gitlab

package
v0.3.90 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 8, 2026 License: MPL-2.0 Imports: 27 Imported by: 0

Documentation

Overview

gitleaks_scan.go integrates the gitleaks secret scanner. Plumber does not embed gitleaks (license + binary-bloat trade-off): we shell out to a user-installed `gitleaks` binary, parse its JSON report, redact matches, and write GitleaksHit entries onto the pipeline IR. The rego rule policies/leaked_secrets.rego turns those IR entries into ISSUE-301 findings.

The raw secret value never leaves this file: redactPreview replaces it with first-4 + "***" + last-4 (or "***" only for short matches) before the entry is appended to pipeline.GitleaksHits. The rego rule and every downstream output (terminal, JSON, SARIF, GitLab SAST, MR comment) see only the redacted form.

Index

Constants

View Source 
const (
	// PlumberBadgeName is the name used for Plumber project badges
	PlumberBadgeName = "Plumber"
	// UnableToGetGitlabClient is the error message for when a Gitlab client cannot be created
	UnableToGetGitlabClient = "Unable to get a Gitlab client"
)
View Source 
const (
	BehaviorWhenCommitIsAddedKeepApprovalsId = iota + 1
	BehaviorWhenCommitIsAddedRemoveCodeOwnerApprovalsId
	BehaviorWhenCommitIsAddedRemoveApprovalsId
)

Behavior when commit is added constants

View Source 
const (
	BehaviorWhenCommitIsAddedKeepApprovalsText   = "Keep approvals"
	BehaviorWhenCommitIsAddedRemoveCodeOwnerText = "Remove approvals by Code Owners if their files changed"
	BehaviorWhenCommitIsAddedRemoveApprovalsText = "Remove all approvals"
)

Behavior when commit is added text values

View Source 
const (
	SquashOptionNever      = "never"       // Never squash
	SquashOptionAlways     = "always"      // Always squash
	SquashOptionDefaultOn  = "default_on"  // Squash by default (can be turned off)
	SquashOptionDefaultOff = "default_off" // Don't squash by default (can be turned on)
)

GitLab squash option constants

View Source 
const (
	AccessLevelNo         = 0
	AccessLevelMinimal    = 5
	AccessLevelGuest      = 10
	AccessLevelPlanner    = 15
	AccessLevelReporter   = 20
	AccessLevelDeveloper  = 30
	AccessLevelMaintainer = 40
	AccessLevelOwner      = 50
	AccessLevelAdmin      = 60
)

Access level constants for GitLab

View Source 
const (
	NoText         = "No access"
	MinimalText    = "Minimal access"
	GuestText      = "Guest"
	PlannerText    = "Planner"
	ReporterText   = "Reporter"
	DeveloperText  = "Developer"
	MaintainerText = "Maintainer"
	OwnerText      = "Owner"
	AdminText      = "Admin"
)

Access level text descriptions

View Source 
const (
	IncludeFile   = "file"
	IncludeRemote = "remote"
)
View Source 
const DataCollectionTypeGitlabPipelineImageVersion = "0.2.0"
View Source 
const DataCollectionTypeGitlabPipelineOriginVersion = "0.2.0"
View Source 
const (
	DataCollectionTypeGitlabProtectionVersion = "0.2.0"
)

Variables

This section is empty.

Functions

func BranchExists added in v0.3.53 

func BranchExists(projectID int, branch string, token string, APIURL string, conf *configuration.Configuration) (bool, error)

BranchExists reports whether the given branch (or tag/ref) exists in the project. A 404 from the API means it does not exist and is returned as (false, nil); any other failure (auth, network) is a real error. Used to tell a non-existent --branch apart from a branch that simply has no .gitlab-ci.yml, so the former fails loudly instead of rendering a confusing limited report (#222).

func BranchMatchesPattern 

func BranchMatchesPattern(pattern, branchName string) bool

BranchMatchesPattern checks if a branch name matches a pattern using wildcard matching Supports * wildcard for pattern matching (e.g., "*production*", "release/*")

func BuildGitlabID 

func BuildGitlabID(id int, idType string) string

Build gitLab GraphQL ID string

func BuildVariableSafeConfID 

func BuildVariableSafeConfID(protected, masked bool, ids ...string) string

func CheckItemMatchToPatterns 

func CheckItemMatchToPatterns(item string, patterns []string) bool

CheckItemMatchToPatterns detects if a string matches at least one of the patterns using wildcard lib (not regex) Examples: "3.2*" matches "3.2-rc-buster", "3.22" 

"*-dev" matches "1.0-dev", "feature-dev"

func CollectOverriddenJobs added in v0.3.65 

func CollectOverriddenJobs(o *GitlabPipelineOriginDataFull, data *GitlabPipelineOriginData) []ir.OverriddenJob

CollectOverriddenJobs returns the jobs inherited from origin that were locally redefined with forbidden CI/CD keys. The IR uses it to expose override metadata to Rego policies; the PBOM generator reuses it so both paths share the same rule for what counts as an override.

func ConvertCICDVariableToMap 

func ConvertCICDVariableToMap(variables []CICDVariable) map[string]string

func CreateMergeRequestNote added in v0.1.42 

func CreateMergeRequestNote(projectID int, mrIID int, body string, token string, instanceURL string, conf *configuration.Configuration) (*gitlab.Note, error)

CreateMergeRequestNote creates a new note (comment) on a merge request

func CreateProjectBadge added in v0.1.42 

func CreateProjectBadge(projectID int, name, imageURL, linkURL, token, instanceURL string, conf *configuration.Configuration) (*gitlab.ProjectBadge, error)

CreateProjectBadge creates a new badge on a project

func DetectMergeRequestIID added in v0.1.42 

func DetectMergeRequestIID() int

DetectMergeRequestIID checks if we are running inside a GitLab CI merge request pipeline and returns the merge request IID. Returns 0 if not in a CI merge request context.

