Skip to main content

GitLab CI

Drop Vulkro into a GitLab pipeline as a test-stage job that publishes JUnit so findings render in the MR's test-report tab.

No pipeline change with Vulkro Cloud

If this repository is connected to Vulkro Cloud, you do not need a pipeline step for pull requests: Vulkro Cloud scans each pull request into a tracked branch and reports back on it with a status and a summary comment (pull-request checks are on every Vulkro Cloud plan). See Pull requests in Vulkro Cloud.

Minimal pipeline​

.gitlab-ci.yml
vulkro:
  stage: test
  image: ubuntu:24.04
  # VULKRO_ACCOUNT_TOKEN: a masked CI/CD variable holding your CI key
  script:
    - curl -fsSL https://dist.vulkro.com/install.sh | bash
    - vulkro login
    - vulkro scan . --format junit > vulkro-junit.xml
    - vulkro scan . --min-confidence high
  artifacts:
    when: always
    reports:
      junit: vulkro-junit.xml
    paths:
      - vulkro-junit.xml
    expire_in: 30 days

The two vulkro scan calls are intentional:

  1. The first run produces JUnit. Its exit code is not gated, so it always succeeds, and the reports.junit artefact path makes it show up in the MR UI.
  2. The second run is the gate.

Licence the runner​

Every machine that scans needs an active trial or Pro, CI runners included. Create a CI key in the customer portal (app.vulkro.com) and add it as a masked CI/CD variable named VULKRO_ACCOUNT_TOKEN; GitLab exposes it to the job and vulkro login exchanges it for a lease. A CI key works for the 14-day trial and for paid plans, uses no device seat, and can be revoked. Without it, the job fails with exit code 1 and license_required. See Accounts and licensing.

Caching the binary​

vulkro:
  stage: test
  image: ubuntu:24.04
  cache:
    key: vulkro-v0.34.1
    paths:
      - .vulkro-cache/
  before_script:
    - mkdir -p .vulkro-cache
    - export VULKRO_BIN_DIR="$CI_PROJECT_DIR/.vulkro-cache"
    - export PATH="$VULKRO_BIN_DIR:$PATH"
    - test -x "$VULKRO_BIN_DIR/vulkro" || curl -fsSL https://dist.vulkro.com/install.sh | bash
    - vulkro login
  script:
    - vulkro scan . --format junit > vulkro-junit.xml
    - vulkro scan . --min-confidence high

SARIF artefact (for external dashboards)​

GitLab doesn't natively render SARIF in MRs, but the artefact is useful for downstream consumers:

  script:
    - vulkro scan . --format sarif > vulkro.sarif
  artifacts:
    paths:
      - vulkro.sarif

Air-gapped runner​

An air-gapped runner cannot sign in, so it uses a licence file instead of a CI key: add the base64 of a .lic file as a masked CI/CD variable named VULKRO_LICENSE_B64 (no vulkro login step is needed).

vulkro:
  # VULKRO_LICENSE_B64: a masked CI/CD variable holding the base64 of a .lic file
  variables:
    VULKRO_OFFLINE: "1"
    VULKRO_CDN_BASE_URL: "https://artifacts.internal/vulkro-cve"
  before_script:
    - curl -fsSL https://artifacts.internal/vulkro/install.sh | bash
Last updated on