Skip to content
Auto Merge for GitLabAuto Merge for GitLab

GitLab Webhook

Webhooks enable near-instant reactions to MR and pipeline events. Without webhooks, Auto Merge still works via 15-second polling.

Setup

Section titled “Setup”
  1. Generate a signing token: echo "whsec_$(openssl rand -base64 32)"
  2. Start Auto Merge with it in GITLAB_WEBHOOK_SIGNING_TOKEN
  3. Go to Settings > Webhooks in the GitLab project (GitLab 19.0 or newer)
  4. Set the URL: https://<auto-merge-host>/api/auto-merge/events/from-gitlab
  5. Enter the same value under Signing token
  6. Select triggers: Merge request events, Pipeline events
  7. Click Add webhook

GitLab signs every delivery with the token (HMAC-SHA256, Standard Webhooks). Auto Merge answers 401 to a delivery without a matching signature or with a webhook-timestamp more than 5 minutes off, and to every delivery while GITLAB_WEBHOOK_SIGNING_TOKEN is unset.

How It Works

Section titled “How It Works”

When GitLab sends a webhook event, Auto Merge immediately triggers a processing run instead of waiting for the next poll cycle. Webhook-triggered runs are debounced to avoid redundant executions when multiple events arrive in quick succession.

Without Webhooks

Section titled “Without Webhooks”

Auto Merge polls the GitLab API every 15 seconds. This works reliably but introduces a small delay between an MR state change and Auto Merge reacting to it. Webhooks reduce this delay to near-zero.