GitLab CI sets CI_MERGE_REQUEST_IID only for merge request pipelines (pipelines triggered by `rules: - if: $CI_MERGE_REQUEST_IID` or `only: merge_requests`).

func EnhanceProjectWithGraphQL 

func EnhanceProjectWithGraphQL(project *Project, token string, instanceURL string, conf *configuration.Configuration) error

EnhanceProjectWithGraphQL adds additional data from GraphQL API This can get information not available via REST

func FetchGitlabFile 

func FetchGitlabFile(projectPath string, filePath string, ref string, token string, APIURL string, conf *configuration.Configuration) ([]byte, error, error)

FetchGitlabFile retrieves a file from a GitLab project using its path

func FetchGitlabGroup 

func FetchGitlabGroup(id int, token string, APIURL string, conf *configuration.Configuration) (*gitlab.Group, error, error)

FetchGitlabGroup retrieves a group from GitLab using its ID The first error returned is error from GitLab API response if any

func FetchGitlabInclude 

func FetchGitlabInclude(include MergedCIConfResponseInclude, projectPath, token, APIURL, sha string, conf *configuration.Configuration, inputs map[string]interface{}, stages []string) ([]string, error)

FetchGitlabInclude retrieves all jobs from a CI conf include

func FetchGitlabProject 

func FetchGitlabProject(id int, token string, APIURL string, conf *configuration.Configuration) (*gitlab.Project, error, error)

FetchGitlabProject retrieves a project from GitLab using its ID

func FetchLatestCommitSha added in v0.1.33 

func FetchLatestCommitSha(token, instanceURL, projectPath, branch string, conf *configuration.Configuration) (string, error)

FetchLatestCommitSha gets the latest commit SHA for a given branch. Exported wrapper around fetchLatestCommitSha for use outside the gitlab package.

func FetchProjectBranches 

func FetchProjectBranches(projectID int, token string, APIURL string, conf *configuration.Configuration) ([]string, error)

FetchProjectBranches retrieves all branches for a project

func FetchProjectMRApprovalRules 

func FetchProjectMRApprovalRules(projectID int, token string, APIURL string, conf *configuration.Configuration) ([]*gitlab.ProjectApprovalRule, error)

FetchProjectMRApprovalRules retrieves MR approval rules for a project

func FetchProjectMRApprovalSettings 

func FetchProjectMRApprovalSettings(projectID int, token string, APIURL string, conf *configuration.Configuration) (*gitlab.ProjectApprovals, error)

FetchProjectMRApprovalSettings retrieves MR approval settings for a project

func FetchRepositoryBranches 

func FetchRepositoryBranches(client *gitlab.Client, projectID string, maxPage int) ([]*gitlab.Branch, error)

FetchRepositoryBranches fetches all branches from a repository, respecting a maxPage limit

func GetExtends 

func GetExtends(extendsInterface interface{}) ([]string, error)

GetExtends gets the extends entry and returns a slice of string with all extends

func GetFullGitlabCI 

func GetFullGitlabCI(project *ProjectInfo, ref, token, url string, conf *configuration.Configuration) (*GitlabCIConf, *GitlabCIConf, *MergedCIConfResponse, string, string, error)

GetFullGitlabCI retrieves the full GitLab CI configuration for a project

func GetFullPathAndName 

func GetFullPathAndName(id int, token string, instanceUrl string, conf *configuration.Configuration) (string, string, error)

GetFullPathAndName returns the full path and full name of a project using its ID

func GetGitlabInstanceVersion 

func GetGitlabInstanceVersion(token, APIURL string, conf *configuration.Configuration) (string, error)

GetGitlabInstanceVersion fetches the GitLab instance version

func GetGraphQLClient 

func GetGraphQLClient(url string, conf *configuration.Configuration) *graphql.Client

GetGraphQLClient creates a GraphQL client with retry logic

func GetGroupFullPath 

func GetGroupFullPath(groupID int, token string, APIURL string, conf *configuration.Configuration) (string, error)

GetGroupFullPath returns gitlab group fullPath from id

func GetHTTPClient 

func GetHTTPClient(conf *configuration.Configuration) *http.Client

GetHTTPClient creates a simple HTTP client with retry logic

func GetImageName 

func GetImageName(imageInterface interface{}) (string, error)

GetImageName gets the image name from an interface parsed from gitlab ci file

func GetMapKeys 

func GetMapKeys(m map[string]string) []string

GetMapKeys returns the keys of a string map as a slice (for safe logging without values)

func GetNewGitlabClient 

func GetNewGitlabClient(token string, instanceUrl string, conf *configuration.Configuration) (*gitlab.Client, error)

GetNewGitlabClient returns a new GitLab client for API requests

func GetScriptLines added in v0.1.52 

func GetScriptLines(scriptInterface interface{}) []string

GetScriptLines extracts script lines from a script field (string or []interface{}). Returns nil for nil input. Multi-line strings are split on newline boundaries.

func GetVariableValue 

func GetVariableValue(valueInterface interface{}) (string, error)

GetVariableValue gets the variable value from an interface parsed from gitlab ci file

func IsGitlabInstanceEnterprise 

func IsGitlabInstanceEnterprise(token, APIURL string, conf *configuration.Configuration) (bool, error)

IsGitlabInstanceEnterprise checks if the GitLab instance is enterprise edition

func IsOnDefaultBranchCI added in v0.1.42 

func IsOnDefaultBranchCI() bool

IsOnDefaultBranchCI checks if the current CI pipeline is running on the project's default branch by comparing CI_COMMIT_BRANCH to CI_DEFAULT_BRANCH. Only call this when IsRunningInCI() returns true.

func IsRunningInCI 

func IsRunningInCI() bool

IsRunningInCI checks if the code is running inside a GitLab CI environment by checking if the CI environment variable is set to "true"

func IsUpToDate 

func IsUpToDate(version, latestVersion string, latestRefs []string) bool

Return if a template is up to date

func IsUsingLatest 

func IsUsingLatest(version string, latestRefs []string) bool

Return if a template is using a latest ref

func IsVersionGreaterOrEqual 

func IsVersionGreaterOrEqual(version, requiredVersion string) bool

IsVersionGreaterOrEqual compares GitLab version strings Returns true if the given version is greater than or equal to the required version

func ListMergeRequestNotes added in v0.1.42 

func ListMergeRequestNotes(projectID int, mrIID int, token string, instanceURL string, conf *configuration.Configuration) ([]*gitlab.Note, error)

