You can not opportunistically spam nearly every thread where GitLab might be tangentially related.
I don't use GitLab largely because of the way you post on HN, though the software seems reasonably well-written. It's very frustrating.
Ok....
It's informative, not "gitlab doesn't suffer from this, here's a 10% off coupon https://gitlab.com!!".
More generally, however, you're right although I have just come to accept that this is how things are on HN. Choose pretty much any "Show HN" thread or any thread about some cool new app/product/service and in the thread you'll find a few "shameless plug" comments that would be considered spam in any other forum: "Hey, we also make an app that does $foo, sign up for our beta at example.com and check us out!".
(One of the worst "offenders" is Userify. Pick any thread that relates tangentially to user authentication and chances are good you'll find a comment from them that manages to work their name/URL into the conversation somehow.)
> To be clear, letting third party JS run in a trusted environment like a dashboard is an industry wide problem. If we assume CircleCI is the only bad actor we're kind of missing the point of the exercise.