If I recall correctly, GitLab has a concept of "keys" (akin to SSH keys) that you can grant for your account. On of the categories is API -- which is specifically for this use case. If I ran my own commercial website, I would probably also disallow robot logins for the UI. It seems like too much trouble with no commecial upside. However, I could imagine allowing robot accounts to access tiny sliver of the API.