nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

GitLab: Integration w/o owner user

Tobias Rahloff

Hi Compass community,

Based on the documentation, it is required to give Compass highly elevated permissions:

do not set expiration date, leave it empty
🛑 set required scopes for the token to “api” and “write_repository”
🛑 select an owner role for the token
have GitLab owner permissions for the group you want to connect

Why is this needed for, essentially, an IDP with DevEx/DORA Metrics BI Dashboard? Unfortunately, this requirement is currently halting the adoption of Compass. Similar tools like LinearB are fine with read-only access.

The only capability I could think of where write access would be needed is to add the `compass automatically.yml` file to repositories.

If this is the reason for owner + repo_write permissions, I think it could be a completely viable to just not use this feature.

Accepted answers

All comments

Josh Campbell_427s4u

Creating merge requests (to add compass.yaml) and future plans to add the Templates feature to GitLab are the primary drivers for needing write permissions. Revisiting the permissions and seeing if we can ask for less and progressively get more (if needed/as Compass features are used) is something we can explore.

Did you try using an incoming webhook by chance?

Tobias Nyholm

Now, over 1 year later, there are still these requirements and I dont see any extra features.

Could you please (in the documentation) list the features that require these permissions so I can easily choose if I am interested or not?
Also: make sure things work without write_repository and owner permissions.