, `preparing`, `pending`, `running`, `success`, `failed`, `canceled`, `skipped`, `manual`, or `scheduled`. Empty when the schedule has never run.","provider":"go.mondoo.com/mql/providers/gitlab"},"nextRunAt":{"name":"nextRunAt","type":"\t","is_mandatory":true,"title":"Next time the schedule is due to run","provider":"go.mondoo.com/mql/providers/gitlab"},"owner":{"name":"owner","type":"\u001bgitlab.user","title":"User whose permissions the scheduled pipeline runs with","provider":"go.mondoo.com/mql/providers/gitlab"},"ref":{"name":"ref","type":"\u0007","is_mandatory":true,"title":"Branch or tag the scheduled pipeline runs against","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the schedule was last modified","provider":"go.mondoo.com/mql/providers/gitlab"},"variables":{"name":"variables","type":"\u001a\u0007\u0007","title":"CI/CD variables the schedule injects, keyed by variable name","desc":"The value of each entry is the variable type, either `env_var` or `file`. Variable values are deliberately omitted because GitLab returns them in clear text. GitLab discloses this list only to the schedule owner and to users with the Maintainer or Owner role, so it is empty for tokens below that threshold.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab pipeline schedule","desc":"Recurring pipeline run configured on the project, executing `ref` on the `cron` cadence with the permissions of `owner`. Schedules persist independently of the repository contents, so one created by an attacker keeps running after the offending commit is reverted. `variables` lists the names and types of the CI/CD variables the schedule injects into each run without revealing their values, and the `lastPipeline` fields report the outcome of the most recent execution.","private":true,"min_provider_version":"13.5.6","defaults":"id description cron active","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.pipelineTrigger":{"id":"gitlab.project.pipelineTrigger","name":"gitlab.project.pipelineTrigger","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the trigger token was created","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable label given to the trigger","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Trigger token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the trigger token last started a pipeline","desc":"Null when the token has never been used, which marks it as a dormant credential.","provider":"go.mondoo.com/mql/providers/gitlab"},"owner":{"name":"owner","type":"\u001bgitlab.user","title":"User whose permissions pipelines started by this token run with","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the trigger token was last modified","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab pipeline trigger token","desc":"Standing credential that lets an external caller start a pipeline on the project over the API. Trigger tokens carry no expiration, so a token created for a one-off integration keeps working indefinitely unless it is deleted. `lastUsedAt` distinguishes tokens still in service from dormant ones that should be removed, `owner` names the user whose permissions the triggered pipeline inherits, and `createdAt` shows how long the credential has been outstanding. The secret value itself is never exposed.","private":true,"min_provider_version":"13.5.6","defaults":"id description lastUsedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.protectedBranch":{"id":"gitlab.project.protectedBranch","name":"gitlab.project.protectedBranch","fields":{"allowForcePush":{"name":"allowForcePush","type":"\u0004","is_mandatory":true,"title":"Whether force push is allowed","provider":"go.mondoo.com/mql/providers/gitlab"},"codeOwnerApproval":{"name":"codeOwnerApproval","type":"\u0004","is_mandatory":true,"title":"Whether code owner approval is required","provider":"go.mondoo.com/mql/providers/gitlab"},"defaultBranch":{"name":"defaultBranch","type":"\u0004","is_mandatory":true,"title":"Whether this is the default branch","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeAccessLevels":{"name":"mergeAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to merge into the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Branch name","provider":"go.mondoo.com/mql/providers/gitlab"},"pushAccessLevels":{"name":"pushAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to push directly to the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"unprotectAccessLevels":{"name":"unprotectAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to remove protection from the branch","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab protected branch","desc":"Branch protection rules for a project, controlling who can push, merge, and remove protection on a given branch. Auditing these settings verifies that critical branches (such as the default branch) enforce review and prevent unauthorized or force pushes. Each branch is identified by `name`, and `pushAccessLevels`, `mergeAccessLevels`, and `unprotectAccessLevels` spell out exactly which roles, users, groups, or deploy keys hold each permission. The `allowForcePush` and `codeOwnerApproval` flags capture whether history-rewriting pushes are permitted and whether Code Owner sign-off is required before merging.","private":true,"min_provider_version":"11.1.12","defaults":"name allowForcePush","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.protectedEnvironment":{"id":"gitlab.project.protectedEnvironment","name":"gitlab.project.protectedEnvironment","fields":{"approvalRules":{"name":"approvalRules","type":"\u0019\n","is_mandatory":true,"title":"Deployment approval rules for the environment","desc":"Each entry is a dict with id, accessLevel, accessLevelDescription, userId, groupId, requiredApprovalCount, and groupInheritanceType keys.","provider":"go.mondoo.com/mql/providers/gitlab"},"deployAccessLevels":{"name":"deployAccessLevels","type":"\u0019\n","is_mandatory":true,"title":"Access levels permitted to deploy to the environment","desc":"Each entry is a dict with accessLevel, accessLevelDescription, userId, groupId, and groupInheritanceType keys.","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name or wildcard pattern","provider":"go.mondoo.com/mql/providers/gitlab"},"requiredApprovalCount":{"name":"requiredApprovalCount","type":"\u0005","is_mandatory":true,"title":"Number of approvals required before a deployment proceeds","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab protected environment","desc":"Deployment gates guarding a protected environment (such as production). The `name` field selects the environment or wildcard pattern it covers, for example `production` or `review/*`. `deployAccessLevels` restricts who may deploy, `requiredApprovalCount` sets how many approvals a deployment needs, and `approvalRules` names the approver groups and users. Weak or missing gates on a production environment let unreviewed changes reach it.","private":true,"min_provider_version":"13.3.9","defaults":"name requiredApprovalCount","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.protectedTag":{"id":"gitlab.project.protectedTag","name":"gitlab.project.protectedTag","fields":{"createAccessLevels":{"name":"createAccessLevels","type":"\u0019\u001bgitlab.protectedBranch.accessLevel","is_mandatory":true,"title":"Access levels permitted to create the protected tag","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tag name or wildcard pattern","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab protected tag","desc":"Protected tag rule and the access levels permitted to create tags matching it, so you can audit who can cut release tags on the project. The `name` is the tag name or wildcard pattern (for example `v*`). `createAccessLevels` lists each role, user, group, or deploy key allowed to create the tag.","private":true,"min_provider_version":"13.3.9","defaults":"name","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.pushRule":{"id":"gitlab.project.pushRule","name":"gitlab.project.pushRule","fields":{"authorEmailRegex":{"name":"authorEmailRegex","type":"\u0007","is_mandatory":true,"title":"Regex for allowed author emails","provider":"go.mondoo.com/mql/providers/gitlab"},"branchNameRegex":{"name":"branchNameRegex","type":"\u0007","is_mandatory":true,"title":"Regex for branch names","provider":"go.mondoo.com/mql/providers/gitlab"},"commitCommitterCheck":{"name":"commitCommitterCheck","type":"\u0004","is_mandatory":true,"title":"Whether the committer must be a verified GitLab user","provider":"go.mondoo.com/mql/providers/gitlab"},"commitCommitterNameCheck":{"name":"commitCommitterNameCheck","type":"\u0004","is_mandatory":true,"title":"Whether the committer name must match the GitLab user name","provider":"go.mondoo.com/mql/providers/gitlab"},"commitMessageNegativeRegex":{"name":"commitMessageNegativeRegex","type":"\u0007","is_mandatory":true,"title":"Regex for commit messages to reject","provider":"go.mondoo.com/mql/providers/gitlab"},"commitMessageRegex":{"name":"commitMessageRegex","type":"\u0007","is_mandatory":true,"title":"Regex for commit messages","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Push rule creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"denyDeleteTag":{"name":"denyDeleteTag","type":"\u0004","is_mandatory":true,"title":"Whether deleting tags is denied","provider":"go.mondoo.com/mql/providers/gitlab"},"fileNameRegex":{"name":"fileNameRegex","type":"\u0007","is_mandatory":true,"title":"Regex for disallowed file names","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Push rule ID","provider":"go.mondoo.com/mql/providers/gitlab"},"maxFileSize":{"name":"maxFileSize","type":"\u0005","is_mandatory":true,"title":"Maximum allowed file size in MB","provider":"go.mondoo.com/mql/providers/gitlab"},"memberCheck":{"name":"memberCheck","type":"\u0004","is_mandatory":true,"title":"Whether commits must be from a group member","provider":"go.mondoo.com/mql/providers/gitlab"},"preventSecrets":{"name":"preventSecrets","type":"\u0004","is_mandatory":true,"title":"Whether