ListMergeRequestNotes retrieves all notes (comments) on a merge request

func ListProjectBadges added in v0.1.42 

func ListProjectBadges(projectID int, token string, instanceURL string, conf *configuration.Configuration) ([]*gitlab.ProjectBadge, error)

ListProjectBadges retrieves all badges for a project

func ParseDefaultImage 

func ParseDefaultImage(conf *GitlabCIConf) (string, error)

ParseDefaultImage parses the default image from a GitLab CI configuration

func ParseGitlabComponentPath added in v0.3.65 

func ParseGitlabComponentPath(path string, instanceURL string) (string, string, string)

ParseGitlabComponentPath parses a GitLab component path to extract: 1. The instance (if any) 2. The clean path without instance prefix 3. The version (if any)

func ParseGitlabID 

func ParseGitlabID(idString string) (int, error)

ParseGitLab GraphQL ID string

func ParseGlobalVariables 

func ParseGlobalVariables(conf *GitlabCIConf) (map[string]string, error)

ParseGlobalVariables parses global variables of a GitLab CI conf

func ParseJobVariables 

func ParseJobVariables(job *GitlabJob) (map[string]string, error)

ParseJobVariables parses job variables from a GitLab CI conf

func RefResolvesAsTagAndBranch added in v0.3.70 

func RefResolvesAsTagAndBranch(projectPath string, ref string, token string, APIURL string, conf *configuration.Configuration) (tagExists bool, branchExists bool, err error)

RefResolvesAsTagAndBranch probes whether ref exists in projectPath as a tag and/or as a branch. go-gitlab accepts a "group/project" path as the project identifier, so callers pass the include's resolved project path directly. A 404 means "not that kind of ref" (false); any other error is returned so the caller abstains rather than guessing. ref-confusion (ISSUE-402) fires only on a confirmed tag-AND-branch collision, so an indeterminate probe (auth, network, rate limit) must never assert ambiguity — the error path leaves both false and surfaces err.

func RemoveGitRefFromURL 

func RemoveGitRefFromURL(rawURL string) (string, error)

RemoveGitRefFromURL removes git refs (commits, branches, tags) from a URL 

func RemoveVersionInRawLink(raw string) string

Return an uniq id for a template data

func ReplaceVariable 

func ReplaceVariable(input string, project, group, instance, job, defaultJob, predefined map[string]string) string

ReplaceVariable replaces variables in the input string recursively up to 5 levels

func ReplaceVariableFromEnv 

func ReplaceVariableFromEnv(input string) string

ReplaceVariableFromEnv replaces variables in the input string using environment variables This is used when running in CI mode where all variables are available in the environment

func RepoHasFolder 

func RepoHasFolder(projectPath string, folderPath string, token string, APIURL string, conf *configuration.Configuration) bool

RepoHasFolder tests if a folder exists in a gitlab repository

func ResolveLocalIncludes added in v0.1.41 

func ResolveLocalIncludes(content []byte, repoRoot string) ([]byte, error)

ResolveLocalIncludes pre-processes a local CI configuration to inline include:local entries from the local filesystem. Other include types (component, template, project, remote) are preserved for GitLab's ciConfig API to resolve server-side.

If the YAML cannot be parsed or no local includes are found, the original content is returned unchanged. If a local include file cannot be read, it is left in the include list for GitLab to resolve from the remote repository.

func ResolveWithinRepo added in v0.3.87 

func ResolveWithinRepo(repoRoot, relPath string) (string, error)

ResolveWithinRepo joins relPath onto repoRoot and returns the joined path, but only after confirming it does not escape repoRoot. Symlinks are resolved on both sides so a link planted in the checkout cannot disguise an out-of-repo target. It is the shared containment guard for repository- relative paths taken from the analyzed project (include:local targets and the CI config path).

func ScanGitleaksForGitHub added in v0.3.65 

func ScanGitleaksForGitHub(
	l *logrus.Entry,
	conf *configuration.Configuration,
	workflowsDir, logicalPrefix string,
	pipeline *ir.NormalizedPipeline,
) error

ScanGitleaksForGitHub runs gitleaks against the workflow files under workflowsDir (typically <rootDir>/.github/workflows). Hits are appended to pipeline.GitleaksHits in the same redacted form as the GitLab path. logicalPrefix is prepended to each finding's File so output reads ".github/workflows/release.yml" rather than the absolute clone path.

func ScanGitleaksForGitlab added in v0.3.65 

func ScanGitleaksForGitlab(
	l *logrus.Entry,
	conf *configuration.Configuration,
	origin *GitlabPipelineOriginData,
	pipeline *ir.NormalizedPipeline,
) error

ScanGitleaksForGitlab runs gitleaks against the resolved GitLab pipeline configuration carried on origin.ConfString and appends any hits to pipeline.GitleaksHits as redacted GitleaksHit entries. The raw secret value never leaves this function.

No-op (returns nil, pipeline untouched) in any of:

  • pipeline or origin is nil
  • control is missing from .plumber.yaml or `enabled: false`
  • origin.ConfString is empty (nothing to scan)
  • gitleaks binary is not resolvable

When gitleaks itself fails (exec error, timeout, non-1 exit) the failure is logged at warn level and nil is returned so the rest of the analyze flow continues. Matches the degraded-but-not-fatal contract every optional integration in plumber follows.

func SearchTags 

func SearchTags(projectPath string, token string, APIURL string, conf *configuration.Configuration) ([]string, error, error)

SearchTags gets all tags of a project

func ToNormalizedPipeline added in v0.3.65 

func ToNormalizedPipeline(
	projectPath string,
	defaultBranch string,
	ciConfigPath string,
	origin *GitlabPipelineOriginData,
	images *GitlabPipelineImageData,
	protection *GitlabProtectionAnalysisData,
) *ir.NormalizedPipeline

ToNormalizedPipeline projects the GitLab collector outputs onto a provider-agnostic IR. Phase 1b: only the fields required by the first rule ported to Rego (image/mutable_tag) are mapped. Additional fields (services, includes, branch protection, etc.) will be filled in as each rule is migrated.

