LogoLogo
WebsitePricingBlog
  • Debricked Documentation
  • Overview
    • Getting started
      • Create a OpenText Core SCA account
      • Running OpenText Core SCA
    • Help
      • Frequently asked questions (FAQ)
      • Upgrade your account
      • Get help in OpenText Core SCA tool
    • Language support
      • C# - Nuget, Paket
      • CycloneDX SBOM
      • Go - Go Modules, Go Dep, Bazel
      • Java & Kotlin - Gradle, Maven, Bazel
      • JavaScript - NPM, Yarn, Bower
      • Objective-C - CocoaPods
      • PHP - Composer
      • Python - Pip, Pipenv
      • Ruby - RubyGems
      • Rust - Cargo
      • Swift - CocoaPods
      • Linux package managers
      • Scala - SBT
    • Security overview
  • Product
    • Vulnerability management
      • Security terms
      • Data sources
      • See your data
      • Pull Requests (PR)
        • Enable Pull Request support
        • Solve vulnerabilities using Pull Requests (PR)
        • Solve vulnerabilities using Pull Requests (PR) via API
      • Set a review status
        • Snooze or pause a review status
      • Reachability Analysis
        • Set up Reachability Analysis for Java
        • Set up Reachability Analysis for Go
      • Solve vulnerabilities manually with root fixes
    • License risk management
      • Licence families
      • License risks
      • Set up a use case
        • Set up a use case using API
      • Proxy non-standard license identifiers
    • Project health
      • Contributors
      • Popularity
      • Security
    • Open source select
      • Search projects
      • Compare projects
      • View more details
      • Start left policies
      • OpenText Core SCA Select Browser Extension
      • End of Life (EOL)
    • Automation
      • Create an automation rule
      • Edit an automation rule
      • Default automation rules
      • Set up webhooks
      • Policies
      • Monitoring
    • Exporting or SBOM
      • Overview
      • License export
      • Vulnerability export
      • SBOM export
        • CycloneDX SBOM export
        • SPDX SBOM export
    • Administration
      • Generate access token
      • Account
        • Change your password
        • Delete your account
        • Delete company account
      • Billing
        • Manage contributing developers
        • Manage billing frequency
        • Manage payment methods
        • Access invoices
        • Manage your subscription
      • Settings
        • Enable and disable snoozing vulnerabilities
        • Supported language for Debricked tool
        • View logged events
        • Two-Factor Authentication (2FA)
      • Users
        • User roles (freemium and premium)
        • Role-Based Access Control (Enterprise)
        • Manage users
          • Add a new user
      • Repositories
        • Default Branch
        • Repository groups
        • Manually upload a dependency file
        • Manage your commits
  • Tools & Integrations
    • Command Line Interface (CLI)
      • Debricked CLI
        • High performance scans
        • File fingerprinting
      • Legacy CLI
    • CI/CD integrations
      • GitHub
      • CircleCI
      • BuildKite
      • GitLab
      • Bitbucket
      • Azure DevOps
      • Argo workflows
      • Travis CI
      • Jenkins
      • Bamboo
      • TeamCity
    • Fortify on Demand (FoD)
    • Fortify Software Security Center (SSC)
    • Debricked APIs
      • Open source select API
    • Integrated Development Environments (IDEs)
    • Single Sign-On (SSO)
      • Single Sign-On (SSO) through Okta
      • Single Sign-On (SSO) through Microsoft Entra ID
      • Single Sign-On (SSO) through JumpCloud OIDC
      • Single Sign-On (SSO) through GitHub
  • Tips & Tricks
    • Debricked CLI migration guide
    • Workarounds
      • Scanning Conan (C++) projects
      • Scanning a repository with different services
      • Scanning Docker images
      • Automations: Do not fail on found CVE lacking a fix
Powered by GitBook
LogoLogo

Company

  • Pricing
  • Blog

Support

  • Privacy Policy
  • Terms & Conditions
  • Service Status

Resources

  • Vulnerability DB
  • Open Source Select

© 2018-2024 | Open Text

On this page
  • Configure Debricked token
  • Configure GitLab CI or CD job
  • Integrate many repositories using one configuration with GitLab
  • Credentials for merge requests

Was this helpful?

Export as PDF
  1. Tools & Integrations
  2. CI/CD integrations

GitLab

Learn how to integrate Debricked with GitLab.

Last updated 2 months ago

Was this helpful?

With CI integration to GitLab you can automatically upload your latest commits and pull requests to Debricked whenever you run your pipeline. Our GitLab integration support the same options as our Bitbucket integration, read more about the options here:

Debricked supports both the cloud version and the self-hosted version of GitLab.

Configure Debricked token

Start by . Copy the token so that you can use it in the next step.

Configure your DEBRICKED_TOKEN:

  1. Go to your Repository.

  2. Go to Settings -> CI/CD.

  3. Expand the Variables field.

  4. Paste in the access token from the previous step. Make sure to mask the token, so that it does not show in the logs.

Configure GitLab CI or CD job

Depending on what package manager you are using there are different job setups.

In order for us to analyze all dependencies in your project, their versions, and relations, files containing the resolved dependency trees have to be created prior to scanning. Those depend on the package manager used. If files are lacking, Debricked tries to generate the lacking files, which can negatively affect speed and accuracy.

Example 1: If is used in your project you will have a "package.json" file, but in order for us to scan all your dependencies, Debricked requires either "package-lock.json" or "yarn.lock" as well.

Example 2: If is used in your project, you will have a pom.xml file, but in order for us to resolve all your dependencies, Debricked requires a second file, as Maven does not offer a lock file system. Instead, "Maven dependency:tree" plugin can be used to create a file called ".debricked-maven-dependencies.tgf".

  1. Add the template to your ".gitlab-ci.yml" file (if the file does not exist, create one).

  1. Commit your changes to ".gitlab-ci.yml" and watch the CI run.

Integrate many repositories using one configuration with GitLab

Integrating many repositories with one configuration using GitLab can greatly simplify the process of managing and deploying code across multiple projects.

You can set this up with multi-project pipelines:

  1. In GitLab, create a file in a new or existing repository and paste the Debricked template:

  1. Trigger it in target project(s) by adding the following code and adjusting the reference to point to the file created in step 2:

    debricked-scan:
      trigger:
        include:
          - project: '<org_name>/<repository_name>'
            ref: '<branch_name>'
            file: '/path/to/file.gitlab-ci.yml'
    	strategy: depend

  2. The process is complete.

Credentials for merge requests

Debricked can generate merge requests for you, but to be able to use it in GitLab, you should provide the credentials, so that the merge requests can be cfreated on your GitLab instance.

You can use either:

  • Personal access tokens

  • Project-scoped access tokens (currently available in paid versions of Gitlab), unique for every project

You can generate a Personal access token by going to the User settings. You should grant the token the API scope.

Then when you try to create a Merge Request inside the Debricked tool, it will automatically ask you for your credentials when needed.

After clicking Confirm, the merge request generation should start.

Start .

To avoid having to add the DEBRICKED_TOKEN to every integrated repository, it is possible to set up the token as a var for either: - -

generating an access token
a group of projects
your entire instance
https://bitbucket.org/debricked/debricked-scan
generating an access token
npm
Maven
https://github.com/debricked/cli/blob/main/examples/templates/GitLab/gitlab-ci.yml
stages:
  - scan
debricked:
  stage: scan
  script:
    - curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
    - ./debricked scan
https://github.com/debricked/cli/blob/main/examples/templates/GitLab/gitlab-ci.yml
stages:
  - scan
debricked:
  stage: scan
  script:
    - curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
    - ./debricked scan