GitLab and Azure DevOps integration

Connecting

In Administration › Integrations, each provider has its own tab. The workspace connects once with a personal access token, which is checked with the provider before it is saved.

• GitLab: gitlab.com or your own self-managed GitLab over https, with a token that has the api scope.
• Azure DevOps: your organization's name and a token with Code (Read & write), Build (Read), Project and Team (Read) and Service Hooks (Read, write & manage).
• The token is stored encrypted, never shown again and can be tested or replaced at any time.
• GitHub, GitLab and Azure DevOps can all be connected at once; each project links the repositories it works with.

Linking repositories and work

• In the project's Configuration › Repositories, choose the provider and search its repositories.
• Linking creates the repository's webhook, with its own address and secret, so changes arrive as they happen.
• Write the item's code, like PBI-364, in a branch, a merge or pull request, a commit message or release notes and it links itself.
• From the item, a branch can be created in the repository already named after it, or a merge request, pull request, branch or commit found by search or pasted by URL.

git switch -c feature/PBI-364-conciliacion
git commit -m "PBI-364 conciliación automática de pagos"
git push -u origin feature/PBI-364-conciliacion

Reviews, pipelines and releases

• GitLab approvals and Azure DevOps reviewer votes show as the review outcome of each merge or pull request.
• GitLab CI pipelines and Azure Pipelines builds show on the items whose branch or commit they ran on, and under Reports › Code & CI.
• GitLab releases mark the items their notes mention as shipped.
• A Deployment with a linked merge or pull request meets the Pull Request requirement to leave Development, and its evidence package lists them.

Security

• Each delivery must carry the repository's own secret — GitLab's token header or Azure DevOps' basic authentication — compared in constant time.
• Deliveries are rate limited, size-limited, reduced to the fields used and processed in the background.
• The server address must use https and can never point to internal addresses; an on-premise install may reach a private network.
• Each project reaches only its own repositories, and each user only the items they can see.