socket-gitlab

A native GitLab CI/CD Component that runs Socket supply-chain analysis on merge requests — the GitLab analogue of Socket's first-party GitHub Action.

Unlike dropping the Socket CLI into a raw pipeline snippet, this component:

• Installs with one include: line (publishable to the GitLab CI/CD Catalog).
• Renders findings natively in the MR widget via a GitLab Code Quality report.
• Posts a single sticky MR comment that updates in place instead of spamming notes.
• Provides a clean merge gate (fails the job on blocking alerts).
• Scans npm + PyPI + NuGet manifests in one pass (JS, Python, and .NET/Blazor).

Status: starter scaffold. The Socket API call in src/socket.ts is stubbed and marked TODO — wire it to @socketsecurity/sdk (verify method names against its README) before this does real work. Everything else (GitLab reporting, sticky comments, Code Quality mapping, the component template) is structurally complete.

How a consumer uses it

# .gitlab-ci.yml in any project
include:
  - component: $CI_SERVER_FQDN/<your-group>/socket-gitlab/scan@~latest
    inputs:
      fail-on-alert: true

They set two CI/CD variables: SOCKET_SECURITY_API_KEY (Socket API token) and GITLAB_TOKEN (a project access token with api scope, used to post the MR comment).

Repo layout

templates/scan.yml     # the CI/CD Component (what consumers include)
src/scan.ts            # orchestrator: detect manifests -> scan -> emit outputs
src/socket.ts          # Socket SDK wrapper  <-- the one TODO to wire up
src/gitlab.ts          # sticky MR comment + changed-file detection via GitLab API
src/codequality.ts     # map Socket alerts -> GitLab Code Quality report JSON
.gitlab-ci.yml         # self-test + publish to the CI/CD Catalog (dogfoods Socket)
example/.gitlab-ci.yml # copy/paste example for consumers

Local development

npm install
npm run build      # tsc -> dist/
npm run scan       # runs against the current MR env (needs CI vars set)

Roadmap (ship the MVP first)

MVP (do these, then publish):

• Wire src/socket.ts to @socketsecurity/sdk
• Code Quality report renders in the MR widget
• Sticky MR comment updates in place
• Merge gate via job exit code
• Run Socket on this repo and add the badge to this README (dogfood)

Stretch:

• SARIF / Dependency-Scanning report into the GitLab Security tab (Ultimate)
• Policy config: which alert types block vs. warn
• Diff-only mode: flag only alerts newly introduced by the MR