supply-chain¶

Run packaged supply-chain pinning policies against GitLab CI YAML.

Validates include, image, and service version pinning using bundled
GLCI-IMAGE-PINNING, GLCI-INCLUDE-VERSIONS, and related policies.
Pass --fix to auto-remediate YAML before checking.

What it checks¶

Bundled policies cover:

Include pinning (GLCI-INCLUDE-VERSIONS)
Container image pinning (GLCI-IMAGE-PINNING)
Service container pinning (for example docker:dind version tags)

Run¶

gitlab-compliance supply-chain -p .gitlab-ci.yml

Also available via check --with-supply-chain (read-only policy checks). Pass --fix on either command to auto-remediate YAML before checking. Omit -f to run only the bundled pack, or pass -f to merge your policies alongside it.

For merge requests after fixes, use check --fix --create-mr (or supply-chain --fix --create-mr).

See Image pinning and Include versions.

Usage¶

Usage: gitlab-compliance supply-chain [OPTIONS]

Options¶

pipeline_file:
Type: STRING
Default: .gitlab-ci.yml
Usage: --pipeline -p

Path to the GitLab CI pipeline YAML file.

output_format:
Type: Choice(['console', 'markdown', 'html', 'mr-comment', 'codequality', 'junit'])
Default: console
Usage: --format

Output format for the supply-chain compliance report.

output_file:
Type: STRING
Default: none
Usage: --output-file -o

Write rendered report to this file (markdown, html, mr-comment, junit).

include_nested:
Type: BOOL
Default: true
Usage: --include-nested

Resolve nested local include files into the compliance stash.

max_include_depth:
Type: INT
Default: none
Usage: --max-include-depth

Max local include nesting depth from the root file (omit for unlimited).

resolve_external_includes:
Type: BOOL
Default: none
Usage: --resolve-external-includes

Fetch remote and project include YAML (default: auto — remote always, project when a token is available).

features_dir:
Type: STRING
Default: none
Usage: --features -f

Policy directory to run instead of packaged supply-chain policies. Defaults to bundled include, image, and service pinning.

gitlab_url:
Type: STRING
Default: none
Usage: --gitlab-url

GitLab instance URL (default: CI_SERVER_URL or https://gitlab.com).

token:
Type: STRING
Default: none
Usage: --token

GitLab API token (default: GITLAB_TOKEN or CI_JOB_TOKEN).

project:
Type: STRING
Default: none
Usage: --project

GitLab project path or ID for API-backed policy checks.

group:
Type: STRING
Default: none
Usage: --group

GitLab group path or ID for API-backed policy checks.

strict:
Type: BOOL
Default: false
Usage: --strict

Fail API-backed scenarios when connection info is missing (default: skip).

fix:
Type: BOOL
Default: false
Usage: --fix

Auto-fix outdated include refs and pin container images to sha256 digests before running supply-chain checks (mutates YAML).

create_mr:
Type: BOOL
Default: false
Usage: --create-mr

After --fix, commit changed files and open a GitLab merge request (requires --token/GITLAB_TOKEN PAT; CI_JOB_TOKEN is rejected).

mr_branch:
Type: STRING
Default: none
Usage: --mr-branch

Source branch for --create-mr (default: gitlab-compliance/supply-chain-fix).

mr_target_branch:
Type: STRING
Default: none
Usage: --mr-target-branch

Target branch for --create-mr (default: project default branch).

help:
Type: BOOL
Default: false
Usage: --help

Show this message and exit.

CLI Help¶

Usage: gitlab-compliance supply-chain [OPTIONS]

  Run packaged supply-chain pinning policies against GitLab CI YAML.

  Validates include, image, and service version pinning using bundled GLCI-
  IMAGE-PINNING, GLCI-INCLUDE-VERSIONS, and related policies. Pass --fix to
  auto-remediate YAML before checking.

Options:
  -p, --pipeline TEXT             Path to the GitLab CI pipeline YAML file.
  --format [console|markdown|html|mr-comment|codequality|junit]
                                  Output format for the supply-chain
                                  compliance report.
  -o, --output-file TEXT          Write rendered report to this file
                                  (markdown, html, mr-comment, junit).
  --include-nested / --no-include-nested
                                  Resolve nested local include files into the
                                  compliance stash.
  --max-include-depth INTEGER     Max local include nesting depth from the
                                  root file (omit for unlimited).
  --resolve-external-includes / --no-resolve-external-includes
                                  Fetch remote and project include YAML
                                  (default: auto — remote always, project when
                                  a token is available).
  -f, --features TEXT             Policy directory to run instead of packaged
                                  supply-chain policies. Defaults to bundled
                                  include, image, and service pinning.
  --gitlab-url TEXT               GitLab instance URL (default: CI_SERVER_URL
                                  or https://gitlab.com).
  --token TEXT                    GitLab API token (default: GITLAB_TOKEN or
                                  CI_JOB_TOKEN).
  --project TEXT                  GitLab project path or ID for API-backed
                                  policy checks.
  --group TEXT                    GitLab group path or ID for API-backed
                                  policy checks.
  --strict                        Fail API-backed scenarios when connection
                                  info is missing (default: skip).
  --fix                           Auto-fix outdated include refs and pin
                                  container images to sha256 digests before
                                  running supply-chain checks (mutates YAML).
  --create-mr                     After --fix, commit changed files and open a
                                  GitLab merge request (requires
                                  --token/GITLAB_TOKEN PAT; CI_JOB_TOKEN is
                                  rejected).
  --mr-branch TEXT                Source branch for --create-mr (default:
                                  gitlab-compliance/supply-chain-fix).
  --mr-target-branch TEXT         Target branch for --create-mr (default:
                                  project default branch).
  --help                          Show this message and exit.