This function is pure: no I/O, no external state. It is safe to call from tests with hand-built fixtures.

func UpdateMergeRequestNote added in v0.1.42 

func UpdateMergeRequestNote(projectID int, mrIID int, noteID int, body string, token string, instanceURL string, conf *configuration.Configuration) (*gitlab.Note, error)

UpdateMergeRequestNote updates an existing note (comment) on a merge request

func UpdateProjectBadge added in v0.1.42 

func UpdateProjectBadge(projectID int, badgeID int, name, imageURL, linkURL, token, instanceURL string, conf *configuration.Configuration) (*gitlab.ProjectBadge, error)

UpdateProjectBadge updates an existing badge on a project

func WrapTransportWithRetry 

func WrapTransportWithRetry(transport http.RoundTripper, conf *configuration.Configuration) http.RoundTripper

WrapTransportWithRetry wraps an existing http.RoundTripper with retry logic

Types

type Artifacts 

type Artifacts struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Paths     []string `yaml:"paths,omitempty"`
	When      string   `yaml:"when,omitempty"`
	Name      string   `yaml:"name,omitempty"`
	Untracked bool     `yaml:"untracked,omitempty"`
}

type Branch 

type Branch struct {
	Name string `json:"name"`
}

Data of a GitLab branch

type BranchProtection 

type BranchProtection struct {
	ProtectionPattern         string                        `json:"protectionPattern"`
	AllowForcePush            bool                          `json:"allowForcePush"`
	CodeOwnerApprovalRequired bool                          `json:"codeOwnerApprovalRequired"`
	MinPushAccessLevel        int                           `json:"minPushAccessLevel"`
	MinMergeAccessLevel       int                           `json:"minMergeAccessLevel"`
	PushAccessLevels          []BranchProtectionAccessLevel `json:"pushAccessLevels"`
	MergeAccessLevels         []BranchProtectionAccessLevel `json:"mergeAccessLevels"`
}

func FetchBranchProtections 

func FetchBranchProtections(projectID int, token string, APIURL string, conf *configuration.Configuration) ([]BranchProtection, error)

FetchBranchProtections retrieves branch protection settings for a project

func FetchProjectBranchData 

func FetchProjectBranchData(projectPath string, token string, APIURL string, conf *configuration.Configuration) ([]string, []BranchProtection, error)

FetchProjectBranchData fetches branches and their protection settings

type BranchProtectionAccessLevel 

type BranchProtectionAccessLevel struct {
	AccessLevel            int    `json:"accessLevel"`
	AccessLevelDescription string `json:"accessLevelDescription"`
}

type CICDVariable 

type CICDVariable struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Environment string `json:"environment"`
	Protected   bool   `json:"protected"`
	Masked      bool   `json:"masked"`
	Hidden      bool   `json:"hidden"`
	Value       string `json:"value"`
}

Data of Gitlab projects and groups variables

func GetGitlabInstanceVariables 

func GetGitlabInstanceVariables(token string, instanceUrl string, conf *configuration.Configuration) ([]CICDVariable, error)

GetGitlabInstanceVariables returns all instance variables

func GetGitlabProjectInheritedVariables 

func GetGitlabProjectInheritedVariables(fullPath string, token string, instanceUrl string, conf *configuration.Configuration) ([]CICDVariable, error)

GetGitlabProjectInheritedVariables returns all project inherited variables

func GetGitlabProjectVariables 

func GetGitlabProjectVariables(fullPath string, token string, instanceUrl string, conf *configuration.Configuration) ([]CICDVariable, error)

GetGitlabProjectVariables returns all project variables

type CICDVariableConf 

type CICDVariableConf struct {
	Path        string `json:"path" validate:"required,max=300"`
	Name        string `json:"name" validate:"required,max=300"`
	Environment string `json:"environment" validate:"required,max=100"`
	Protected   bool   `json:"protected"`
	Masked      bool   `json:"masked"`
}

type CICDVariableSource 

type CICDVariableSource struct {
	ID         int            `json:"id"`
	Name       string         `json:"name"`
	Path       string         `json:"path"`
	Visibility string         `json:"visibility"`
	Type       string         `json:"type"`
	All        []CICDVariable `json:"all"`
}

type CICatalogResource 

type CICatalogResource struct {
	ID                  string                     `json:"id"`
	Name                string                     `json:"name"`
	Description         string                     `json:"description"`
	Topics              []string                   `json:"topics"`
	VerificationLevel   string                     `json:"verificationLevel"`
	VisibilityLevel     string                     `json:"visibilityLevel"`
	StarCount           int                        `json:"starCount"`
	Icon                string                     `json:"icon"`
	FullPath            string                     `json:"fullPath"`
	Last30DayUsageCount int                        `json:"last30DayUsageCount"`
	LatestReleasedAt    string                     `json:"latestReleasedAt"`
	WebPath             string                     `json:"webPath"`
	Versions            []CICatalogResourceVersion `json:"versions"`
}

func GetGitlabCIComponentResource added in v0.3.60 

func GetGitlabCIComponentResource(fullPath string, token string, instanceUrl string, conf *configuration.Configuration) (*CICatalogResource, error)

GetGitlabCIComponentResource fetches a SINGLE CI/CD catalog resource by its project full path, with its released versions and their components. It is the targeted replacement for the instance-wide GetGitlabCIComponentResources enumeration: on a large catalog (gitlab.com has ~800 resources) that broad query returns a multi-megabyte payload that exceeds the HTTP timeout, gets cancelled, and silently disables outdated-include detection (#156). This per-component lookup returns in well under a second and is complete (no pagination roulette). Returns (nil, nil) when no catalog resource exists at fullPath — e.g. a component published only as git tags, or a plain project include — so the caller can fall back to the tags API.

func GetGitlabCIComponentResources deprecated 

func GetGitlabCIComponentResources(isGroup bool, token string, instanceUrl string, conf *configuration.Configuration) ([]CICatalogResource, error)

GetGitlabCIComponentResources fetches all CI component resources from GitLab.

