Skip to main content

GitLab CI

Scan every merge request from GitLab CI. The job authenticates with a GitLab OIDC token, so there is no API key to store.

Set it up​

  1. In Musha, open your project > Integration > Pull request scan.
  2. Enter the project path as group/project (nested groups are fine), optionally pin a ref, and click Connect repository.
  3. Copy the job shown there into your .gitlab-ci.yml.

The guide generates the job for your project, with your project ID filled in. Always copy it from there: it includes the step that works out which lines the merge request added, and that step is easier to get from the guide than to retype.

What the job does​

  • Runs on merge request pipelines only ($CI_PIPELINE_SOURCE == "merge_request_event"), never on a bare branch push.
  • Sets GIT_DEPTH: "0" so the merge request diff has full history.
  • Requests an ID token with aud: api.mushasec.com and exchanges it for a short-lived Musha token.
  • Computes the lines the merge request added, packages the code and uploads it.
  • Musha posts a comment on the merge request.

The runner image needs curl, jq, tar and git. The generated job installs them on Alpine.

Musha accepts the token only if you connected that GitLab project to the Musha project in the Integration guide.

Failing the job when a scan is blocked​

The scan runs while the request is open, and the response says whether it was blocked:

{ "scan_id": "<scan-id>", "status": "completed", "blocked": true }

On GitHub, the Musha action fails the job when blocked is true. The generated GitLab job does not: the request succeeds, the comment is posted, and the pipeline stays green. If you want the pipeline to fail, save the response and check the field. Replace the final curl line with the same command plus -o musha.json, then add:

cat musha.json
jq -e '.blocked == false' musha.json > /dev/null

jq -e exits non-zero when blocked is true, which fails the job.

note

Failing the job is only half of a gate. To stop the merge itself, require the pipeline to pass in your merge request settings.

Troubleshooting​

The token exchange fails. The GitLab project isn't connected, or the ref doesn't match. Check Settings > CI / Pipeline in Musha.

The job doesn't run on merge requests. Make sure the rules entry above is present and that merge request pipelines are enabled for the project.

Every finding is treated as new. The pipeline cloned a shallow history. Keep GIT_DEPTH: "0".

A 429 response. See Limits.