GitLab CI

include:
  - remote: https://raw.githubusercontent.com/trustivan/trustivan/main/infra/ci/trustivan-gate.gitlab-ci.yml

scan:
  extends: .trustivan-gate
  variables:
    TRUSTIVAN_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    TRUSTIVAN_POLICY: $TRUSTIVAN_POLICY_ID

The key

Add TRUSTIVAN_API_KEY as a project CI/CD variable, masked and protected. Masked keeps it out of the job log. Protected is the one that actually matters: an unprotected variable is readable by anyone who can open a merge request from a branch, which on most projects is everyone. Scopes: scans:create, scans:read, verdicts:request. Nothing else.

Variables

Variable	Default	Meaning
`TRUSTIVAN_URL`	`https://app.trustivan.com`	The deployment
`TRUSTIVAN_IMAGE`		Container image to scan
`TRUSTIVAN_REPO`		Repository URL. Name one of these two
`TRUSTIVAN_REF`		Branch, tag or commit, for a repository scan
`TRUSTIVAN_POLICY`		Policy id. Empty uses your organization’s enabled policy
`TRUSTIVAN_TIMEOUT`	`20m`	How long to wait for the scan
`TRUSTIVAN_CLI_VERSION`	`latest`	CLI release to download
`TRUSTIVAN_IDEMPOTENCY_KEY`	`$CI_PIPELINE_ID`	Makes a retried job reuse its scan

Exit codes

The job fails on both 1 and 2, but they mean different things:

Code	Meaning	What to do
`0`	The policy passed	—
`1`	The policy blocked the build	Fix the findings, or exempt them
`2`	TRUSTIVAN could not answer	Check the key, the URL and network egress

On 2 the job log says so explicitly, so an outage does not read as a wave of new vulnerabilities.

Scanning the repository instead of an image

scan:
  extends: .trustivan-gate
  variables:
    TRUSTIVAN_REPO: $CI_PROJECT_URL
    TRUSTIVAN_REF: $CI_COMMIT_SHA

A private project needs a stored git credential for the GitLab host — a deploy token is the right shape. See Scan a private repository. The pipeline’s own CI_JOB_TOKEN is not used: it lives for the job, and a scan that outlives it could not re-fetch.

Air-gapped runners

The template downloads the CLI from GitHub releases. A runner without that route should use the backend image, which carries the same binary at /app/trustivan:

scan:
  image: ghcr.io/trustivan/trustivan-backend:v1.0.0
  script:
    - /app/trustivan gate --image "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"

Getting started

Concepts

Tutorials

How-to guides

Integrations

Help

The key

Variables

Exit codes

Scanning the repository instead of an image

Air-gapped runners

​The key

​Variables

​Exit codes

​Scanning the repository instead of an image

​Air-gapped runners

The key

Variables

Exit codes

Scanning the repository instead of an image

Air-gapped runners