known secrets are prevented from being pushed","provider":"go.mondoo.com/mql/providers/gitlab"},"rejectNonDCOCommits":{"name":"rejectNonDCOCommits","type":"\u0004","is_mandatory":true,"title":"Whether non-DCO commits are rejected","provider":"go.mondoo.com/mql/providers/gitlab"},"rejectUnsignedCommits":{"name":"rejectUnsignedCommits","type":"\u0004","is_mandatory":true,"title":"Whether unsigned commits are rejected","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project push rules","desc":"Server-side constraints GitLab enforces on every push to a project's repository. Push rules govern commit message formats, branch naming, author and committer identity, file names and sizes, secret-leak prevention, and commit-signature requirements. Query this to audit whether a project blocks known secrets (preventSecrets), rejects unsigned commits (rejectUnsignedCommits), and restricts commits to verified GitLab users (commitCommitterCheck).","private":true,"min_provider_version":"11.1.138","defaults":"preventSecrets rejectUnsignedCommits commitCommitterCheck","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.release":{"id":"gitlab.project.release","name":"gitlab.project.release","fields":{"assets":{"name":"assets","type":"\n","is_mandatory":true,"title":"Downloadable assets attached to the release","desc":"A dict with count, sources (format/url), and links (id/name/url/linkType/ external) keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Release author username","provider":"go.mondoo.com/mql/providers/gitlab"},"authorUser":{"name":"authorUser","type":"\u001bgitlab.user","title":"User who created the release (null when unknown)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"commit":{"name":"commit","type":"\n","is_mandatory":true,"title":"Commit the release points to","desc":"A dict with id, shortId, title, authorName, authoredDate, committedDate, and webUrl keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Release creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Release description","provider":"go.mondoo.com/mql/providers/gitlab"},"evidences":{"name":"evidences","type":"\u0019\n","is_mandatory":true,"title":"Release evidence collected at publish time (tamper-evidence)","desc":"Each entry is a dict with sha, filepath, and collectedAt keys.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Release name","provider":"go.mondoo.com/mql/providers/gitlab"},"releasedAt":{"name":"releasedAt","type":"\t","is_mandatory":true,"title":"Release publish time","provider":"go.mondoo.com/mql/providers/gitlab"},"tagName":{"name":"tagName","type":"\u0007","is_mandatory":true,"title":"Release tag name","provider":"go.mondoo.com/mql/providers/gitlab"},"upcomingRelease":{"name":"upcomingRelease","type":"\u0004","is_mandatory":true,"title":"Whether the release is scheduled but not yet published","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project release","desc":"A published or scheduled release of a project, keyed by its Git tag. Releases mark shippable versions and carry the release notes, the commit they point at, the downloadable assets (source archives and attached links), and any collected evidence. Use it to audit what was shipped, verify that releases reference the expected commits, and check release evidence for supply-chain integrity. The upcomingRelease field distinguishes scheduled-but-unpublished releases from live ones.","private":true,"min_provider_version":"11.1.129","defaults":"tagName name","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.remoteMirror":{"id":"gitlab.project.remoteMirror","name":"gitlab.project.remoteMirror","fields":{"authMethod":{"name":"authMethod","type":"\u0007","is_mandatory":true,"title":"How the mirror authenticates to the destination","desc":"Either `password` or `ssh_public_key`.","provider":"go.mondoo.com/mql/providers/gitlab"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the mirror is active","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Mirror ID","provider":"go.mondoo.com/mql/providers/gitlab"},"keepDivergentRefs":{"name":"keepDivergentRefs","type":"\u0004","is_mandatory":true,"title":"Whether refs that have diverged on the destination are preserved","provider":"go.mondoo.com/mql/providers/gitlab"},"lastError":{"name":"lastError","type":"\u0007","is_mandatory":true,"title":"Error reported by the most recent failed replication attempt","provider":"go.mondoo.com/mql/providers/gitlab"},"lastSuccessfulUpdateAt":{"name":"lastSuccessfulUpdateAt","type":"\t","is_mandatory":true,"title":"Time replication last completed successfully","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUpdateAt":{"name":"lastUpdateAt","type":"\t","is_mandatory":true,"title":"Time replication was last attempted","provider":"go.mondoo.com/mql/providers/gitlab"},"mirrorBranchRegex":{"name":"mirrorBranchRegex","type":"\u0007","is_mandatory":true,"title":"Regular expression selecting which branches are replicated","provider":"go.mondoo.com/mql/providers/gitlab"},"onlyProtectedBranches":{"name":"onlyProtectedBranches","type":"\u0004","is_mandatory":true,"title":"Whether replication is limited to protected branches","provider":"go.mondoo.com/mql/providers/gitlab"},"updateStatus":{"name":"updateStatus","type":"\u0007","is_mandatory":true,"title":"Outcome of the most recent replication attempt","desc":"One of `none`, `scheduled`, `started`, `finished`, or `failed`.","provider":"go.mondoo.com/mql/providers/gitlab"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Destination repository the code is pushed to","desc":"Any password embedded in the URL is redacted by GitLab before the value is returned.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project push mirror","desc":"Continuous replication of the project's repository to an external Git host. A push mirror moves source code out of GitLab on every update, so `url` records the destination the code is being sent to and `authMethod` how the mirror authenticates there. `onlyProtectedBranches` narrows what is replicated, and `keepDivergentRefs` decides whether the remote keeps refs that have diverged locally. GitLab redacts any password embedded in `url`.","private":true,"min_provider_version":"13.5.6","defaults":"url enabled updateStatus","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.runner":{"id":"gitlab.project.runner","name":"gitlab.project.runner","fields":{"accessLevel":{"name":"accessLevel","type":"\u0007","title":"Access level controlling which refs the runner may run jobs on (\"not_protected\" or \"ref_protected\")","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"contactedAt":{"name":"contactedAt","type":"\t","title":"Timestamp of the runner's most recent check-in with GitLab; nil when the runner has never connected","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Runner description","provider":"go.mondoo.com/mql/providers/gitlab"},"groups":{"name":"groups","type":"\u0019\u0007","title":"Web URLs of the groups the runner is associated with (group-type runners)","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Runner ID","provider":"go.mondoo.com/mql/providers/gitlab"},"isShared":{"name":"isShared","type":"\u0004","is_mandatory":true,"title":"Whether this is a shared runner","provider":"go.mondoo.com/mql/providers/gitlab"},"lockedToProject":{"name":"lockedToProject","type":"\u0004","title":"Whether the runner is locked to the projects it is currently associated with (cannot be assigned to additional projects)","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"maintenanceNote":{"name":"maintenanceNote","type":"\u0007","title":"Free-form note the runner administrator left explaining maintenance state","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"maximumTimeout":{"name":"maximumTimeout","type":"\u0005","title":"Maximum job timeout in seconds (0 means use the project default)","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Runner name","provider":"go.mondoo.com/mql/providers/gitlab"},"online":{"name":"online","type":"\u0004","is_mandatory":true,"title":"Whether the runner is online","provider":"go.mondoo.com/mql/providers/gitlab"},"paused":{"name":"paused","type":"\u0004","is_mandatory":true,"title":"Whether the runner is paused","provider":"go.mondoo.com/mql/providers/gitlab"},"projects":{"name":"projects","type":"\u0019\u0007","title":"Path-with-namespace of projects the runner is associated with (e.g. \"acme/api\")","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"runUntagged":{"name":"runUntagged","type":"\u0004","title":"Whether the runner picks up jobs that don't carry a `tags:` directive","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"runnerType":{"name":"runnerType","type":"\u0007","is_mandatory":true,"title":"Runner type (instance_type, group_type, project_type)","provider":"go.mondoo.com/mql/providers/gitlab"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Runner status (online, offline, stale, never_contacted, active, paused)","provider":"go.mondoo.com/mql/providers/gitlab"},"tagList":{"name":"tagList","type":"\u0019\u0007","title":"Tags applied to the runner; jobs whose `tags:` match are routed here","min_provider_version":"13.2.3","provider":"go.mondoo.com/mql/providers/gitlab"},"tokenExpiresAt":{"name":"tokenExpiresAt","type":"\t","is_mandatory":true,"title":"Registration token expiry; nil when the token does not expire","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab CI/CD runner","desc":"CI/CD runner registered for a GitLab project  GitLab Runner that executes CI/CD jobs for the project, covering project-specific runners as well as shared instance or group runners visible to the project. Beyond inventory (type, paused, shared, online, status), it exposes security-relevant settings used to audit job exposure: whether the runner picks up untagged jobs, whether it is locked to its associated projects, and the access level governing whether it may run on non-protected refs. Use it to find untagged