gitlab osv-scanner

[jsqfengbao]

If I want to use osv-scanner on gitlab, how do I configure the yml file? Is there a corresponding tool or plug-in that can be installed?

[oliverchang]

We currently don't have support for GitLab unfortunately, but we'd be very happy to take contributions!

[jsqfengbao]

We currently don't have support for GitLab unfortunately, but we'd be very happy to take contributions!

OK, I'd love to

[andrewpollock]

https://docs.gitlab.com/ee/ci/migration/github_actions.html is probably relevant...

[andrewpollock]

Also https://about.gitlab.com/blog/2024/02/27/how-to-integrate-custom-security-scanners-into-gitlab/#tutorial-integrating-custom-security-scanners as surfaced in https://groups.google.com/g/osv-discuss/c/1zA5yRWJK9w

[H4x0rcr4x]

Also https://about.gitlab.com/blog/2024/02/27/how-to-integrate-custom-security-scanners-into-gitlab/#tutorial-integrating-custom-security-scanners as surfaced in https://groups.google.com/g/osv-discuss/c/1zA5yRWJK9w

Adding to this:

Integrating a security scanner, with results automatically presented in various places in GitLab, means ensuring the output is in a GitLab-specified format.

Integrating external security scanners into your DevSecOps workflow blog post provides an example of using a custom Synk and a script to convert the resulting JSON to the GitLab-specified format.

You can find the schemas for existing scanners here:

Container Scanning
Coverage Fuzzing
DAST
Dependency Scanning (this is likely the one that you will want to use for OSV-Scanner)
SAST
Secret Detection

Your output will need to adhere to one of these schemas. The docs provide further details on the available Report Fields in these schemas.

[H4x0rcr4x]

Let me know who I can send a boatload of ☕️🧋to for your help with making this a reality!
Thank you!!!

[H4x0rcr4x]

If I want to use osv-scanner on gitlab, how do I configure the yml file? Is there a corresponding tool or plug-in that can be installed?

I just posted how to do it in GitLab. I have had osv-scanner running in GitLab for a few months.

[cuixq]

Thank you @H4x0rcr4x for sharing the configuration file!

[H4x0rcr4x]

@cuixq you're welcome.

Here is the updated configuration to enable osv-scanner in GitLab's .gitlab-ci.yml file.

#
# OSV scanner for vulnerabilities
#
osv_scanner:
  stage: test
  rules: 
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'  
  image:
    name: ghcr.io/google/osv-scanner:v1.9.1 # osv-scanner final v1 stable image
    entrypoint: [""] # Override entry point
  script: # osv-scanner recursively scans the project for dependencies
    - /osv-scanner --format json --call-analysis -r . > osv-scanner-report.json
  artifacts:
    paths:
      - osv-scanner-report.json
    expire_in: 7 days