From 6e98e3d3eb8851097be15e762de7f4aef37047f1 Mon Sep 17 00:00:00 2001
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
Date: Wed, 3 Sep 2025 21:46:35 +0200
Subject: [PATCH] [PR #10785/aed763da backport][stable-11]
 gitlab_*_access_token: add missing scopes (#10789)

gitlab_*_access_token: add missing scopes (#10785)

Over time, GitLab added extra scopes to the API. I'm in here to add
self_rotate, but may as well add all other missing scopes while I'm
here.

(cherry picked from commit aed763dae7570f0d8245e998e89f6468109677f6)

Co-authored-by: David Phillips <phillid@users.noreply.github.com>
---
 .../10785-gitlab-token-add-missing-scopes.yml         |  3 +++
 plugins/modules/gitlab_group_access_token.py          | 11 ++++++++++-
 plugins/modules/gitlab_project_access_token.py        |  7 ++++++-
 3 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 changelogs/fragments/10785-gitlab-token-add-missing-scopes.yml

diff --git a/changelogs/fragments/10785-gitlab-token-add-missing-scopes.yml b/changelogs/fragments/10785-gitlab-token-add-missing-scopes.yml
new file mode 100644
index 0000000000..a38d98a444
--- /dev/null
+++ b/changelogs/fragments/10785-gitlab-token-add-missing-scopes.yml
@@ -0,0 +1,3 @@
+minor_changes:
+  - gitlab_group_access_token - add missing scopes (https://github.com/ansible-collections/community.general/pull/10785).
+  - gitlab_project_access_token - add missing scopes (https://github.com/ansible-collections/community.general/pull/10785).
diff --git a/plugins/modules/gitlab_group_access_token.py b/plugins/modules/gitlab_group_access_token.py
index ae37c2b6d7..ba8291edbb 100644
--- a/plugins/modules/gitlab_group_access_token.py
+++ b/plugins/modules/gitlab_group_access_token.py
@@ -51,6 +51,7 @@ options:
   scopes:
     description:
       - Scope of the access token.
+      - The values V(read_virtual_registry), V(write_virtual_registry), V(manage_runner), and V(self_rotate) were added in community.general 11.3.0.
     required: true
     type: list
     elements: str
@@ -60,11 +61,15 @@ options:
       - read_api
       - read_registry
       - write_registry
+      - read_virtual_registry
+      - write_virtual_registry
       - read_repository
       - write_repository
       - create_runner
+      - manage_runner
       - ai_features
       - k8s_proxy
+      - self_rotate
   access_level:
     description:
       - Access level of the access token.
@@ -241,11 +246,15 @@ def main():
                              'read_api',
                              'read_registry',
                              'write_registry',
+                             'read_virtual_registry',
+                             'write_virtual_registry',
                              'read_repository',
                              'write_repository',
                              'create_runner',
+                             'manage_runner',
                              'ai_features',
-                             'k8s_proxy']),
+                             'k8s_proxy',
+                             'self_rotate']),
         access_level=dict(type='str', default='maintainer', choices=['guest', 'planner', 'reporter', 'developer', 'maintainer', 'owner']),
         expires_at=dict(type='str', required=True),
         recreate=dict(type='str', default='never', choices=['never', 'always', 'state_change'])
diff --git a/plugins/modules/gitlab_project_access_token.py b/plugins/modules/gitlab_project_access_token.py
index e96f13a546..32194f5f86 100644
--- a/plugins/modules/gitlab_project_access_token.py
+++ b/plugins/modules/gitlab_project_access_token.py
@@ -51,6 +51,7 @@ options:
   scopes:
     description:
       - Scope of the access token.
+      - The values V(manage_runner) and V(self_rotate) were added in community.general 11.3.0.
     required: true
     type: list
     elements: str
@@ -63,8 +64,10 @@ options:
       - read_repository
       - write_repository
       - create_runner
+      - manage_runner
       - ai_features
       - k8s_proxy
+      - self_rotate
   access_level:
     description:
       - Access level of the access token.
@@ -242,8 +245,10 @@ def main():
                              'read_repository',
                              'write_repository',
                              'create_runner',
+                             'manage_runner',
                              'ai_features',
-                             'k8s_proxy']),
+                             'k8s_proxy',
+                             'self_rotate']),
         access_level=dict(type='str', default='maintainer', choices=['guest', 'planner', 'reporter', 'developer', 'maintainer', 'owner']),
         expires_at=dict(type='str', required=True),
         recreate=dict(type='str', default='never', choices=['never', 'always', 'state_change'])