shared-runner exposure, runners that are not restricted to protected refs, and stale runners that have not checked in.","private":true,"min_provider_version":"11.1.130","defaults":"id description status runnerType","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.secureFile":{"id":"gitlab.project.secureFile","name":"gitlab.project.secureFile","fields":{"certificateExpiresAt":{"name":"certificateExpiresAt","type":"\t","is_mandatory":true,"title":"Expiration recorded inside the certificate itself","provider":"go.mondoo.com/mql/providers/gitlab"},"certificateId":{"name":"certificateId","type":"\u0007","is_mandatory":true,"title":"Serial number of the certificate, when the file is a certificate","provider":"go.mondoo.com/mql/providers/gitlab"},"checksum":{"name":"checksum","type":"\u0007","is_mandatory":true,"title":"Checksum of the stored file","provider":"go.mondoo.com/mql/providers/gitlab"},"checksumAlgorithm":{"name":"checksumAlgorithm","type":"\u0007","is_mandatory":true,"title":"Algorithm used to compute the checksum","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the file was uploaded","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the file expires","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Secure file ID","provider":"go.mondoo.com/mql/providers/gitlab"},"issuer":{"name":"issuer","type":"\n","is_mandatory":true,"title":"Authority that issued the certificate","desc":"Keys are the distinguished-name components GitLab parses out: `CN`, `O`, `OU`, and `C`.","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"File name as referenced by CI jobs","provider":"go.mondoo.com/mql/providers/gitlab"},"subject":{"name":"subject","type":"\n","is_mandatory":true,"title":"Entity the certificate was issued to","desc":"Keys are the distinguished-name components GitLab parses out: `CN`, `O`, `OU`, `C`, and `UID`.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project secure file","desc":"Certificate, keystore, or provisioning profile stored in the project and mounted into CI jobs at run time. Secure files hold signing material that outlives any single pipeline, so `expiresAt` and the certificate fields matter for spotting credentials that are about to lapse or that were issued by an unexpected authority. `checksum` and `checksumAlgorithm` pin the exact bytes GitLab is serving to jobs.","private":true,"min_provider_version":"13.5.6","defaults":"name expiresAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.securitySetting":{"id":"gitlab.project.securitySetting","name":"gitlab.project.securitySetting","fields":{"autoFixContainerScanning":{"name":"autoFixContainerScanning","type":"\u0004","is_mandatory":true,"title":"Whether auto-fix for container scanning is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"autoFixDAST":{"name":"autoFixDAST","type":"\u0004","is_mandatory":true,"title":"Whether auto-fix for DAST is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"autoFixDependencyScanning":{"name":"autoFixDependencyScanning","type":"\u0004","is_mandatory":true,"title":"Whether auto-fix for dependency scanning is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"autoFixSAST":{"name":"autoFixSAST","type":"\u0004","is_mandatory":true,"title":"Whether auto-fix for SAST is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"containerScanningForRegistryEnabled":{"name":"containerScanningForRegistryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether container scanning for registry is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"continuousVulnerabilityScansEnabled":{"name":"continuousVulnerabilityScansEnabled","type":"\u0004","is_mandatory":true,"title":"Whether continuous vulnerability scans are enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"secretPushProtectionEnabled":{"name":"secretPushProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether secret push protection is enabled","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project security settings","desc":"Project-level toggles that govern GitLab's built-in security scanning and remediation features. `secretPushProtectionEnabled` blocks commits that contain detected secrets before they reach the repository, and `continuousVulnerabilityScansEnabled` re-scans existing dependencies as new advisories are published. The `autoFix*` flags control whether GitLab opens automatic merge requests to remediate findings from SAST, DAST, dependency scanning, and container scanning, and `containerScanningForRegistryEnabled` extends container scanning to images already stored in the project's registry. Audit these to confirm a project enforces the scanning coverage its compliance policy expects. Most fields require a GitLab tier that includes the corresponding scanner.","private":true,"min_provider_version":"11.1.138","defaults":"secretPushProtectionEnabled continuousVulnerabilityScansEnabled","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.variable":{"id":"gitlab.project.variable","name":"gitlab.project.variable","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Variable description","provider":"go.mondoo.com/mql/providers/gitlab"},"environmentScope":{"name":"environmentScope","type":"\u0007","is_mandatory":true,"title":"Environment scope for the variable","provider":"go.mondoo.com/mql/providers/gitlab"},"hidden":{"name":"hidden","type":"\u0004","is_mandatory":true,"title":"Whether the variable is hidden","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Variable key/name","provider":"go.mondoo.com/mql/providers/gitlab"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the variable value is masked in job logs","provider":"go.mondoo.com/mql/providers/gitlab"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the variable is protected (only available on protected branches/tags)","provider":"go.mondoo.com/mql/providers/gitlab"},"raw":{"name":"raw","type":"\u0004","is_mandatory":true,"title":"Whether the variable is raw (not expanded)","provider":"go.mondoo.com/mql/providers/gitlab"},"variableType":{"name":"variableType","type":"\u0007","is_mandatory":true,"title":"Variable type (env_var or file)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project CI/CD variable","desc":"A single CI/CD variable exposed to a project's pipelines, holding a key/value pair that jobs read as an environment variable or file. These variables frequently carry secrets (deploy tokens, cloud credentials, API keys), so they are a common audit target: `masked` reports whether the value is hidden in job logs, `protected` restricts it to jobs on protected branches and tags, and `environmentScope` limits which deployment environments can use it. A variable is identified by its `key` together with its `environmentScope`, so the same key can exist with different values per environment.","private":true,"min_provider_version":"11.1.129","defaults":"key masked protected","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.vulnerability":{"id":"gitlab.project.vulnerability","name":"gitlab.project.vulnerability","fields":{"confirmedAt":{"name":"confirmedAt","type":"\t","is_mandatory":true,"title":"When the vulnerability was confirmed","provider":"go.mondoo.com/mql/providers/gitlab"},"confirmedBy":{"name":"confirmedBy","type":"\u001bgitlab.user","title":"User who confirmed the vulnerability","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Detailed description of the finding","provider":"go.mondoo.com/mql/providers/gitlab"},"detectedAt":{"name":"detectedAt","type":"\t","is_mandatory":true,"title":"When the vulnerability was first detected","provider":"go.mondoo.com/mql/providers/gitlab"},"dismissalReason":{"name":"dismissalReason","type":"\u0007","is_mandatory":true,"title":"Reason given when the vulnerability was dismissed","desc":"One of ACCEPTABLE_RISK, FALSE_POSITIVE, MITIGATING_CONTROL, USED_IN_TESTS, or NOT_APPLICABLE.","provider":"go.mondoo.com/mql/providers/gitlab"},"dismissedAt":{"name":"dismissedAt","type":"\t","is_mandatory":true,"title":"When the vulnerability was dismissed","provider":"go.mondoo.com/mql/providers/gitlab"},"dismissedBy":{"name":"dismissedBy","type":"\u001bgitlab.user","title":"User who dismissed the vulnerability","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Global vulnerability ID","provider":"go.mondoo.com/mql/providers/gitlab"},"identifiers":{"name":"identifiers","type":"\u0019\n","is_mandatory":true,"title":"External references attached to the finding","desc":"Each entry has `externalType` (CVE, CWE, OWASP, vendor-specific), `externalId`, `name`, and `url`.","provider":"go.mondoo.com/mql/providers/gitlab"},"location":{"name":"location","type":"\n","is_mandatory":true,"title":"Where the finding occurs","desc":"Shape varies by `reportType`. SAST → `file`, `startLine`, `endLine`, `blobPath`, `vulnerableClass`, `vulnerableMethod`. Dependency scanning → `dependency.package`, `dependency.version`, `file`. Container scanning → `image`, `operatingSystem`, `dependency`. DAST → `hostname`, `path`, `requestMethod`, `param`.","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"Project this finding belongs to","provider":"go.mondoo.com/mql/providers/gitlab"},"reportType":{"name":"reportType","type":"\u0007","is_mandatory":true,"title":"Scanner family that produced the finding","desc":"One of SAST, DAST, DEPENDENCY_SCANNING, CONTAINER_SCANNING, SECRET_DETECTION, COVERAGE_FUZZING, API_FUZZING, CLUSTER_IMAGE_SCANNING, or GENERIC.","provider":"go.mondoo.com/mql/providers/gitlab"},"resolvedAt":{"name":"resolvedAt","type":"\t","is_mandatory":true,"title":"When the vulnerability was resolved","provider":"go.mondoo.com/mql/providers/gitlab"},"resolvedBy":{"name":"resolvedBy","type":"\u001bgitlab.user","title":"User who resolved the vulnerability","provider":"go.mondoo.com/mql/providers/gitlab"},"resolvedOnDefaultBranch":{"name":"resolvedOnDefaultBranch","type":"\u0004","is_mandatory":true,"title":"Whether the finding is still present on the project's default branch","provider":"go.mondoo.com/mql/providers/gitlab"},"scanner":{"name":"scanner","type":"\u001bgitlab.project.vulnerability.scanner","title":"Scanner that produced this finding","provider":"go.mondoo.com/mql/providers/gitlab"},"severity":{"name":"severity","type":"\u0007","is_mandatory":true,"title":"Severity","desc":"One of INFO, UNKNOWN, LOW, MEDIUM, HIGH, or CRITICAL.","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Workflow state","desc":"One of DETECTED, CONFIRMED, RESOLVED, or DISMISSED.","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Short summary of the finding","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Web URL to the vulnerability detail page in GitLab","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Security scanner finding from a GitLab project","desc":"Confirmed vulnerabilities surfaced by GitLab's built-in security scanners: SAST, DAST, dependency scanning, secret detection, and container scanning. Filter by `severity`, `state`, or `reportType` to drive audit queries: open CRITICAL findings, undismissed secrets in commits, or unresolved CVEs in dependencies. Use `scanner` to attribute a finding to the tool that produced it and `identifiers` to look up the corresponding CVE, CWE, or OWASP entry.  