Improve “Check configuration” to validate GitLab token scopes for Quality Gate reporting

Suggest new features
1

Summary
When configuring DevOps Platform Integrations with GitLab in SonarQube Developer Edition, the “Check configuration” button reports success even if the provided GitLab token lacks API access. Because API access is required for posting Quality Gate statuses to merge requests, the current validation is misleading.

Problem

  • A GitLab token without API access is accepted as “valid” by “Check configuration”.
  • Administrators are then puzzled why Quality Gate results never appear on MRs.
  • This increases troubleshooting time and leads to misconfiguration in production.

Proposed Solution
Enhance “Check configuration” to verify that the supplied GitLab token includes the minimum required scopes/permissions for Quality Gate status reporting. If missing, surface a clear error or warning that lists the required scopes.

Steps to Reproduce (current behavior)

  1. Administration → DevOps Platform Integrations → GitLab.
  2. Enter a GitLab personal access token without API access.
  3. Click “Check configuration”.
  4. Result: Validation passes; no Quality Gate statuses are posted to MRs.

Impact
Misleading validation increases configuration time and delays adoption of MR status reporting.

2

Hey there.

I just tried it out on 2025.4.2, and when I create a Gitlab token with a scope that isn’t api (randomly I chose ai_features), I get this feedback in the UI.

image
image1258×464 26.9 KB

What is working differently for you?