Deprecated: this instance-wide enumeration is too heavy on large catalogs and is no longer used for version resolution (see GetGitlabCIComponentResource and #156). Kept for any external callers.

type CICatalogResourceVersion 

type CICatalogResourceVersion struct {
	Name       string        `json:"name"`
	Path       string        `json:"path"`
	Components []CIComponent `json:"components"`
}

type CIComponent 

type CIComponent struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	IncludePath string `json:"includePath"`
}

type CIConfDefault 

type CIConfDefault struct {
	Image interface{} `yaml:"image,omitempty"`
}

type CIConfVariable 

type CIConfVariable struct {
	Description string   `yaml:"description,omitempty"`
	Value       string   `yaml:"value,omitempty"`
	Options     []string `yaml:"options,omitempty"`
}

type Cache 

type Cache struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Key       interface{} `yaml:"key,omitempty"`
	Paths     []string    `yaml:"paths,omitempty"`
	Policy    string      `yaml:"policy,omitempty"`
	When      string      `yaml:"when,omitempty"`
	Untracked bool        `yaml:"untracked,omitempty"`
}

type Environment 

type Environment struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Name map[string]string `yaml:",inline"`
	URL  string            `yaml:"url,omitempty"`
}

type Except 

type Except struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Refs      []string          `yaml:"refs,omitempty"`
	Kinds     []string          `yaml:"kinds,omitempty"`
	Variables map[string]string `yaml:"variables,omitempty"`
}

type GitlabCIConf 

type GitlabCIConf struct {
	Image           interface{}            `yaml:"image,omitempty"`
	GlobalVariables map[string]interface{} `yaml:"variables,omitempty"`
	Stages          []string               `yaml:"stages,omitempty"`
	BeforeScript    interface{}            `yaml:"before_script,omitempty"`
	AfterScript     interface{}            `yaml:"after_script,omitempty"`
	DefaultScript   interface{}            `yaml:"script,omitempty"`
	Default         CIConfDefault          `yaml:"default,omitempty"`
	Spec            interface{}            `yaml:"spec,omitempty"`

	Include    IncludeList            `yaml:"include,omitempty"` // Can be list of string or list of include
	GitlabJobs map[string]interface{} `yaml:",inline"`           // Can be a string or a map[string]GitlabJob
	Workflow   interface{}            `yaml:"workflow,omitempty"`
	Cache      interface{}            `yaml:"cache,omitempty"`
}

GitLab CI Configuration

func ParseGitlabCI 

func ParseGitlabCI(fileContent []byte) (*GitlabCIConf, error)

ParseGitlabCI parses a .gitlab-ci.yml file

type GitlabJob 

type GitlabJob struct {
	Script       interface{}            `yaml:"script,omitempty"`        // Can be both multi lines or one literal block scalar
	BeforeScript interface{}            `yaml:"before_script,omitempty"` // Can be both multi lines or one literal block scalar
	AfterScript  interface{}            `yaml:"after_script,omitempty"`  // Can be both multi lines or one literal block scalar
	Stage        string                 `yaml:"stage,omitempty"`
	Image        interface{}            `yaml:"image,omitempty"`
	Services     interface{}            `yaml:"services,omitempty"` // Can be both a list of string or a list of Serive
	Only         interface{}            `yaml:"only,omitempty"`
	Except       interface{}            `yaml:"except,omitempty"`
	Variables    map[string]interface{} `yaml:"variables,omitempty"`
	Cache        interface{}            `yaml:"cache,omitempty"`
	Dependencies interface{}            `yaml:"dependencies,omitempty"`
	Needs        interface{}            `yaml:"needs,omitempty"`
	Rules        interface{}            `yaml:"rules,omitempty"`
	Artifacts    interface{}            `yaml:"artifacts,omitempty"`
	Environment  interface{}            `yaml:"environment,omitempty"`
	When         interface{}            `yaml:"when,omitempty"`
	AllowFailure interface{}            `yaml:"allow_failure,omitempty"`
	Extends      interface{}            `yaml:"extends,omitempty"`
}

func ParseGitlabCIJob 

func ParseGitlabCIJob(jobContent interface{}) (*GitlabJob, error)

ParseGitlabCIJob parses a job from GitLab CI conf

type GitlabMemberInfo 

type GitlabMemberInfo struct {
	ID            int    `json:"id"`
	Name          string `json:"name"`          // GitLab username (@username)
	DisplayedName string `json:"displayedName"` // GitLab display name (e.g., "John Doe")
	Email         string `json:"email"`
	AvatarURL     string `json:"avatarUrl"`
	AccessLevel   int    `json:"accessLevel"`
}

Common struct for GitLab members (both project and group members)

func FetchGroupMembers 

func FetchGroupMembers(groupID int, token string, APIURL string, conf *configuration.Configuration) ([]GitlabMemberInfo, error)

FetchGroupMembers retrieves all members of a group

func FetchProjectMembers 

func FetchProjectMembers(projectID int, token string, APIURL string, conf *configuration.Configuration) ([]GitlabMemberInfo, error)

FetchProjectMembers retrieves all members of a project

type GitlabPipelineImageData added in v0.3.65 

type GitlabPipelineImageData struct {
	// Gitlab CI configuration
	MergedConf *GitlabCIConf
	CiValid    bool
	CiMissing  bool

	// Default image and variables
	DefaultImage string
	InstanceVars map[string]string
	GroupVars    map[string]string
	ProjectVars  map[string]string
	GlobalVars   map[string]string

