Seems like GitLab now decides on a whim whether or not a phone number is required: Identity verification | GitLab
Identity verification provides multiple layers of GitLab account security. Depending on your risk score, you might be required to perform up to three stages of verification to register an account:
- All users - Email verification.
- Medium-risk users - Phone number verification.
- High-risk users - Credit card verification.
The risk score is decided by a third party with no information given ofc: Arkose Protect | GitLab