Component for Dependency and License Scanning

This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this component is capable of generating a Dependency Scanning report from the vulnerabilities detected in the project's dependencies.

Requirements

This CI/CD component requires GitLab dependency scanning capabilities, a GitLab Ultimate feature.

Usage

Add the following snippet to your .gitlab-ci.yml to run the dependency-scanning job with the default configuration.

include:
  - component: $CI_SERVER_FQDN/components/dependency-scanning/main@<VERSION>

You can also customize the job uisng the CI/CD component's inputs. For example, you can configure the log level and the job stage with the following configuration.

include:
  - component: $CI_SERVER_FQDN/components/dependency-scanning/main@<VERSION>
    inputs:
      log_level: "debug"
      stage: "security-scanning"

[!note] Make sure to set the component's version. Released versions may be found in the tags section of the project. More information on component versioning and available options may be found in component versions documentation.

Inputs

Please see the catalog page for the complete list of allowed inputs.

Contribute

1. Read how to contribute to GitLab development and the Development guide for GitLab official CI/CD components.
2. Submit a merge request, and follow the bot instructions.

Release process

1. Promote unreleased changelogs with changie batch auto.
2. Update CHANGELOG.md with changie merge.
3. Create a new release using the latest version in the changelog with git tag "$(changie latest -r)" && git push origin "$(changie latest -r)".