aikidosecurity/gitlab-ci-integration repository overview

⁠Aikido Security Gitlab CI security scanner

This repository contains an application that can be used in GitLab Pipelines. It will trigger a scan in Aikido to make sure no new critical issues are introduced into your application. This action is available in any paid plan at Aikido.

⁠Using this job

We recommend to only run this job on merge requests. This will make sure only your latest changes are scanned and the scan will happen faster. It is therefore important to include the following bit to the job:

only:
    - merge_requests

Firstly, you need to obtain the CI Integration Token from the Aikido settings page and add it to the variables of your CI CD pipeline in Gitlab.

Note: Make sure the variable is available on all branches (uncheck the protect variable checkbox).

Next you can use our docker image to run the action using the example snippet below:

stages:
    - verify

aikido_security_dependency_scanning:
    stage: verify
    image:
        name: registry.gitlab.com/aikido-security/gitlab-ci-integration/dependency-scanner:latest
        entrypoint: ['/bin/sh', '-c']
    only:
        - merge_requests
    script:
        - node /app/index.js --secret_key $AIKIDO_SECRET_KEY

By default, the job will fail if the scan did not complete within 2 minutes. You can control this behaviour by providing the fail_on_timeout parameter to the script and set it to false:

stages:
    - verify

aikido_security_dependency_scanning:
    stage: verify
    image:
        name: registry.gitlab.com/aikido-security/gitlab-ci-integration/dependency-scanner:latest
        entrypoint: ['/bin/sh', '-c']
    only:
        - merge_requests
    script:
        - node /app/index.js --secret_key $AIKIDO_SECRET_KEY --fail_on_timeout false

This integration will block a pipeline when it detects of critical severity by default. If you'd like to be more conservative and fail on another severity, you can also do so via a parameter to the script:

stages:
    - verify

aikido_security_dependency_scanning:
    stage: verify
    image:
        name: registry.gitlab.com/aikido-security/gitlab-ci-integration/dependency-scanner:latest
        entrypoint: ['/bin/sh', '-c']
    only:
        - merge_requests
    script:
        - node /app/index.js --secret_key $AIKIDO_SECRET_KEY --minimum_severity MEDIUM

Now the action will still shut down after 2 minutes, but it won't fail and block your pipeline.

Below we listed a table with all properties you can provide to the action