⭐ gitlab: add protectedEnvironments, integrations, and personal access tokens

[tas50]

What

Three new security-relevant resources for the GitLab provider.

gitlab.project.protectedEnvironment (new)

Deployment gates on protected environments:

• name, requiredApprovalCount, deployAccessLevels (who may deploy), and approvalRules (approver groups/users) — the deploy-side counterpart to protected branches/tags. Exposed via gitlab.project.protectedEnvironments().

gitlab.project.integration (new)

Active external integrations (Slack, Jira, generic webhook-style services) wired into a project — a data-egress / inbound-trigger surface:

• id, title, slug, active, inherited, timestamps, and the full set of event triggers (pushEvents, mergeRequestsEvents, pipelineEvents, deploymentEvents, vulnerabilityEvents, …). Exposed via gitlab.project.integrations().

gitlab.user.personalAccessToken (new)

PAT inventory, exposed via gitlab.user.personalAccessTokens() (filtered by the user's id):

• id, name, description, active, revoked, scopes, createdAt, expiresAt, lastUsedAt — for auditing over-scoped, stale, or non-expiring tokens. Complements the existing project/group access-token resources.

Example queries

gitlab.project.protectedEnvironments.where(requiredApprovalCount == 0) { name }
gitlab.project.integrations.where(active) { slug title pushEvents mergeRequestsEvents }
gitlab.users.flatMap(personalAccessTokens).where(expiresAt == null && active) { name scopes }
gitlab.users.flatMap(personalAccessTokens).where(scopes.contains("api")) { name }

Notes

• All three are additive; new .lr.versions entries at 13.3.9.
• personalAccessTokens() requires an admin token to enumerate other users' tokens (self-access otherwise); premium/permission-gated calls return an empty list on 403/404 rather than failing the resource graph.
• protectedEnvironment deploy-access levels and approval rules are modeled as []dict (they carry groupInheritanceType and no deploy key, so they don't fit the shared protectedBranch.accessLevel row); token/secret values are never exposed.

Test

• go build ./... (gitlab module) — clean
• go vet ./resources/ — clean
• go test ./resources/ — pass

[mondoo-code-review]

Missing pagination and error handling in integrations listing may truncate results or fail on restricted projects.

[mondoo-code-review]

🔴 critical — ListServices is called without pagination. If a project has more integrations than the API's default page size, results will be silently truncated. Add a pagination loop like the one used in protectedEnvironments() (line 602–614). The go-gitlab ListServices method likely accepts ListServiceOptions with ListOptions.

[mondoo-code-review]

🟡 warning — Unlike protectedEnvironments() and personalAccessTokens(), this method does not handle 403/404 gracefully — it will propagate the error and fail the resource graph. Add a resp check:

if err != nil {
    if resp != nil && (resp.StatusCode == 403 || resp.StatusCode == 404) {
        return []any{}, nil
    }
    return nil, err
}

[mondoo-code-review]

🔵 suggestion — The id() method for mqlGitlabProjectIntegration is placed above the unrelated protectedTags comment on line 541. Consider moving it closer to the integrations() method or into a separate section for better readability.

[github-actions]

Test Results

11 253 tests   11 246 ✅  5m 23s ⏱️
   546 suites       7 💤
    40 files         0 ❌

Results for commit a83efef.