Integrate vet with Gitlab CI/CD Catalog as a Component

[abhisek]

Gitlab launched CI/CD catalog:
https://about.gitlab.com/blog/2023/12/21/introducing-the-gitlab-ci-cd-catalog-beta/

To be able to integrate with Gitlab CI through its Catalog, we need to package vet as a Gitlab CI Component
https://docs.gitlab.com/ee/ci/components/

[insaaniManav]

@abhisek I would like to work on this

[abhisek]

@insaaniManav Awesome. Thanks :)

Lets pick this up first. Goal is to provide vet-action like user experience for Gitlab CI and list in Gitlab CI catalog. It may not be exact user experience but closer. Lets do a bit of analysis to identify how we can integrate vet natively in Gitlab CI using Gitlab CI Components:

https://docs.gitlab.com/ee/ci/components/

[KunalSin9h]

Feature implementation approach:

Approach:

CI Component can be implemented with any language, favorably using bash script or golang, since there is no package (like github actions), this makes the implementation pretty simple. We just need to create a report and make it available to artifact (gitlab will take case of displaying this report to, PR section, Pipeline section and Security Dashboards).

Blocking: #404

CycloneDX Support Docs: https://docs.gitlab.com/user/application_security/dependency_scanning/#cyclonedx-software-bill-of-materials

Reference:

• Creating GitLab Security Scanners
• dependency_scanning report format schema
• How to upload Artifacts
• Free Vs Ultimate Tier

Progress:

• Create a demo repository for testing CI Component

  https://gitlab.com/KunalSin9h/dummy
  This repository holds the demo-client-python repo

• Create a GitLab CI Component Repository in safedep gitlab org.
• Understand current vet-action project and usage
• Learn GitLab CI

  https://youtu.be/z7nLsJvEyMY?si=vBsisEbe7t28gydW
  YAML Syntax reference: https://docs.gitlab.com/ci/yaml/#stages

• ⌛ Read Dependency Sanning CI component project from gitlab

  https://gitlab.com/explore/catalog/components/dependency-scanning

• Work on core CI Logic
• Test it on Demo repo
• Release it
• Verify Catalog Presence

[abhisek]

@KunalSin9h When an MR is raised, how can get have vet run automatically, perform necessary scanning and then add a comment to the MR? Is this possible with Gitlab like we do for GitHub?

[KunalSin9h]

@abhisek yes, it possible and this is what happening.

see this MR: https://gitlab.com/vetting/dummy/-/merge_requests/9

This is a dummy repo, i am prototyping solution on.

See, vet run automatilly as CI just like github (doing necessary scanning), but we dont do comments, it is done by gitlab automatically, we just have to give gitlab correct report artifact of different types

[KunalSin9h]

Its UX is better then github i my view

[KunalSin9h]

i see other uses are not able to see the security details. only we (developer) see it

[abhisek]

@KunalSin9h I think it is fine that Gitlab restricts security info to developers only

[KunalSin9h]

@abhisek its flexible
This was the artifacts config, we can make it all or none also

job:
  artifacts:
    access: 'developer'