Requires GitLab Ultimate; on lower tiers the resource returns an empty list.","private":true,"min_provider_version":"13.3.1","defaults":"severity state reportType title","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.vulnerability.scanner":{"id":"gitlab.project.vulnerability.scanner","name":"gitlab.project.vulnerability.scanner","fields":{"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"Scanner ID as referenced in the security report artifact","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Scanner global ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable scanner name (e.g., \"GitLab SAST\", \"Trivy\", \"Gemnasium\")","provider":"go.mondoo.com/mql/providers/gitlab"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Vendor that ships the scanner (e.g., \"GitLab\")","provider":"go.mondoo.com/mql/providers/gitlab"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Scanner version","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Security scanner that produced a vulnerability finding","private":true,"min_provider_version":"13.3.1","defaults":"name vendor","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.project.webhook":{"id":"gitlab.project.webhook","name":"gitlab.project.webhook","fields":{"alertStatus":{"name":"alertStatus","type":"\u0007","is_mandatory":true,"title":"Delivery health of the webhook","desc":"One of executable (delivering normally), disabled (permanently turned off after repeated delivery failures), or temporarily_disabled (auto-paused after recent failures, with disabledUntil giving the resume time).","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"branchFilterStrategy":{"name":"branchFilterStrategy","type":"\u0007","is_mandatory":true,"title":"Strategy used to filter branches for push events: all_branches, wildcard, or regex","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialIssuesEvents":{"name":"confidentialIssuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential issues events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"confidentialNoteEvents":{"name":"confidentialNoteEvents","type":"\u0004","is_mandatory":true,"title":"Whether confidential note events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Webhook creation time","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"customHeaders":{"name":"customHeaders","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom HTTP headers sent with the webhook request","desc":"Keyed by header name (for example an `Authorization` or custom `X-*` header) with the configured header value. GitLab redacts the values of headers it treats as secret, so those entries may be empty or masked.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"customWebhookTemplate":{"name":"customWebhookTemplate","type":"\u0007","is_mandatory":true,"title":"Custom webhook payload template configured for this hook (empty when default payload is used)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"deploymentEvents":{"name":"deploymentEvents","type":"\u0004","is_mandatory":true,"title":"Whether deployment events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Webhook description","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"disabledUntil":{"name":"disabledUntil","type":"\t","is_mandatory":true,"title":"Time until which the webhook is disabled (set by GitLab when too many failures occur)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"emojiEvents":{"name":"emojiEvents","type":"\u0004","is_mandatory":true,"title":"Whether emoji events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"featureFlagEvents":{"name":"featureFlagEvents","type":"\u0004","is_mandatory":true,"title":"Whether feature flag events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Webhook ID","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"issuesEvents":{"name":"issuesEvents","type":"\u0004","is_mandatory":true,"title":"Whether issues events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"jobEvents":{"name":"jobEvents","type":"\u0004","is_mandatory":true,"title":"Whether job events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsEvents":{"name":"mergeRequestsEvents","type":"\u0004","is_mandatory":true,"title":"Whether merge request events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"milestoneEvents":{"name":"milestoneEvents","type":"\u0004","is_mandatory":true,"title":"Whether milestone events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Webhook display name","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"noteEvents":{"name":"noteEvents","type":"\u0004","is_mandatory":true,"title":"Whether note (comment) events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"pipelineEvents":{"name":"pipelineEvents","type":"\u0004","is_mandatory":true,"title":"Whether pipeline events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"project":{"name":"project","type":"\u001bgitlab.project","title":"The project this webhook is registered against","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEvents":{"name":"pushEvents","type":"\u0004","is_mandatory":true,"title":"Whether push events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEventsBranchFilter":{"name":"pushEventsBranchFilter","type":"\u0007","is_mandatory":true,"title":"Branch filter for push events","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"releasesEvents":{"name":"releasesEvents","type":"\u0004","is_mandatory":true,"title":"Whether release events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"repositoryUpdateEvents":{"name":"repositoryUpdateEvents","type":"\u0004","is_mandatory":true,"title":"Whether repository update events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"resourceAccessTokenEvents":{"name":"resourceAccessTokenEvents","type":"\u0004","is_mandatory":true,"title":"Whether resource access token events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"sslVerification":{"name":"sslVerification","type":"\u0004","is_mandatory":true,"title":"Whether TLS certificate verification is enabled for webhook delivery","desc":"When false, GitLab does not validate the receiving endpoint's TLS certificate, which permits man-in-the-middle interception of the webhook payload and any secret token sent with it.","provider":"go.mondoo.com/mql/providers/gitlab"},"tagPushEvents":{"name":"tagPushEvents","type":"\u0004","is_mandatory":true,"title":"Whether tag push events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"tokenPresent":{"name":"tokenPresent","type":"\u0004","is_mandatory":true,"title":"Whether a secret token is configured on the webhook","desc":"The receiver uses that token to confirm a payload really came from GitLab. Without one, anything that learns the webhook URL can post a payload the receiver treats as genuine. The token value is write-only and is never returned. Null on instances that do not report token presence.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Webhook URL","provider":"go.mondoo.com/mql/providers/gitlab"},"urlVariables":{"name":"urlVariables","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"URL variables interpolated into the webhook URL","desc":"Keyed by variable name, with the value substituted into `{name}` placeholders in the webhook url. Values GitLab treats as secret are redacted, so they may be empty or masked.","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"vulnerabilityEvents":{"name":"vulnerabilityEvents","type":"\u0004","is_mandatory":true,"title":"Whether vulnerability events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"wikiPageEvents":{"name":"wikiPageEvents","type":"\u0004","is_mandatory":true,"title":"Whether wiki page events trigger the webhook","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab project webhook","desc":"HTTP callback registered against a project that GitLab invokes to deliver event payloads to an external endpoint whenever selected activity occurs, such as pushes, merge requests, or pipeline runs. Audit webhooks to confirm payloads reach only trusted destinations over a verified TLS connection: url is the delivery target and sslVerification reports whether the receiver's certificate is validated. The per-event boolean fields (pushEvents, mergeRequestsEvents, pipelineEvents, and the rest) show which activity is sent to that endpoint. The configured secret token is never returned by the API, so its presence cannot be read here; confirm token configuration through the GitLab UI or audit logs.","private":true,"min_provider_version":"11.1.13","defaults":"url sslVerification","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.protectedBranch":{"id":"gitlab.protectedBranch","fields":{"accessLevel":{"name":"accessLevel","type":"\u001bgitlab.protectedBranch.accessLevel","title":"GitLab protected-branch access level","desc":"A single access grant on a protected branch, describing who may perform the push, merge, or unprotect action. Each entry grants access either to a role (via `accessLevel`), a specific `user`, a specific `group`, or a deploy key (via `deployKeyId`). Exactly one of these targets is set per grant; the others are null or zero.