GitLab Self-Managed Setup for Local Code Scanning

​

Prerequisites

1. Personal Access Token (PAT)
   Ensure you’ve already created a PAT in the CybeDefend dashboard. If not, see Personal Access Tokens (PAT).
2. CybeDefend CLI
   You can either install the CLI directly in your job container or use a Docker image containing the CLI.

​

Example .gitlab-ci.yml

stages:
  - security-scan

security_scan_job:
  image: ubuntu:latest
  stage: security-scan
  script:
    - apt-get update && apt-get install -y curl
    - curl -L https://github.com/CybeDefend/cybedefend-cli/releases/download/v1.0.0/cybedefend-linux-amd64 -o cybedefend
    - chmod +x cybedefend
    - mv cybedefend /usr/local/bin/
    - cybedefend scan --dir . --ci --project-id $CYBEDEFEND_PROJECT_ID
  only:
    - main

​

Key Points

• Use the “security-scan” stage or any custom stage relevant to your pipeline.
• Install CLI: Basic curl commands to grab the binary.
• Run the scan: Provide --dir . to scan current working directory.
• Env Variables: $CYBEDEFEND_PAT and $CYBEDEFEND_PROJECT_ID are stored in GitLab’s CI/CD Variables.

​

Viewing Results

• Check the CLI output for immediate details.
• Use the CLI ‘results’ command to fetch a more comprehensive vulnerability listing:
  cybedefend results --project-id $CYBEDEFEND_PROJECT_ID --all --output html
  
• Visit CybeDefend Dashboard to see a full breakdown of vulnerabilities found during each pipeline run.