Install Pando

GitLab

gitlab Clone from gitlab.com or a self-managed GitLab with an OAuth application, an access or deploy token, or a deploy key, optionally limited to one group.

Setup

  1. Choose how Pando signs in

    Settings method, host

  2. Create an OAuth application

    1. In GitLab, select your avatar, then Edit profile → Access → Applications → Add new application. For a group, start from its Settings → Applications.
    2. Enter a Name. Set Redirect URI to your Pando address plus /api/v1/sources/callback.
    3. Clear Confidential. Under Scopes, select read_repository and read_api.
    4. Choose Save application and copy the Application ID and Secret.

    Open applications

    Settings client_id, client_secret · Only when method is oauth

  3. Create a token

    1. Create one of these in GitLab:
      TokenWhereSettings
      Fine-grained personal access token (GitLab 19.2 or later)Avatar → Edit profile → Access → Personal access tokens → Generate token → Fine-grained tokenCode: Download, Project: Read and Branch: Read; boundary User to list every project, or the group
      Personal access tokenAvatar → Edit profile → Access → Personal access tokens → Generate token → Legacy tokenScopes read_repository, read_api
      Project access tokenProject → Settings → Access tokens → Add new tokenRole Reporter; scopes read_repository, read_api
      Group access tokenGroup → Settings → Access tokens → Add new tokenRole Reporter; scopes read_repository, read_api
      Deploy tokenProject or group → Settings → Repository → Deploy tokens → Add tokenScope read_repository
    2. Copy the token, and for a deploy token its username.

    Open personal access tokens

    Settings token_type, username, token · Only when method is token

  4. Add a deploy key

    1. Run ssh-keygen -t ed25519 -f pando-deploy -N "".
    2. In the project, open Settings → Repository, expand Deploy keys and choose Add new key.
    3. Paste pando-deploy.pub into Key and choose Add key.
    4. Paste pando-deploy below.

    Settings ssh_private_key, ssh_passphrase, known_hosts · Only when method is ssh

  5. Choose a group

    Settings scope

Settings (13)
methodHow Pando signs inRequired
  • oauth OAuth application — Authorize once in the browser or with a device code. Repositories can be picked from a list.
  • token Access token or deploy token — A personal, project or group access token, or a deploy token over HTTPS.
  • ssh Deploy key — An SSH key added to the project as a deploy key. Repositories are entered by address.

one of the values above · Default oauth

hostHost

The host repositories are on. Change it for a self-managed server.

string · Default gitlab.com

scopeGroup

Subgroups are included. Empty is every project the credential can read.

string · For example acme/platform

client_idOAuth client ID

The Application ID of a GitLab OAuth application with the read_repository and read_api scopes.

string · Used when method is oauth

client_secretOAuth client secretCredential

Needed for browser authorization. Device authorization works without one.

string · Used when method is oauth

token_typeToken type
  • access_token Access token — A personal, project or group access token with read_repository and read_api. Repositories can be picked from a list.
  • deploy_token Deploy token — A deploy token with read_repository. It cannot list repositories, so they are entered by address.

one of the values above · Default access_token · Used when method is token

usernameUsername

The username GitLab shows beside the deploy token.

string · For example gitlab+deploy-token-12 · Used when token_type is deploy_token

tokenTokenCredential

An access token with read_repository and read_api, or a deploy token with read_repository.

string · Used when method is token

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it. Leave empty for gitlab.com; Pando knows its key.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://<host>/api/v4

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates