GitLab CI

Create CHECKOPS_TOKEN in Settings › CI/CD › Variables (masked, protected).

Image scan and upload

checkops:
  stage: test
  image: registry.gitlab.com/clearcloud.fr/check-ops/cli:latest
  before_script: []
  script:
    - checkops push gl-container-scanning-report.json --product $CI_PROJECT_NAME --version $CI_COMMIT_REF_NAME --wait --fail-on critical

gl-container-scanning-report.json comes from the GitLab Container Scanning template. With Trivy directly:

scan:
  stage: test
  image: { name: aquasec/trivy:latest, entrypoint: [""] }
  script:
    - trivy image --format json -o trivy.json $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    - curl -sSfL https://checkops.eu/install.sh | CHECKOPS_INSTALL_DIR=/tmp sh
    - /tmp/checkops push trivy.json --product $CI_PROJECT_NAME --version $CI_COMMIT_SHORT_SHA --wait --fail-on high

Merge request: what the branch changes

diff:
  stage: test
  image: registry.gitlab.com/clearcloud.fr/check-ops/cli:latest
  rules: [{ if: $CI_PIPELINE_SOURCE == "merge_request_event" }]
  script:
    - checkops diff main.trivy.json trivy.json --format table --fail-on-new high

Secrets in the repository

secrets:
  stage: test
  image: { name: zricethezav/gitleaks:latest, entrypoint: [""] }
  script:
    - gitleaks detect --report-format json --report-path gitleaks.json || true
    - curl -sSfL https://checkops.eu/install.sh | CHECKOPS_INSTALL_DIR=/tmp sh
    - /tmp/checkops push gitleaks.json --product $CI_PROJECT_NAME --version $CI_COMMIT_SHORT_SHA --wait

Go: reachability

govulncheck:
  stage: test
  image: golang:1.23
  script:
    - go install golang.org/x/vuln/cmd/govulncheck@latest
    - govulncheck -format json ./... > govulncheck.json || true
    - curl -sSfL https://checkops.eu/install.sh | CHECKOPS_INSTALL_DIR=/tmp sh
    - /tmp/checkops push govulncheck.json --product $CI_PROJECT_NAME --version $CI_COMMIT_SHORT_SHA