# GitLab Webhooks

## When to Use This Skill

* Setting up GitLab webhook handlers
* Debugging webhook token verification failures
* Understanding GitLab event types and payloads
* Handling push, merge request, issue, or pipeline events

## Essential Code (USE THIS)

### GitLab Token Verification (JavaScript)

```javascript
function verifyGitLabWebhook(tokenHeader, secret) {
  if (!tokenHeader || !secret) return false;

  // GitLab uses simple token comparison (not HMAC)
  // Use timing-safe comparison to prevent timing attacks
  try {
    return crypto.timingSafeEqual(
      Buffer.from(tokenHeader),
      Buffer.from(secret)
    );
  } catch {
    return false;
  }
}

```

### Express Webhook Handler

```javascript
const express = require('express');
const crypto = require('crypto');
const app = express();

// CRITICAL: Use express.json() - GitLab sends JSON payloads
app.post('/webhooks/gitlab',
  express.json(),
  (req, res) => {
    const token = req.headers['x-gitlab-token'];
    const event = req.headers['x-gitlab-event'];
    const eventUUID = req.headers['x-gitlab-event-uuid'];

    // Verify token
    if (!verifyGitLabWebhook(token, process.env.GITLAB_WEBHOOK_TOKEN)) {
      console.error('GitLab token verification failed');
      return res.status(401).send('Unauthorized');
    }

    console.log(`Received ${event} (UUID: ${eventUUID})`);

    // Handle by event type
    const objectKind = req.body.object_kind;
    switch (objectKind) {
      case 'push':
        console.log(`Push to ${req.body.ref}:`, req.body.commits?.length, 'commits');
        break;
      case 'merge_request':
        console.log(`MR !${req.body.object_attributes?.iid} ${req.body.object_attributes?.action}`);
        break;
      case 'issue':
        console.log(`Issue #${req.body.object_attributes?.iid} ${req.body.object_attributes?.action}`);
        break;
      case 'pipeline':
        console.log(`Pipeline ${req.body.object_attributes?.id} ${req.body.object_attributes?.status}`);
        break;
      default:
        console.log('Received event:', objectKind || event);
    }

    res.json({ received: true });
  }
);

```

### Python Token Verification (FastAPI)

```python
import secrets

def verify_gitlab_webhook(token_header: str, secret: str) -> bool:
    if not token_header or not secret:
        return False

    # GitLab uses simple token comparison (not HMAC)
    # Use timing-safe comparison to prevent timing attacks
    return secrets.compare_digest(token_header, secret)

```

> For complete working examples with tests, see:
> 
> * [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/gitlab-webhooks/examples/express/) - Full Express implementation
> * [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/gitlab-webhooks/examples/nextjs/) - Next.js App Router implementation
> * [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/gitlab-webhooks/examples/fastapi/) - Python FastAPI implementation

## Common Event Types

| Event | X-Gitlab-Event Header | object_kind | Description |
| --- | --- | --- | --- |
| Push | Push Hook | push | Commits pushed to branch |
| Tag Push | Tag Push Hook | tag_push | New tag created |
| Issue | Issue Hook | issue | Issue opened, closed, updated |
| Comment | Note Hook | note | Comment on commit, MR, issue |
| Merge Request | Merge Request Hook | merge_request | MR opened, merged, closed |
| Wiki | Wiki Page Hook | wiki_page | Wiki page created/updated |
| Pipeline | Pipeline Hook | pipeline | CI/CD pipeline status |
| Job | Job Hook | build | CI job status |
| Deployment | Deployment Hook | deployment | Environment deployment |
| Release | Release Hook | release | Release created |

> For full event reference, see [GitLab Webhook Events](https://docs.gitlab.com/user/project/integrations/webhook_events/)

## Important Headers

| Header | Description |
| --- | --- |
| `X-Gitlab-Token` | Secret token for authentication |
| `X-Gitlab-Event` | Human-readable event name |
| `X-Gitlab-Instance` | GitLab instance hostname |
| `X-Gitlab-Webhook-UUID` | Unique webhook configuration ID |
| `X-Gitlab-Event-UUID` | Unique ID for this event delivery |

## Environment Variables

```bash
GITLAB_WEBHOOK_TOKEN=your_secret_token   # Set when creating webhook in GitLab

```

## Local Development

```bash
# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 gitlab --path /webhooks/gitlab

```

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/gitlab-webhooks/references/overview.md) - GitLab webhook concepts
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/gitlab-webhooks/references/setup.md) - Configuration guide
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/gitlab-webhooks/references/verification.md) - Token verification details