	// Images found in the pipeline
	Images []GitlabPipelineImageInfo `json:"images"`
}

type GitlabPipelineImageDataCollection added in v0.3.65 

type GitlabPipelineImageDataCollection struct{}

func (*GitlabPipelineImageDataCollection) Run added in v0.3.65 

func (dc *GitlabPipelineImageDataCollection) Run(project *ProjectInfo, token string, conf *configuration.Configuration, pipelineOriginData *GitlabPipelineOriginData) (*GitlabPipelineImageData, *GitlabPipelineImageMetrics, error)

type GitlabPipelineImageInfo added in v0.3.65 

type GitlabPipelineImageInfo struct {
	Link     string `json:"link"`
	Name     string `json:"image"`
	Tag      string `json:"tag"`
	Registry string `json:"registry"`
	Job      string `json:"job"`
}

type GitlabPipelineImageMetrics added in v0.3.65 

type GitlabPipelineImageMetrics struct {
	Total                      uint `json:"total"`
	IssueUntrusted             uint `json:"issueUntrusted"`
	IssueUntrustedDismissed    uint `json:"issueUntrustedDismissed"`
	IssueForbiddenTag          uint `json:"issueForbiddenTag"`
	IssueForbiddenTagDismissed uint `json:"issueForbiddenTagDismissed"`
}

type GitlabPipelineJobData added in v0.3.65 

type GitlabPipelineJobData struct {
	Name         string   `json:"name"`
	Extends      []string `json:"extends"`
	Lines        int      `json:"lines"`
	IsHardocded  bool     `json:"isHardcoded"`
	IsOverridden bool     `json:"isOverridden"`
}

type GitlabPipelineJobGitlabComponent added in v0.3.65 

type GitlabPipelineJobGitlabComponent struct {
	RepoFullPath           string `json:"repoFullPath"`
	RepoWebPath            string `json:"repoWebPath"`
	RepoName               string `json:"repoName"`
	ComponentName          string `json:"componentName"`
	ComponentLatestVersion string `json:"componentLatestVersion"`
	ComponentIncludePath   string `json:"componentIncludePath"`
}

GitlabPipelineJobGitlabComponent represents a GitLab component

type GitlabPipelineJobPlumberOrigin added in v0.3.65 

type GitlabPipelineJobPlumberOrigin struct {
	ID                uint   `json:"id"`
	Path              string `json:"path"`
	LatestVersion     string `json:"latestVersion"`
	RepoDefaultBranch string `json:"repoDefaultBranch"`
}

GitlabPipelineJobPlumberOrigin represents a Plumber template origin

type GitlabPipelineOriginData added in v0.3.65 

type GitlabPipelineOriginData struct {

	// Gitlab CI configuration
	Conf            *GitlabCIConf
	ConfString      string
	MergedConf      *GitlabCIConf
	MergedResponse  *MergedCIConfResponse
	CiValid         bool
	CiMissing       bool
	CiErrors        []string // Specific CI config errors for output
	IncludesFailed  []string // include locations whose fetch failed (jobs dropped from analysis, #220)
	LimitedAnalysis bool

	// Origins and jobs data
	Origins []GitlabPipelineOriginDataFull

	// CI conf content
	JobMap              map[string]*GitlabPipelineJobData
	JobExtendsMap       map[string][]string
	JobHardcodedMap     map[string]bool
	JobHardcodedContent map[string]interface{}
}

type GitlabPipelineOriginDataCollection added in v0.3.65 

type GitlabPipelineOriginDataCollection struct{}

func (*GitlabPipelineOriginDataCollection) Run added in v0.3.65 

func (dc *GitlabPipelineOriginDataCollection) Run(project *ProjectInfo, token string, conf *configuration.Configuration) (*GitlabPipelineOriginData, *GitlabPipelineOriginMetrics, error)

type GitlabPipelineOriginDataFull added in v0.3.65 

type GitlabPipelineOriginDataFull struct {
	// Origin data generic and specific
	GitlabPipelineOriginDataGeneric
	GitlabPipelineOriginDataProjectSpecific
}

type GitlabPipelineOriginDataGeneric added in v0.3.65 

type GitlabPipelineOriginDataGeneric struct {
	OriginType          string                           `json:"originType"`
	FromPlumber         bool                             `json:"fromPlumber"`
	FromGitlabCatalog   bool                             `json:"fromGitlabCatalog"`
	PlumberOrigin       GitlabPipelineJobPlumberOrigin   `json:"plumberOrigin"`
	GitlabIncludeOrigin IncludeOriginWithoutRef          `json:"gitlabIncludeOrigin"`
	GitlabComponent     GitlabPipelineJobGitlabComponent `json:"gitlabComponent"`
	OriginHash          uint64                           `json:"originHash"`
}

type GitlabPipelineOriginDataProjectSpecific added in v0.3.65 

type GitlabPipelineOriginDataProjectSpecific struct {
	// Data specific to this project
	Version  string `json:"version"`
	UpToDate bool   `json:"upToDate"`
	Nested   bool   `json:"nested"`
	// RefIsAmbiguous: the pinned Version resolves upstream as both a
	// tag and a branch (ref-confusion, ISSUE-402). Set by the origin
	// collector's tag+branch probe; false unless both are confirmed.
	RefIsAmbiguous bool `json:"refIsAmbiguous"`

	// Job related data
	Jobs []GitlabPipelineJobData `json:"jobs"`
}

type GitlabPipelineOriginMetrics added in v0.3.65 

type GitlabPipelineOriginMetrics struct {

	// Data metrics: jobs
	JobTotal     uint `json:"jobTotal"`
	JobHardcoded uint `json:"jobHardcoded"`

	// Data metrics: origin
	OriginTotal         uint `json:"originTotal"`
	OriginComponent     uint `json:"originComponent"`
	OriginLocal         uint `json:"originLocal"`
	OriginProject       uint `json:"originProject"`
	OriginRemote        uint `json:"originRemote"`
	OriginTemplate      uint `json:"originTemplate"`
	OriginGitLabCatalog uint `json:"originGitLabCatalog"`
	OriginOutdated      uint `json:"originOutdated"`
}

type GitlabProtectionAnalysisData added in v0.3.65 

type GitlabProtectionAnalysisData struct {
	Branches           []string                    `json:"branches"`
	BranchProtections  []BranchProtection          `json:"branchProtections"`
	MRApprovalRules    []*glab.ProjectApprovalRule `json:"mrApprovalRules"`
	MRApprovalSettings *glab.ProjectApprovals      `json:"mrApprovalSettings"`
	MRSettings         *glab.Project               `json:"mrSettings"`
	ProjectMembers     []GitlabMemberInfo          `json:"projectMembers"`
}

