GitLab

configuration the gitlab integration scans repositories in gitlab to scan artifacts in gitlab ci, see scanning in ci docid 8dqnvc9xddxkjkd3dy8xu instead web configuration you can configure this integration via the web ui through the integrations tab or you can use a local configuration file as outlined below local configuration access token sources \ connection '@type' type googleapis com/sources gitlab endpoint https //gitlab ourbusiness com \# the gitlab token must be created with the \# `read api` scope token xxxxxxxxxxxxxxxxxxxxxxxxxx skipbinaries true name gitlab scanperiod 12h type source type gitlab verify true basic auth sources \ connection '@type' type googleapis com/sources gitlab endpoint https //gitlab ourbusiness com basicauth password xxxxxxxxxxxxxxx username svc user ignorerepos \ trufflesecurity/test keys skipbinaries true name gitlab scanperiod 12h type source type gitlab verify true options key description required endpoint the url endpoint for the gitlab server defaults to gitlab cloud no repositories list of repository names to scan in gitlab omit to enumerate instead no ignorerepos list of repository names to ignore in an organization scan supports globbing with no includerepos list of repository names to include in an organization scan supports globbing with no skipbinaries whether to skip scanning binary files no skiparchives whether to skip scanning archive files no capabilities feature supported scan archive files ✅ scan archived repos ✅ scan base64 encoded data ✅ scan binaries ✅ exclude filter ✅ include filter ✅ pre commit ✅ pre receive ✅ scan gitlab actions ✅ auto resume ✅ notes trufflehog does not scan diffs > 1 gb