GitLab support via webhook bridge (ADR 0043)

[ggallen]

Context

ADR 0028 (GitLab Support Architecture) was deprecated because the surrounding infrastructure changed significantly since it was written — the token mint (ADR 0029), synchronous dispatch (ADR 0041), reusable workflows (ADR 0031), and per-repo mode (ADR 0033) all shifted the baseline.

Decision

ADR 0043 supersedes ADR 0028 with a webhook bridge architecture:

• Bridge Cloud Function: Translates GitLab webhooks into pipeline triggers, isolating untrusted payload handling from the token mint
• GitLab OIDC via JWKS: Child pipelines authenticate to the mint using GitLab OIDC tokens
• Project Access Tokens: Per-role per-project PATs stored in Secret Manager, distributed through the existing mint model
• Defense in depth: Hardcoded ref, protected CI/CD variables, per-project webhook secrets

Deliverables

• ADR 0043 documenting the architectural decision
• Implementation plan (docs/problems/gitlab-support.md) covering 7 phases
• Implementation (future PRs)

[fullsend-ai-triage]

Triage Summary

Category: Feature | Severity: Medium

This is a well-structured tracking issue for ADR 0043, which supersedes the deprecated ADR 0028 with an updated GitLab support architecture based on a webhook bridge model.

Architecture Overview

• Bridge Cloud Function translates GitLab webhooks into pipeline triggers
• GitLab OIDC via JWKS for child pipeline authentication to the token mint
• Project Access Tokens (per-role, per-project) stored in Secret Manager
• Defense in depth via hardcoded ref, protected CI/CD variables, per-project webhook secrets

Status

• ✅ ADR 0043 documented
• ✅ Implementation plan (7 phases in docs/problems/gitlab-support.md)
• ⬜ Implementation (future PRs)

Related Issues

• Add GitLab CI as a trigger/coordination and compute layer #322 — Broader GitLab CI support feature request (parent scope)
• Forge-portable harness schema (role, slug, forge sections with inheritance) #1605 — Forge-portable harness schema (complementary work)

Proposed Test Case

End-to-end webhook bridge verification:
1. GitLab webhook event → bridge Cloud Function → pipeline trigger
2. Child pipeline authenticates to mint via GitLab OIDC token
3. Mint validates OIDC token against GitLab JWKS endpoint
4. Mint issues scoped PAT for the requesting project/role
5. Defense-in-depth: reject bad webhook secrets, non-protected refs,
   mismatched project IDs
Edge cases: self-managed GitLab custom JWKS, webhook replay,
   expired OIDC tokens

This issue is ready for implementation work following the phased plan.

---

Labels: GitLab webhook bridge is a new feature involving dispatch infrastructure and the token mint, matching component/dispatch and component/mint labels along with type/feature.

[fullsend-ai-prioritize]

RICE Priority Score: 0.8

Score breakdown

Dimension	Score	Reasoning
Reach	1.5	GitLab support expands the platform to a new forge, likely affecting multiple customers who use GitLab instead of GitHub. Related issue #322 suggests ongoing demand. Without customer research data, scoring conservatively at 1.5 for multiple strategic customers.
Impact	2	For GitLab-based teams, this is blocking — they cannot use the platform without forge support. The webhook bridge unlocks an entirely new user segment, making this a very high impact feature for those affected.
Confidence	0.8	High confidence due to a well-documented ADR (0043), a detailed 7-phase implementation plan, and clear architectural boundaries (bridge Cloud Function, OIDC, PATs, defense-in-depth). Scope and approach are well-understood.
Effort	3	Very complex — 7-phase implementation spanning a new Cloud Function (webhook bridge), GitLab OIDC/JWKS integration, per-project PAT management in Secret Manager, and multiple defense-in-depth security layers. Touches dispatch infrastructure and the token mint.

Formula: (1.5 x 2 x 0.8) / 3 = 0.8

[fullsend-ai-triage]

Meeting update — 2026-06-10

Relevant to this issue: The team decided on combining native CI and a cron job for GitLab integration, to be detailed in an ADR — aligning with the webhook bridge approach in ADR 0043.

• Decision: implement GitLab integration using native CI combined with a cron job for platform compatibility
• An ADR will document the detailed design, including slash command behavior and GitLab tier evaluation

Related PRs: ADR 0043 GitLab per-repo support in PR #2042

Next steps:

• Update the ADR with slash command behavior and GitLab tier evaluation details

Meeting notes