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true}},"is_extension":true},"gitlab.protectedBranch.accessLevel":{"id":"gitlab.protectedBranch.accessLevel","name":"gitlab.protectedBranch.accessLevel","fields":{"accessLevel":{"name":"accessLevel","type":"\u0005","is_mandatory":true,"title":"Numeric access level (0 No access, 30 Developer, 40 Maintainer, 60 Admin)","provider":"go.mondoo.com/mql/providers/gitlab"},"accessLevelDescription":{"name":"accessLevelDescription","type":"\u0007","is_mandatory":true,"title":"Human-readable description of the access level","provider":"go.mondoo.com/mql/providers/gitlab"},"deployKeyId":{"name":"deployKeyId","type":"\u0005","is_mandatory":true,"title":"ID of the deploy key granted access, or 0 when the grant does not target a deploy key","provider":"go.mondoo.com/mql/providers/gitlab"},"group":{"name":"group","type":"\u001bgitlab.group","title":"Group granted access, when the grant targets a specific group (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"User granted access, when the grant targets a specific user (null otherwise)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab protected-branch access level","desc":"A single access grant on a protected branch, describing who may perform the push, merge, or unprotect action. Each entry grants access either to a role (via `accessLevel`), a specific `user`, a specific `group`, or a deploy key (via `deployKeyId`). Exactly one of these targets is set per grant; the others are null or zero.","private":true,"min_provider_version":"13.3.9","defaults":"accessLevel accessLevelDescription","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.settings":{"id":"gitlab.settings","name":"gitlab.settings","fields":{"adminMode":{"name":"adminMode","type":"\u0004","is_mandatory":true,"title":"Whether administrators must re-authenticate before using administrator rights","desc":"False lets an account that holds administrator rights exercise them continuously for the whole session. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"allowLocalRequestsFromSystemHooks":{"name":"allowLocalRequestsFromSystemHooks","type":"\u0004","is_mandatory":true,"title":"Whether system hooks may send requests to the local network (SSRF exposure)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"allowLocalRequestsFromWebHooksAndServices":{"name":"allowLocalRequestsFromWebHooksAndServices","type":"\u0004","is_mandatory":true,"title":"Whether webhooks and integrations may send requests to the local network (SSRF exposure)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"allowRunnerRegistrationToken":{"name":"allowRunnerRegistrationToken","type":"\u0004","is_mandatory":true,"title":"Whether runner registration tokens are still accepted","desc":"The legacy registration flow uses one long-lived, non-expiring token shared across every runner registered with it, so a leaked copy keeps working until the token is rotated by hand. True leaves that path open alongside the newer per-runner authentication tokens. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"application":{"name":"application","type":"\u001bgitlab.settings.application","title":"GitLab OAuth application","desc":"An OAuth application registered on the instance, which can exchange an authorization for a token that acts on a user's behalf. The `confidential` field reports whether the application is able to hold a client secret and `redirectUris` lists the destinations an authorization code may be returned to, the pair that decides whether an intercepted authorization can be redeemed by someone else. The client secret is never reported.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"applications":{"name":"applications","type":"\u0019\u001bgitlab.settings.application","title":"OAuth applications registered on the instance","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"deactivateDormantUsers":{"name":"deactivateDormantUsers","type":"\u0004","is_mandatory":true,"title":"Whether accounts that have not signed in for a set period are deactivated automatically","desc":"Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"deactivateDormantUsersPeriod":{"name":"deactivateDormantUsersPeriod","type":"\u0005","is_mandatory":true,"title":"Days of inactivity before an account is treated as dormant","desc":"Takes effect only while deactivateDormantUsers is true. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"defaultGroupVisibility":{"name":"defaultGroupVisibility","type":"\u0007","is_mandatory":true,"title":"The default group visibility (private, internal, public)","provider":"go.mondoo.com/mql/providers/gitlab"},"defaultProjectVisibility":{"name":"defaultProjectVisibility","type":"\u0007","is_mandatory":true,"title":"The default project visibility (private, internal, public)","provider":"go.mondoo.com/mql/providers/gitlab"},"disablePasswordAuthenticationForUsersWithSsoIdentities":{"name":"disablePasswordAuthenticationForUsersWithSsoIdentities","type":"\u0004","is_mandatory":true,"title":"Whether users linked to an identity provider are barred from signing in with a local password","desc":"False leaves a password fallback in place for those users, so the identity provider's own controls, including its multi-factor requirement, can be sidestepped. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"disabledOauthSignInSources":{"name":"disabledOauthSignInSources","type":"\u0019\u0007","is_mandatory":true,"title":"OAuth sign-in sources that are disabled (for example google_oauth2, github)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"domainAllowlist":{"name":"domainAllowlist","type":"\u0019\u0007","is_mandatory":true,"title":"Email domains allowed to sign up (empty means no allowlist)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"domainDenylist":{"name":"domainDenylist","type":"\u0019\u0007","is_mandatory":true,"title":"Email domains denied from signing up","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"domainDenylistEnabled":{"name":"domainDenylistEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the sign-up email domain denylist is enforced","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"dsaKeyRestriction":{"name":"dsaKeyRestriction","type":"\u0005","is_mandatory":true,"title":"Minimum DSA key size, in bits, accepted for uploaded SSH keys","desc":"A value of -1 refuses DSA keys outright and 0 accepts any size. Any other value is the minimum bit length. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"duoFeaturesEnabled":{"name":"duoFeaturesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether GitLab Duo AI features are enabled for the instance","desc":"Reads false when the instance does not support or has not enabled Duo; older GitLab versions do not report this field.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ecdsaKeyRestriction":{"name":"ecdsaKeyRestriction","type":"\u0005","is_mandatory":true,"title":"Minimum ECDSA key size, in bits, accepted for uploaded SSH keys","desc":"A value of -1 refuses ECDSA keys outright and 0 accepts any size. Any other value is the minimum bit length. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ecdsaSkKeyRestriction":{"name":"ecdsaSkKeyRestriction","type":"\u0005","is_mandatory":true,"title":"Minimum ECDSA key size, in bits, accepted for uploaded FIDO security key SSH keys","desc":"A value of -1 refuses ECDSA security keys outright and 0 accepts any size. Any other value is the minimum bit length. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ed25519KeyRestriction":{"name":"ed25519KeyRestriction","type":"\u0005","is_mandatory":true,"title":"Whether Ed25519 SSH keys are accepted, expressed as a size restriction","desc":"A value of -1 refuses Ed25519 keys and 0 accepts them. Ed25519 has a fixed key size, so no other value carries meaning. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"ed25519SkKeyRestriction":{"name":"ed25519SkKeyRestriction","type":"\u0005","is_mandatory":true,"title":"Whether Ed25519 FIDO security key SSH keys are accepted, expressed as a size restriction","desc":"A value of -1 refuses Ed25519 security keys and 0 accepts them. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"enforceCiInboundJobTokenScopeEnabled":{"name":"enforceCiInboundJobTokenScopeEnabled","type":"\u0004","is_mandatory":true,"title":"Whether every project on the instance must keep its inbound CI job token allowlist switched on","desc":"The instance-wide backstop behind the per-project ciJobTokenScopeEnabled setting. False lets an individual project opt out and accept a job token issued to any other project on the instance. