Skip to main content

GitLab CI

This job scans the repository, publishes a JUnit report so findings show in the merge request's test report, and fails on Critical or High findings.

.gitlab-ci.yml
vulkro:
  stage: test
  image: ubuntu:24.04
  before_script:
    - apt-get update -qq && apt-get install -y -qq curl ca-certificates git
    - curl -fsSL https://dist.vulkro.com/install.sh | bash
  script:
    - vulkro scan ci . --format junit > vulkro-junit.xml
  artifacts:
    when: always
    reports:
      junit: vulkro-junit.xml

Set the secret​

Create a CI key in the customer portal (app.vulkro.com, Settings) and add it as a masked CI/CD variable named VULKRO_ACCOUNT_TOKEN (Settings, CI/CD, Variables). The scan signs in with it, so no vulkro login step is needed. A CI key works during the 14-day trial and on paid plans, and uses no device seat. See CI keys.

What fails the build​

The ci preset exits 1 when it finds Critical or High findings (or breaks the [quality_gate] thresholds in vulkro.toml, when you set them). artifacts: when: always keeps the report on a failed job.

Exit codeMeaning
0No findings at the gate level
1Findings at the gate level, or no licence (license_required on stderr)
2Error: bad arguments, IO failure

Fail only on new findings​

In merge request pipelines, make the scan report-only and gate on what the merge request adds with vulkro gate:

  variables:
    GIT_DEPTH: 0
  script:
    - vulkro scan ci . --format junit > vulkro-junit.xml || true
    - git fetch origin "+refs/heads/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME:refs/remotes/origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - vulkro gate --base "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

For a SARIF file instead of JUnit, use --format sarif > vulkro.sarif and list vulkro.sarif under artifacts: paths.

Air-gapped runners​

A runner with no route out uses a licence file instead of a CI key. Add the base64 of your .lic file (base64 -w0 your.lic) as a masked variable named VULKRO_LICENSE_B64, install from your internal mirror, and set VULKRO_OFFLINE: "1" in variables. See Offline mode.

If this repository is connected to Vulkro Cloud, merge requests are scanned without any pipeline step: see Pull requests in Vulkro Cloud.

Last updated on