GitlabProtectionAnalysisData holds all the data needed by protection controls

type GitlabProtectionData added in v0.3.65 

type GitlabProtectionData struct {
	Branches []*GitlabProtectionDataBranch `json:"branches"`
}

GitlabProtectionData holds the collected protection data

type GitlabProtectionDataBranch added in v0.3.65 

type GitlabProtectionDataBranch struct {
	BranchName string `json:"branchName"`
	Default    bool   `json:"default"`
}

GitlabProtectionDataBranch holds branch information

type GitlabProtectionDataCollection added in v0.3.65 

type GitlabProtectionDataCollection struct{}

GitlabProtectionDataCollection handles protection data collection

func (*GitlabProtectionDataCollection) Run added in v0.3.65 

func (dc *GitlabProtectionDataCollection) Run(
	project *ProjectInfo,
	token string,
	conf *configuration.Configuration,
) (*GitlabProtectionAnalysisData, *GitlabProtectionMetrics, error)

Run fetches all GitLab protection data needed by the controls

type GitlabProtectionMetrics added in v0.3.65 

type GitlabProtectionMetrics struct {
	Branches int `json:"branches"`
}

GitlabProtectionMetrics holds metrics about protection data

type Group 

type Group struct {
	IdOnPlatform      int       `json:"idOnPlatform" validate:"required,number"`
	GroupIdOnPlatform int       `json:"groupIdOnPlatform" validate:"number"`
	Path              string    `json:"path" validate:"required,max=300"`
	Name              string    `json:"name" validate:"required,max=300"`
	Visibility        string    `json:"visibility" validate:"required,max=50"`
	CreatedAt         time.Time `json:"createdAt"`
}

Data of a GitLab group

type GroupMetadataNode 

type GroupMetadataNode struct {
	ID         string
	FullName   string
	FullPath   string
	Visibility string
	CreatedAt  time.Time
	Parent     struct {
		ID string
	}
}

type GroupProjectsResponse 

type GroupProjectsResponse struct {
	Group struct {
		Projects struct {
			Nodes    []ProjectMetadataNode
			PageInfo PageInfo
		}
	}
}

Gitlab GraphQL response of query to get all projects of a group with metadata

type Image 

type Image struct {
	Name       string        `yaml:"name,omitempty"`
	Entrypoint []string      `yaml:"entrypoint,omitempty"`
	PullPolicy StringOrSlice `yaml:"pull_policy,omitempty"`
}

type Include 

type Include struct {
	Local    string      `yaml:"local,omitempty"`
	Project  string      `yaml:"project,omitempty"`
	Remote   string      `yaml:"remote,omitempty"`
	Template string      `yaml:"template,omitempty"`
	File     interface{} `yaml:"file,omitempty"` // Slice of string or string
	Ref      string      `yaml:"ref,omitempty"`
}

type IncludeList added in v0.2.8 

type IncludeList []interface{}

IncludeList is a type that can unmarshal from either a scalar value or a slice. GitLab CI accepts both forms:

  • include: "https://..." (scalar string)
  • include: (sequence)
  • "https://..."
  • remote: "https://..."
  • project: foo file: bar.yml

When GitLab serializes the merged CI configuration it may normalize a single-item array into a scalar, which the plain []interface{} field cannot handle. This type absorbs both representations transparently.

func (*IncludeList) UnmarshalYAML added in v0.2.8 

func (il *IncludeList) UnmarshalYAML(unmarshal func(interface{}) error) error

UnmarshalYAML implements yaml.v2 Unmarshaler interface

type IncludeOrigin 

type IncludeOrigin struct {
	IncludeOriginWithoutRef
	Raw string `json:"raw"`
	Ref string `json:"ref"`
}

type IncludeOriginWithoutRef 

type IncludeOriginWithoutRef struct {
	Location string `json:"location"`
	Type     string `json:"type"`
	Project  string `json:"project"`
}

type InstanceGroupsResponse 

type InstanceGroupsResponse struct {
	Groups struct {
		Nodes    []GroupMetadataNode
		PageInfo PageInfo
	}
}

Gitlab GraphQL response of query to get all groups of an instance with metadata

type InstanceProjectsResponse 

type InstanceProjectsResponse struct {
	Projects struct {
		Nodes    []ProjectMetadataNode
		PageInfo PageInfo
	}
}

Gitlab GraphQL response of query to get all projects of an instance with metadata

type MergedCIConfResponse 

type MergedCIConfResponse struct {
	CiConfig struct {
		MergedYaml string                        `json:"mergedYaml"`
		Errors     []string                      `json:"errors"`
		Warnings   []interface{}                 `json:"warnings"`
		Status     string                        `json:"status"`
		Includes   []MergedCIConfResponseInclude `json:"includes"`
		Stages     struct {
			Nodes []struct {
				Name   string `json:"name"`
				Groups struct {
					Nodes []struct {
						Name string `json:"name"`
						Size int    `json:"size"`
						Jobs struct {
							Nodes []struct {
								Name   string   `json:"name"`
								Script []string `json:"script"`
							} `json:"nodes"`
						} `json:"jobs"`
					} `json:"nodes"`
				} `json:"groups"`
			} `json:"nodes"`
		} `json:"stages"`
	} `json:"ciConfig"`
}

Gitlab GraphQL response of merged CI conf

func FetchGitlabMergedCIConf 

func FetchGitlabMergedCIConf(projectPath string, confContent string, sha string, userToken string, instanceUrl string, conf *configuration.Configuration) (MergedCIConfResponse, error)

