Setting up Managed Service for GitLab integration with SourceCraft Security

Integrating Managed Service for GitLab with SourceCraft Security enables automatic scanning of code from the repositories of a GitLab instance for secrets and vulnerabilities in both dependencies and the code itself. Repositories are mirrored to SourceCraft. Checks are performed on mirrored repositories, and the SourceCraft Security features are available for them in their entirety.

Warning

For integration, you need the paid SourceCraft Security add-on. The cost is based on the SourceCraft pricing policy.

Repositories are created in the same Yandex Cloud organization where the GitLab instance is located. This organization may be different from the personal organization created automatically during your sign-up to SourceCraft. Make sure the add-on is enabled exactly for the organization the instance is in.

By enabling the integration, you confirm sending the source code to SourceCraft. All repositories of the GitLab instance are mirrored, regardless of their visibility settings. In SourceCraft, mirrored repositories are created as private.

Enabling integration

Enable the SourceCraft Security add-on to for your organization

  1. Open the SourceCraft home page.

  2. Navigate to the Organizations list and select the Yandex Cloud organization containing the GitLab instance.

  3. On the organization's page, under Security, open the Overview section.

  4. Make sure the SourceCraft Security add-on is enabled. If a prompt to enable the Security add-on appears instead of scan results, enable it for the selected organization.

    If a trial period is available, click Start free trial and follow the instructions in the UI. If you do not have permission to connect the add-on, contact your organization's administrator.

Enable integration in the GitLab instance settings

  1. In the management console, select the folder containing your GitLab instance.
  2. Navigate to Managed Service for GitLab.
  3. Select your instance and click Edit in the top-right corner of the page.
  4. Under SourceCraft integration, enable Enable SourceCraft integration.
  5. Click Save.
  6. Wait for the instance update to complete: its status will switch from Updating to Running, and in the Overview section, the SourceCraft integration field will show Enabled.

Tip

You can also enable integration when creating the GitLab instance. First, connect the SourceCraft Security add-on to the organization where the instance will be created.

Wait for the repositories to be mirrored

  1. Open the organization for which you have enabled the SourceCraft Security add-on.

  2. Navigate to the organization's repository list and wait for the mirrored repositories of the GitLab instance to appear.

    Their names are derived from the path of the source repository, e.g., test-group/test-subgroup/example-repo is transformed into test-group-test-subgroup-example-repo. Learn more about address transformation.

Note

Scans are triggered when commits are pushed to the default branch of the GitLab source repository. Wait for the code to synchronize and the checks to complete, then view the results in SourceCraft.

Disabling integration

  1. In the management console, select the folder containing your GitLab instance.
  2. Navigate to Managed Service for GitLab.
  3. Select your instance and click Edit in the top-right corner of the page.
  4. Under SourceCraft integration, disable Enable SourceCraft integration.
  5. Click Save.
  6. Wait for the instance update to complete. Under Overview, the SourceCraft integration field will switch to Disabled.

Viewing scan results

The results are available in the SourceCraft vulnerability control center. To grant developers access to them, invite users to the organization and assign roles for the relevant repositories or the organization.

All repositories

Select the organization where the GitLab instance is located. Its vulnerability control center displays results for all repositories of this organization that are accessible to you.

To open the security dashboard for an organization:

  1. Open the SourceCraft home page.

  2. Go to the Organizations tab and select an organization.

  3. Under Security, navigate to Overview.

    The Secret scanning alerts, Dependencies, and Code scanning alerts dashboards provide the following statistics:

    • Alert status.
    • Resolved alerts breakdown.
    • Alerts by severity level (Dependencies and Code scanning alerts dashboards).

    To access detailed lists of issues of a specific type, click next to the dashboard header.

    This page also provides a full list of detected security issues with the following information:

    • Repository name.
    • Issue type.
    • Scanner that detected the problem.
    • Last scan time.
    • Warning data.

Specific repository

Select the mirrored SourceCraft repository matching the source GitLab repository.

To open the security dashboard for a repository:

  1. Open the SourceCraft home page.

  2. On the Home tab, navigate to Repositories and select a repository.

  3. Under  Security on the repository page, go to  Overview.

    The Secret scanning alerts, Dependency scanning alerts, and Code analysis alerts dashboards provide the following statistics:

    • Alert status.
    • Resolved alerts breakdown.
    • Alerts by severity level (Dependency scanning alerts and Code analysis alerts dashboards).

    To download SARIF (Static Analysis Results Interchange Format) or SBOM (Software Bill of Materials) files in SPDX format for audit or integration with external systems, click Download SARIF or Download SBOM on the dashboard.

    The security dashboard also shows the last scan time.

Useful links

Previous
Setting up integration with Yandex Tracker
Next
Authorization