Socket in your Gitlab Pipeline

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for your open source dependencies. It is easy to integrate Socket into your Gitlab Pipeline to provide an extra layer of security against Supply Chain Attacks.

Adding Socket to your pipeline

Create your Socket API Key

You can either create your API Key yourself if you have permissions in your socket.dev account or you can have your Admin create it for you with the Reports scope.

  1. Log into the socket.dev dashboard

  2. Go to Settings

  3. Go to the API Tokens tab

  4. Select Create API Token

  5. Give the token a name like Gitlab API Token

  6. Select the report, repo, and full-scans Scopes

  7. Click Confirm

  8. Click on Show key

  9. Click on the API Token to copy

Create your Socket Environment variables

  1. Log into Gitlab

  2. Navigate to your project

  3. Go to Settings -> CI/CD

  4. Expand Variables

  5. Do Add Variable

    1. Select Mask Variable
    2. Key: SOCKET_SECURITY_API_KEY
    3. Value: Socket API Token
  6. Create a new variable for your Gitlab Token that has access to the Project

  7. Key: GITLAB_TOKEN

  8. Value: gitlab_token_with_access

Example Gitlab Pipeline Setup

  1. Go to Build

  2. Go to Pipeline Editor

  3. Paste the following Pipeline Yaml, or integrate with your existing code

    test:
      image: socketdev/cli:0.0.67
      rules:
          - when: always
            changes:
            - package.json
            - package-lock.json
            - ./**/package.json
            - ./**/package-lock.json
      script:
          - socketcli --repo $CI_PROJECT_NAME --branch $(if [ -z $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME ]; then echo "$CI_COMMIT_BRANCH"; else echo "$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"; fi) --target_path $CI_PROJECT_DIR --committer "$(echo $CI_COMMIT_AUTHOR | awk -F '<' '{print $2}' | head -c -2)" --commit_message "$CI_COMMIT_MESSAGE" --pr_number $(if [ -z $CI_MERGE_REQUEST_ID ]; then echo 0; else echo $CI_MERGE_REQUEST_ID; fi) --scm gitlab
    
  4. Commit changes to your main branch or the current branch you are working on

Testing pipeline

  1. Create a new branch

  2. Modify or add a package.json

  3. Create a new Merge request

  4. Confirm that the Socket CI pipeline job ran

  5. Confirm that for an unhealthy report a comment is left on the Merge request


What’s Next

That's it! You're all done now any time there is an update to your manifest file the Socket CI will automatically run. You can update the criteria to add more things like requirements.txt or other lock files.