FetchGitlabMergedCIConf gets merged version of a GitLab CI configuration

type MergedCIConfResponseInclude 

type MergedCIConfResponseInclude struct {
	Location       string `json:"location,omitempty"`
	Raw            string `json:"raw,omitempty"`
	Blob           string `json:"blob,omitempty"` // Contains version-specific reference (e.g., blob SHA) - critical for cache key differentiation
	ContextProject string `json:"contextProject,omitempty"`
	Type           string `json:"type,omitempty"`
	Extra          struct {
		Project string `json:"project,omitempty"`
		Ref     string `json:"ref,omitempty"`
	} `json:"extra,omitempty"`
}

type Only 

type Only struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Refs      []string          `yaml:"refs,omitempty"`
	Kinds     []string          `yaml:"kinds,omitempty"`
	Variables map[string]string `yaml:"variables,omitempty"`
}

type PageInfo 

type PageInfo struct {
	EndCursor   string
	HasNextPage bool
}

GraphQL page info

type Project 

type Project struct {
	IdOnPlatform        int       `json:"idOnPlatform" validate:"required,number"`
	GroupIdOnPlatform   int       `json:"groupIdOnPlatform" validate:"required,number"`
	Path                string    `json:"path" validate:"required,max=300"`
	Name                string    `json:"name" validate:"required,max=300"`
	Visibility          string    `json:"visibility" validate:"required,max=50"`
	DefaultBranch       string    `json:"defaultBranch" validate:"max=100"`
	CiConfPath          string    `json:"ciConfPath" validate:"required,max=100"`
	LastActivityAt      time.Time `json:"lastActivityAt" validate:"required"`
	Archived            bool      `json:"archived"`
	LatestHeadCommitSha string    `json:"latestHeadCommitSha"`
	IsCatalogResource   bool      `json:"isCatalogResource"`
	//Note: IsOfficialCatalogResource is not returned by gitlab, we set it ourselves
	IsOfficialCatalogResource bool              `json:"isOfficialCatalogResource"`
	Languages                 []ProjectLanguage `json:"languages"`
	CreatedAt                 time.Time         `json:"createdAt" validate:"required"`
}

Data of a GitLab project

func FetchProjectByID 

func FetchProjectByID(projectID int, token string, instanceURL string, conf *configuration.Configuration) (*Project, error)

FetchProjectByID fetches project information using its GitLab ID

func FetchProjectDetails 

func FetchProjectDetails(projectPath string, token string, instanceURL string, conf *configuration.Configuration) (*Project, error)

FetchProjectDetails fetches complete project information from GitLab API and returns a Project struct populated with all available data

func (*Project) GetCIPredefinedVariables 

func (p *Project) GetCIPredefinedVariables() map[string]string

GetCIPredefinedVariables returns CI predefined variables based on project info These would normally be available in GitLab CI jobs

func (*Project) ToProjectInfo 

func (p *Project) ToProjectInfo() *ProjectInfo

ToProjectInfo converts Project to the simpler ProjectInfo struct used by collectors

type ProjectBranchesResponse 

type ProjectBranchesResponse struct {
	Project struct {
		Repository struct {
			BranchNames []string
		}
	}
}

Gitlab GrapQL response of query to get all branches of a project

type ProjectInfo 

type ProjectInfo struct {
	ID                  int // Project ID on GitLab
	Path                string
	CiConfPath          string
	DefaultBranch       string // The actual default branch from GitLab (e.g., "main")
	AnalyzeBranch       string // The branch to analyze (from --branch flag, defaults to DefaultBranch)
	LatestHeadCommitSha string
	Archived            bool
	NotFound            bool
	IsGroup             bool // True if organization is a group (vs instance-wide)
}

ProjectInfo contains basic project information for CI analysis

type ProjectLanguage 

type ProjectLanguage struct {
	Name  string  `json:"name"`
	Share float64 `json:"share"`
}

ProjectLanguage represents a programming language used in a project

type ProjectMetadataNode 

type ProjectMetadataNode struct {
	ID                    string
	CreatedAt             time.Time
	NameWithNamespace     string
	FullPath              string
	Visibility            string
	CiConfigPathOrDefault string
	Repository            struct {
		RootRef string
		Tree    struct {
			LastCommit struct {
				Sha string
			}
		}
	}
	Group struct {
		ID string
	}
	LastActivityAt    time.Time
	Archived          bool
	IsCatalogResource bool
	Languages         []struct {
		Name  string  `json:"name"`
		Share float64 `json:"share"`
	}
}

type Resource 

type Resource struct {
	CPU    int `yaml:"cpu,omitempty"`
	Memory int `yaml:"memory,omitempty"`
}

type Resources 

type Resources struct {
	Limits *Resource `yaml:"limits,omitempty"`
}

type RetryConfig 

type RetryConfig struct {
	MaxRetries     int
	InitialBackoff time.Duration
	MaxBackoff     time.Duration
	BackoffFactor  float64
}

RetryConfig holds the configuration for retry logic

func DefaultRetryConfig 

func DefaultRetryConfig(conf *configuration.Configuration) *RetryConfig

DefaultRetryConfig returns the default retry configuration

type Rule 

type Rule struct {
	// NOTE: this type must be updated if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	If           string   `yaml:"if"`
	ChangesFrom  []string `yaml:"changes"`
	When         string   `yaml:"when"`
	AllowFailure bool     `yaml:"allow_failure"`
}

type SecurityPolicyProject 

type SecurityPolicyProject struct {
	Id       int    `json:"id"`
	Name     string `json:"name"`
	FullPath string `json:"fullPath"`
}

type Service 

type Service struct {
	Name       string      `yaml:"name,omitempty"`
	Alias      string      `yaml:"alias,omitempty"`
	Entrypoint string      `yaml:"entrypoint,omitempty"`
	Image      interface{} `yaml:"image,omitempty"`
	Command    string      `yaml:"command,omitempty"`
}

type StringOrSlice 

type StringOrSlice []string

StringOrSlice is a type that can unmarshal from either a string or a slice of strings This is needed for GitLab CI fields like pull_policy that support both formats:

  • pull_policy: "always"
  • pull_policy: [if-not-present, always]
  • pull_policy:
  • if-not-present
  • always

func (*StringOrSlice) UnmarshalYAML 

func (s *StringOrSlice) UnmarshalYAML(unmarshal func(interface{}) error) error

UnmarshalYAML implements yaml.v2 Unmarshaler interface

type Workflow 

type Workflow struct {
	// NOTE: this type must be verified if we need to use it !
	// See https://docs.gitlab.com/ee/ci/yaml/#rules
	Rules interface{} `yaml:"rules,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.