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"enforcePatExpiration":{"name":"enforcePatExpiration","type":"\u0004","is_mandatory":true,"title":"Whether personal access tokens are required to have an expiration date","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"enforceSshKeyExpiration":{"name":"enforceSshKeyExpiration","type":"\u0004","is_mandatory":true,"title":"Whether SSH keys are required to have an expiration date","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"externalAuthorizationServiceEnabled":{"name":"externalAuthorizationServiceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether an external authorization service gates project access","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"failedLoginAttemptsUnlockPeriodInMinutes":{"name":"failedLoginAttemptsUnlockPeriodInMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes a locked account stays locked after too many failed sign-in attempts","desc":"Null when a locked account is never released automatically, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"gitTwoFactorSessionExpiry":{"name":"gitTwoFactorSessionExpiry","type":"\u0005","is_mandatory":true,"title":"Session expiry for Git operations when 2FA is enabled (in minutes)","provider":"go.mondoo.com/mql/providers/gitlab"},"groupRunnerTokenExpirationInterval":{"name":"groupRunnerTokenExpirationInterval","type":"\u0005","is_mandatory":true,"title":"Rotation interval, in seconds, for group runner authentication tokens","desc":"Null when no rotation interval is configured, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Settings ID","provider":"go.mondoo.com/mql/providers/gitlab"},"importSources":{"name":"importSources","type":"\u0019\u0007","is_mandatory":true,"title":"Enabled project import sources (for example github, bitbucket, git)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"lockDuoFeaturesEnabled":{"name":"lockDuoFeaturesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the GitLab Duo features toggle is locked so groups and projects cannot override it","desc":"Reads false on instances that do not report this setting.","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"loginRecaptchaProtectionEnabled":{"name":"loginRecaptchaProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a CAPTCHA is presented after repeated failed sign-in attempts","desc":"Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"maxLoginAttempts":{"name":"maxLoginAttempts","type":"\u0005","is_mandatory":true,"title":"Number of failed sign-in attempts before an account is locked","desc":"Null when the instance does not lock accounts after repeated failures, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"maxPersonalAccessTokenLifetime":{"name":"maxPersonalAccessTokenLifetime","type":"\u0005","is_mandatory":true,"title":"Maximum lifetime, in days, allowed for a personal access token","desc":"Null when the instance sets no ceiling on token lifetime, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"minimumPasswordLength":{"name":"minimumPasswordLength","type":"\u0005","is_mandatory":true,"title":"Minimum length required for new passwords","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"notifyOnUnknownSignIn":{"name":"notifyOnUnknownSignIn","type":"\u0004","is_mandatory":true,"title":"Whether users are notified of sign-ins from unrecognized IP addresses","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"packageRegistryAllowAnyoneToPullOption":{"name":"packageRegistryAllowAnyoneToPullOption","type":"\u0004","is_mandatory":true,"title":"Whether packages may be pulled from the package registry without authentication","desc":"True lets a project make its published packages readable by anyone who can reach the instance. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordAuthenticationEnabledForGit":{"name":"passwordAuthenticationEnabledForGit","type":"\u0004","is_mandatory":true,"title":"Whether password authentication is enabled for Git over HTTP(S)","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordAuthenticationEnabledForWeb":{"name":"passwordAuthenticationEnabledForWeb","type":"\u0004","is_mandatory":true,"title":"Whether password authentication is enabled for the web interface","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordLowercaseRequired":{"name":"passwordLowercaseRequired","type":"\u0004","is_mandatory":true,"title":"Whether new passwords must contain a lowercase letter","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordNumberRequired":{"name":"passwordNumberRequired","type":"\u0004","is_mandatory":true,"title":"Whether new passwords must contain a number","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordSymbolRequired":{"name":"passwordSymbolRequired","type":"\u0004","is_mandatory":true,"title":"Whether new passwords must contain a symbol","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"passwordUppercaseRequired":{"name":"passwordUppercaseRequired","type":"\u0004","is_mandatory":true,"title":"Whether new passwords must contain an uppercase letter","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"projectRunnerTokenExpirationInterval":{"name":"projectRunnerTokenExpirationInterval","type":"\u0005","is_mandatory":true,"title":"Rotation interval, in seconds, for project runner authentication tokens","desc":"Null when no rotation interval is configured, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"protectedCiVariables":{"name":"protectedCiVariables","type":"\u0004","is_mandatory":true,"title":"Whether CI/CD variables are protected by default","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"requireAdminApprovalAfterUserSignup":{"name":"requireAdminApprovalAfterUserSignup","type":"\u0004","is_mandatory":true,"title":"Whether new sign-ups require administrator approval before activation","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"requireAdminTwoFactorAuthentication":{"name":"requireAdminTwoFactorAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether two-factor authentication is required for administrators","provider":"go.mondoo.com/mql/providers/gitlab"},"requirePersonalAccessTokenExpiry":{"name":"requirePersonalAccessTokenExpiry","type":"\u0004","is_mandatory":true,"title":"Whether new personal access tokens must be given an expiration date","desc":"Distinct from enforcePatExpiration, which decides whether a token that has already passed its expiry stops working. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"requireTwoFactorAuthentication":{"name":"requireTwoFactorAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether all users are required to set up two-factor authentication","provider":"go.mondoo.com/mql/providers/gitlab"},"rsaKeyRestriction":{"name":"rsaKeyRestriction","type":"\u0005","is_mandatory":true,"title":"Minimum RSA key size, in bits, accepted for uploaded SSH keys","desc":"A value of -1 refuses RSA keys outright and 0 accepts any size. Any other value is the minimum bit length. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"runnerTokenExpirationInterval":{"name":"runnerTokenExpirationInterval","type":"\u0005","is_mandatory":true,"title":"Rotation interval, in seconds, for instance runner authentication tokens","desc":"Null when no rotation interval is configured, and on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"serviceAccessTokensExpirationEnforced":{"name":"serviceAccessTokensExpirationEnforced","type":"\u0004","is_mandatory":true,"title":"Whether service account access tokens are forced to expire","desc":"Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"sessionExpireDelay":{"name":"sessionExpireDelay","type":"\u0005","is_mandatory":true,"title":"Web session expiry, in minutes","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sessionExpireFromInit":{"name":"sessionExpireFromInit","type":"\u0004","is_mandatory":true,"title":"Whether a web session expires a fixed time after sign-in rather than after idle time","desc":"Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"signupEnabled":{"name":"signupEnabled","type":"\u0004","is_mandatory":true,"title":"Whether new user registration is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"systemHook":{"name":"systemHook","type":"\u001bgitlab.settings.systemHook","title":"GitLab system hook","desc":"An instance-wide hook that receives events from every project and group on the instance, a tier above the project and group webhooks. The `url` field is the destination, `sslVerification` reports whether GitLab validates that endpoint's certificate, and `tokenPresent` reports whether a secret token is configured for the receiver to authenticate payloads with.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"systemHooks":{"name":"systemHooks","type":"\u0019\u001bgitlab.settings.systemHook","title":"System hooks registered on the instance","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"terminalMaxSessionTime":{"name":"terminalMaxSessionTime","type":"\u0005","is_mandatory":true,"title":"Maximum web-terminal session time, in seconds","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"twoFactorGracePeriod":{"name":"twoFactorGracePeriod","type":"\u0005","is_mandatory":true,"title":"Time (in hours) users are allowed to skip forced 2FA configuration","provider":"go.mondoo.com/mql/providers/gitlab"},"uniqueIpsLimitEnabled":{"name":"uniqueIpsLimitEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the number of IP addresses one user may sign in from is capped","desc":"Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"uniqueIpsLimitPerUser":{"name":"uniqueIpsLimitPerUser","type":"\u0005","is_mandatory":true,"title":"Maximum number of distinct IP addresses a single user may sign in from","desc":"Takes effect only while uniqueIpsLimitEnabled is true. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"uniqueIpsLimitTimeWindow":{"name":"uniqueIpsLimitTimeWindow","type":"\u0005","is_mandatory":true,"title":"Window, in seconds, over which distinct sign-in IP addresses are counted","desc":"Takes effect only while uniqueIpsLimitEnabled is true. Null on instances that do not report the setting.","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update time","provider":"go.mondoo.com/mql/providers/gitlab"},"variable":{"name":"variable","type":"\u001bgitlab.settings.variable","title":"Instance-scope CI/CD variable","desc":"A CI/CD variable defined at instance scope, which is injected into every pipeline that runs anywhere on the instance and therefore has the widest blast radius of any variable tier. The `key` field names the variable and `masked`, `protected`, and `variableType` describe how its value is handled. The value itself is never reported.