Gerrit

Connect Gerrit to collect version control evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Gerrit:

   1. Sign in to Gerrit as the account Safeguard will use and open Settings.
   2. In the HTTP Credentials section, click Generate Password (or, on sites that configure it, Obtain Password and follow the site-specific instructions).
   3. Copy the generated HTTP password.
   4. As a Gerrit administrator, open the access rights settings of the root project All-Projects.
   5. Assign the global capability View All Accounts to a group containing the Safeguard account.
   6. Grant that group Read on refs/* and on refs/meta/config for the projects Safeguard should see.

   Where to find the other values:

   • Instance URL: The https base address of your Gerrit server.
   • Username: The username of the Gerrit account Safeguard signs in as.

   Global capabilities are set in the root project All-Projects. View All Accounts lists all accounts regardless of accounts.visibility but not all account data (secondary emails need View Secondary Emails). Docs do not say whether the generated password is shown only once. That the username is displayed in HTTP Credentials is not explicitly quoted in the fetched text. Verification: the BROWSE › Repositories menu path and the username being shown under HTTP Credentials were not in the fetched docs and were dropped.

   Source: gerrit-review.googlesource.com, gerrit-review.googlesource.com, checked 2026-10-07.

   The permissions Safeguard needs: Read on projects and refs/meta/config, View All Accounts.

2. On Compliance › Connectors, open Gerrit, click Connect, choose API token and fill in:

   Field	What to enter
   Instance URL	Required. Your own server: an https address reachable from the internet.
   Username	Required.
   HTTP password	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Gerrit and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Version Control connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks