socket.yml for GitLab

Override the Socket GitLab app's defaults for one project with a socket.yml file in the project root.

🧪
Socket for GitLab is in beta. Behavior may change between releases.

A project overrides the Socket GitLab app's defaults with a socket.yml file in its root (socket.yaml also works). The app reads projectIgnorePaths and the gitlabApp keys, and ignores every other key.

Example socket.yml for GitLab

This file leaves the dist and vendor folders out of scans, keeps both merge request comments, and turns off the commit status for the project:

version: 2
projectIgnorePaths:
  - dist
  - "vendor/**"
gitlabApp:
  enabled: true
  dependencyOverviewEnabled: true
  pullRequestAlertsEnabled: true
  commitStatusEnabled: false

The GitLab app doesn't need version: 2, but keep it so the same file works with the Socket GitHub App and the Socket CLI.

Keys the GitLab app reads

Each key is optional. Without a key, the app uses the setting from its environment file:

Key	Default	Effect
`projectIgnorePaths`	None	Paths and glob patterns left out of push and merge request scans
`gitlabApp.enabled`	`true`	`false` skips merge request scans and comments; pushes still create scans
`gitlabApp.dependencyOverviewEnabled`	`ENABLE_DEPENDENCY_OVERVIEW_COMMENTS`	Turns the dependency overview comment on or off
`gitlabApp.pullRequestAlertsEnabled`	`ENABLE_ALERTS_COMMENTS`	Turns the alerts comment on or off
`gitlabApp.commitStatusEnabled`	`ENABLE_COMMIT_STATUS`	Turns the "Socket Security" commit status on or off

A folder name in projectIgnorePaths, such as dist, also covers everything inside it.

Where the app reads socket.yml

The app reads socket.yml from the commit it scans: the pushed commit for push scans, and the merge request's latest commit for merge request scans. A file that can't be read or parsed is logged and ignored, so it never fails a scan.

socket.yml for GitLab

Example socket.yml for GitLab

Keys the GitLab app reads

Where the app reads socket.yml

Related topics

What’s Next