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"variables":{"name":"variables","type":"\u0019\u001bgitlab.settings.variable","title":"CI/CD variables defined at instance scope","min_provider_version":"13.6.2","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab Instance Application Settings","desc":"Instance-wide security and configuration settings for a self-managed GitLab deployment, readable only with an admin token. These settings govern the whole instance rather than any single project or group, which makes them the primary control surface for hardening audits: two-factor enforcement and grace periods, web and Git password authentication, new-user registration and admin approval, sign-up domain allow/deny lists, password-complexity minimums, token and SSH key expiration enforcement, default project and group visibility, and SSRF-relevant toggles that let hooks and integrations reach the local network. It also covers the credential lifecycle policy (token expiry ceilings, runner token rotation, and the SSH key algorithms and sizes the instance will accept), sign-in hardening (lockout thresholds, concurrent sign-in IP limits, and whether users linked to an identity provider keep a local password fallback), the instance-wide CI job token allowlist enforcement, and the instance-scope CI/CD variables, system hooks, and OAuth applications registered on it.","min_provider_version":"13.0.3","defaults":"requireTwoFactorAuthentication","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.settings.application":{"id":"gitlab.settings.application","name":"gitlab.settings.application","fields":{"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OAuth client identifier issued to the application","provider":"go.mondoo.com/mql/providers/gitlab"},"confidential":{"name":"confidential","type":"\u0004","is_mandatory":true,"title":"Whether the application is able to hold a client secret","desc":"False marks a public client, such as a single-page or mobile app, which cannot authenticate itself when redeeming an authorization code.","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Application ID","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application display name","provider":"go.mondoo.com/mql/providers/gitlab"},"redirectUris":{"name":"redirectUris","type":"\u0019\u0007","is_mandatory":true,"title":"Destinations an authorization code may be returned to","desc":"One entry per redirect URI configured on the application. A wildcard or otherwise broad entry lets an authorization code be delivered to a host the application does not control.","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"OAuth scopes the application may request","desc":"Null on instances that do not report scopes when listing applications.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab OAuth application","desc":"An OAuth application registered on the instance, which can exchange an authorization for a token that acts on a user's behalf. The `confidential` field reports whether the application is able to hold a client secret and `redirectUris` lists the destinations an authorization code may be returned to, the pair that decides whether an intercepted authorization can be redeemed by someone else. The client secret is never reported.","private":true,"min_provider_version":"13.6.2","defaults":"name confidential redirectUris","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.settings.systemHook":{"id":"gitlab.settings.systemHook","name":"gitlab.settings.systemHook","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Hook creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Hook description","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"System hook ID","provider":"go.mondoo.com/mql/providers/gitlab"},"mergeRequestsEvents":{"name":"mergeRequestsEvents","type":"\u0004","is_mandatory":true,"title":"Whether merge request events trigger the hook","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Hook display name","provider":"go.mondoo.com/mql/providers/gitlab"},"pushEvents":{"name":"pushEvents","type":"\u0004","is_mandatory":true,"title":"Whether push events trigger the hook","provider":"go.mondoo.com/mql/providers/gitlab"},"repositoryUpdateEvents":{"name":"repositoryUpdateEvents","type":"\u0004","is_mandatory":true,"title":"Whether repository update events trigger the hook","desc":"Null on instances that do not report the trigger, so that a hook whose state could not be read is not reported as having the trigger switched off.","provider":"go.mondoo.com/mql/providers/gitlab"},"sslVerification":{"name":"sslVerification","type":"\u0004","is_mandatory":true,"title":"Whether TLS certificate verification is enabled for hook delivery","desc":"When false, GitLab does not validate the receiving endpoint's TLS certificate, which permits man-in-the-middle interception of the payload and any secret token sent with it.","provider":"go.mondoo.com/mql/providers/gitlab"},"tagPushEvents":{"name":"tagPushEvents","type":"\u0004","is_mandatory":true,"title":"Whether tag push events trigger the hook","provider":"go.mondoo.com/mql/providers/gitlab"},"tokenPresent":{"name":"tokenPresent","type":"\u0004","is_mandatory":true,"title":"Whether a secret token is configured on the hook","desc":"The receiver uses that token to confirm a payload really came from GitLab. Without one, anything that learns the hook URL can post a payload the receiver treats as genuine. The token value is write-only and is never returned. Null on instances that do not report token presence.","provider":"go.mondoo.com/mql/providers/gitlab"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Destination URL the hook posts to","provider":"go.mondoo.com/mql/providers/gitlab"},"urlVariables":{"name":"urlVariables","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"URL variables interpolated into the hook URL","desc":"Keyed by variable name, with the value substituted into `{name}` placeholders in the hook url. Values GitLab treats as secret are redacted, so they may be empty or masked.","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab system hook","desc":"An instance-wide hook that receives events from every project and group on the instance, a tier above the project and group webhooks. The `url` field is the destination, `sslVerification` reports whether GitLab validates that endpoint's certificate, and `tokenPresent` reports whether a secret token is configured for the receiver to authenticate payloads with.","private":true,"min_provider_version":"13.6.2","defaults":"url sslVerification tokenPresent","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.settings.variable":{"id":"gitlab.settings.variable","name":"gitlab.settings.variable","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Variable description","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Variable key","provider":"go.mondoo.com/mql/providers/gitlab"},"masked":{"name":"masked","type":"\u0004","is_mandatory":true,"title":"Whether the variable value is masked in job logs","provider":"go.mondoo.com/mql/providers/gitlab"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the variable is exposed only to pipelines on protected branches and tags","provider":"go.mondoo.com/mql/providers/gitlab"},"raw":{"name":"raw","type":"\u0004","is_mandatory":true,"title":"Whether the variable is passed to jobs without variable expansion","provider":"go.mondoo.com/mql/providers/gitlab"},"variableType":{"name":"variableType","type":"\u0007","is_mandatory":true,"title":"Variable type, either env_var or file","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Instance-scope CI/CD variable","desc":"A CI/CD variable defined at instance scope, which is injected into every pipeline that runs anywhere on the instance and therefore has the widest blast radius of any variable tier. The `key` field names the variable and `masked`, `protected`, and `variableType` describe how its value is handled. The value itself is never reported.","private":true,"min_provider_version":"13.6.2","defaults":"key masked protected","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.user":{"id":"gitlab.user","name":"gitlab.user","fields":{"avatarURL":{"name":"avatarURL","type":"\u0007","is_mandatory":true,"title":"Avatar URL","provider":"go.mondoo.com/mql/providers/gitlab"},"bot":{"name":"bot","type":"\u0004","is_mandatory":true,"title":"Whether this is a bot account","provider":"go.mondoo.com/mql/providers/gitlab"},"canCreateGroup":{"name":"canCreateGroup","type":"\u0004","title":"Whether the user can create top-level groups","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"canCreateOrganization":{"name":"canCreateOrganization","type":"\u0004","title":"Whether the user can create organizations","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"canCreateProject":{"name":"canCreateProject","type":"\u0004","title":"Whether the user can create personal projects","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"confirmedAt":{"name":"confirmedAt","type":"\t","title":"Time when the user's email was confirmed","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Account creation date","provider":"go.mondoo.com/mql/providers/gitlab"},"createdBy":{"name":"createdBy","type":"\u001bgitlab.user","title":"User who created this account (null when unknown)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"currentSignInAt":{"name":"currentSignInAt","type":"\t","title":"Time of the user's current sign-in","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"currentSignInIp":{"name":"currentSignInIp","type":"\u0007","title":"IP address of the current session's sign-in (admin-only; empty otherwise)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address","provider":"go.mondoo.com/mql/providers/gitlab"},"emails":{"name":"emails","type":"\u0019\u001bgitlab.user.email","title":"Email addresses registered to this user (requires admin or self-access)","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"external":{"name":"external","type":"\u0004","title":"Whether the user is marked as external","desc":"Externals get read-only access by default and cannot create groups, projects, or namespaces.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"externalIdentities":{"name":"externalIdentities","type":"\u0019\u001bgitlab.user.externalIdentity","title":"External SSO identities linked to this user (SAML, LDAP, OAuth providers, etc.)