checkpoint/spectral-gitlab-pipeline-scanner repository overview

⁠Spectral GitLab Pipeline Scanner

Spectral helps you monitor, classify and protect your code, assets and infrastructure for exposed API keys, tokens, credentials and high-risk security misconfigurations in a simple way, without noise.

This image helps you run Spectral inside your CI/CD process in GitLab. In order to run this image you should make sure you have the required GitLab infrastructure such as a GitLab runner⁠ based on docker executor⁠.

⁠Usage

⁠Run a scan focusing on changed files

Gitlab pipeline scanner brings optimal developer experience by focusing on the actual problems in your change set.

There are two running run modes possible for the job:

1. As part of a Merge Request - when the job runs as part of a merge request, the files that have been changed in this merge request are being scanned.
2. After a standalone Push - If the job runs without a merge request context, it calculates the diff (changed files) between the last commit, and the last commit before the push, and runs the scan on those files.

⁠Setup

To run the image properly you'll need to apply those environment variables on your project (or higher level GitLab component) settings⁠:

Define the job in your .gitlab-ci.yml file⁠, here is a basic YAML configuration example:

stages:
  - test

spectral-scan:
  stage: test
  allow_failure: true
  image: checkpoint/spectral-gitlab-pipeline-scanner:latest
  variables:
    GIT_STRATEGY: none
  script:
    - /usr/src/app/scanner

Define the desired triggers⁠ for the job using the rules property (every push to main branch, merge_request_event etc.).

⁠Support

NOTE: The advanced integration is currently supported only on Standalone GitLab servers.

⁠Additional GitLab integrations

In case you wish to secure your merge requests without using pipelines, you can use Spectral GitLab webhook scanner⁠.