Connect GitLab CI
Connect gitlab.com with OAuth or a self-hosted GitLab instance with an access token — zero code access either way.
TrimCI connects to GitLab CI in two ways: sign in with OAuth on gitlab.com, or paste a Personal, Group, or Project Access Token. Both paths need only the read_api scope, and both end on the same project picker. Whatever happens to the credential later — expiry, revocation — your project list and collected history are never lost.
Simplified illustration — the real screens hold more detail, but the labels and steps match the app.
Step by step
-
Open the connect page
In the sidebar, under SETUP, click Connectors. Press "+ Add connection", then choose "Connect GitLab CI" from the provider grid. The first screen lists exactly what TrimCI accesses (pipelines, jobs, job traces, project names) and what it never touches (source code, CI/CD YAML, merge requests), then asks you to choose a connection method.
-
Option A — sign in with OAuth
Press "Sign in with https://gitlab.com". GitLab shows an authorization screen for TrimCI's read_api scope; approve it and you are redirected straight back. OAuth tokens are short-lived and rotated automatically before expiry — nothing to maintain.
-
Option B — paste an access token
Press "Continue with access token". In GitLab, create a Personal, Group, or Project Access Token named TrimCI with the read_api scope (group tokens are recommended for teams — they survive individual member changes), paste it into the form, and press "Validate and connect". The token is encrypted at rest before storing.
-
Pick projects to track
Both paths land on the "GitLab projects" picker, showing every project the credential can see — private projects included. Tick the ones to analyze and press "Save selection". "Refresh project list" re-reads the catalog after you grant the token access to more projects.
-
Let the first backfill run
Each newly activated project starts a backfill of up to 60 days of pipeline history; its badge switches from "Syncing…" to "Synced" when done. After that, syncing continues incrementally on a schedule, and "Sync now" triggers an immediate pass.
-
Keep an eye on token health
The Connectors page shows each connection's token expiry date, and for access-token connections a "Reconnect" button lets you rotate the token proactively — before it ever expires, with the project selection staying active throughout. TrimCI also emails organization managers 7 days and 1 day before a token expires, and once more after it has expired.
When a credential stops working
A revoked or expired credential never tears the connection down. Syncing pauses, the connection is marked "Paused" on the Connectors page, and managers get an email. Reconnecting swaps the credential in place — the host stays the same, and every project row, sync cursor, and all historical data survive. After reconnecting, re-tick your projects on the picker page; syncing then resumes incrementally from where it stopped, with no fresh backfill.
Simplified illustration — the real screens hold more detail, but the labels and steps match the app.
One organization can hold several GitLab connections at once — for example gitlab.com and a self-hosted instance side by side, one connection per host. Disconnecting one never touches the projects tracked through another, and even a full disconnect keeps your historical pipeline data.
Self-hosted GitLab CE/EE (version 14.0 or newer) is supported, but whether the connect form accepts a custom base URL depends on how the deployment is configured. When the form is locked to gitlab.com, the connect page tells you how to get a self-hosted instance connected. Self-hosted always uses the access-token path, over HTTPS.
GitLab's API has no scope narrower than read_api, so TrimCI enforces its zero-code-access promise itself: a URL allowlist inside the HTTP client permits only pipeline, job, trace, and project-listing endpoints. Any call toward repository files, commits, merge requests, or snippets is refused before the request ever leaves TrimCI's server.