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"externalIdentity":{"name":"externalIdentity","type":"\u001bgitlab.user.externalIdentity","title":"External SSO identity linked to a GitLab user (SAML, LDAP, OAuth provider, etc.)","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"User ID","provider":"go.mondoo.com/mql/providers/gitlab"},"isAdmin":{"name":"isAdmin","type":"\u0004","title":"Whether the user has the instance Administrator role","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"isAuditor":{"name":"isAuditor","type":"\u0004","title":"Whether the user has the Auditor role (read-only access across the instance)","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"jobTitle":{"name":"jobTitle","type":"\u0007","is_mandatory":true,"title":"Job title","provider":"go.mondoo.com/mql/providers/gitlab"},"lastActivityOn":{"name":"lastActivityOn","type":"\t","title":"Date of the user's most recent activity (commit, comment, etc.)","desc":"The API returns this as a date with no time-of-day component.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"lastSignInAt":{"name":"lastSignInAt","type":"\t","title":"Time of the user's most recent prior sign-in","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"lastSignInIp":{"name":"lastSignInIp","type":"\u0007","title":"IP address of the most recent sign-in (admin-only; empty otherwise)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Geographic location","provider":"go.mondoo.com/mql/providers/gitlab"},"locked":{"name":"locked","type":"\u0004","is_mandatory":true,"title":"Whether the account is locked","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/gitlab"},"note":{"name":"note","type":"\u0007","title":"Administrator note attached to the user account","desc":"Often used to record the reason an account is restricted, banned, or kept under review.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"organization":{"name":"organization","type":"\u0007","is_mandatory":true,"title":"Organization name","provider":"go.mondoo.com/mql/providers/gitlab"},"personalAccessToken":{"name":"personalAccessToken","type":"\u001bgitlab.user.personalAccessToken","title":"GitLab personal access token","desc":"Personal access token belonging to a user, with the fields needed to audit over-scoped, stale, or non-expiring credentials: the `scopes` it grants, whether it is `active` or `revoked`, and its `expiresAt` and `lastUsedAt` timestamps.","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"personalAccessTokens":{"name":"personalAccessTokens","type":"\u0019\u001bgitlab.user.personalAccessToken","title":"Personal access tokens belonging to this user (requires admin or self-access)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"privateProfile":{"name":"privateProfile","type":"\u0004","title":"Whether the user's profile is private","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"projectsLimit":{"name":"projectsLimit","type":"\u0005","title":"Maximum number of projects the user may create","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"publicEmail":{"name":"publicEmail","type":"\u0007","title":"Publicly visible email address","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sharedRunnersMinutesLimit":{"name":"sharedRunnersMinutesLimit","type":"\u0005","title":"Monthly shared-runner CI minutes quota (0 means unlimited)","min_provider_version":"13.3.9","provider":"go.mondoo.com/mql/providers/gitlab"},"sshKey":{"name":"sshKey","type":"\u001bgitlab.user.sshKey","title":"SSH key registered to a GitLab user account","is_private":true,"provider":"go.mondoo.com/mql/providers/gitlab","is_implicit_resource":true},"sshKeys":{"name":"sshKeys","type":"\u0019\u001bgitlab.user.sshKey","title":"SSH keys registered for this user (requires admin or self-access)","min_provider_version":"13.0.8","provider":"go.mondoo.com/mql/providers/gitlab"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"User state (active, blocked, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"},"twoFactorEnabled":{"name":"twoFactorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether two-factor authentication is enabled","provider":"go.mondoo.com/mql/providers/gitlab"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"GitLab login name (handle) of the user","provider":"go.mondoo.com/mql/providers/gitlab"},"usingLicenseSeat":{"name":"usingLicenseSeat","type":"\u0004","title":"Whether the user is currently consuming a paid license seat","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/gitlab"},"webURL":{"name":"webURL","type":"\u0007","is_mandatory":true,"title":"Web URL to user profile","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab user","desc":"User account on a GitLab instance, keyed by numeric id (for example `gitlab.user(id: 42)`). Covers basic identity (username, name, email, avatar), account state (locked, bot, twoFactorEnabled), profile metadata (jobTitle, organization, location), linked SSO identities and SSH keys, and admin-scoped fields such as isAdmin, isAuditor, external, the sign-in and activity timestamps, and note. The admin-scoped fields require the calling token to be able to read `/users/:id`. With a non-admin token they return zero values rather than failing the resource graph, and a one-time warning is emitted at runtime when this fallback is hit.","min_provider_version":"11.1.129","defaults":"username name state","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.user.email":{"id":"gitlab.user.email","name":"gitlab.user.email","fields":{"confirmedAt":{"name":"confirmedAt","type":"\t","is_mandatory":true,"title":"When the email address was confirmed; null when the address is unconfirmed","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Email ID","min_provider_version":"13.4.2","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"Email address registered to a GitLab user account","desc":"Email address linked to a user account and whether it has been confirmed. Unconfirmed addresses (`confirmedAt` is null) can indicate a pending account takeover or an unverified secondary identity. Requires the calling token to be able to read the user's emails (admin or self-access).","private":true,"min_provider_version":"11.1.129","defaults":"email confirmedAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.user.externalIdentity":{"id":"gitlab.user.externalIdentity","name":"gitlab.user.externalIdentity","fields":{"externUID":{"name":"externUID","type":"\u0007","is_mandatory":true,"title":"External identifier within the provider","provider":"go.mondoo.com/mql/providers/gitlab"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Identity provider name (e.g., saml, ldapmain, google_oauth2, github)","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"The GitLab user this identity is linked to","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"External SSO identity linked to a GitLab user (SAML, LDAP, OAuth provider, etc.)","private":true,"min_provider_version":"13.0.8","defaults":"provider externUID","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.user.personalAccessToken":{"id":"gitlab.user.personalAccessToken","name":"gitlab.user.personalAccessToken","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the token is active","provider":"go.mondoo.com/mql/providers/gitlab"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the token was created","provider":"go.mondoo.com/mql/providers/gitlab"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the token","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"When the token expires; null when it never expires","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Token ID","provider":"go.mondoo.com/mql/providers/gitlab"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"When the token was last used","provider":"go.mondoo.com/mql/providers/gitlab"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Token name","provider":"go.mondoo.com/mql/providers/gitlab"},"revoked":{"name":"revoked","type":"\u0004","is_mandatory":true,"title":"Whether the token has been revoked","provider":"go.mondoo.com/mql/providers/gitlab"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes granted by the token (api, read_api, read_repository, etc.)","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"GitLab personal access token","desc":"Personal access token belonging to a user, with the fields needed to audit over-scoped, stale, or non-expiring credentials: the `scopes` it grants, whether it is `active` or `revoked`, and its `expiresAt` and `lastUsedAt` timestamps.","private":true,"min_provider_version":"13.3.9","defaults":"name active expiresAt","provider":"go.mondoo.com/mql/providers/gitlab"},"gitlab.user.sshKey":{"id":"gitlab.user.sshKey","name":"gitlab.user.sshKey","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Key creation time","provider":"go.mondoo.com/mql/providers/gitlab"},"daysOld":{"name":"daysOld","type":"\u0005","title":"Age of the key in days since creation","provider":"go.mondoo.com/mql/providers/gitlab"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Key expiration time","provider":"go.mondoo.com/mql/providers/gitlab"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Key ID","provider":"go.mondoo.com/mql/providers/gitlab"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Public SSH key","provider":"go.mondoo.com/mql/providers/gitlab"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Key title","provider":"go.mondoo.com/mql/providers/gitlab"},"usageType":{"name":"usageType","type":"\u0007","is_mandatory":true,"title":"Key usage type (auth, signing, auth_and_signing)","provider":"go.mondoo.com/mql/providers/gitlab"},"user":{"name":"user","type":"\u001bgitlab.user","title":"The GitLab user that owns this SSH key","provider":"go.mondoo.com/mql/providers/gitlab"}},"title":"SSH key registered to a GitLab user account","private":true,"min_provider_version":"13.0.8","defaults":"id title createdAt","provider":"go.mondoo.com/mql/providers/gitlab"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/gitlab":"gitlab.group"}}