audit-labs/audit-report

 1# Example GitLab CI configuration: collect evidence, then report on it.
 2#
 3# Copy into .gitlab-ci.yml (or `include:` it) in a project under the group you
 4# want to audit. It produces a control-mapped report as a job artifact and fails
 5# the pipeline if any high-severity control is unsupported.
 6#
 7# audit-tools is not published to PyPI — it is a set of per-platform scripts, so
 8# this clones the repo and runs applications/gitlab/audit.py directly.
 9# audit-report *is* pip-installable from git.
10#
11# Required CI/CD variable (Settings > CI/CD > Variables):
12#   GITLAB_TOKEN   a token with read_api scope for the group
13# GITLAB_GROUP defaults to this project's top-level group and the API URL to the
14# instance running the pipeline, so it audits "where it lives" out of the box.
15
16stages: [audit]
17
18compliance-evidence:
19  stage: audit
20  image: python:3.12-slim
21  rules:
22    - if: $CI_PIPELINE_SOURCE == "schedule"
23    - if: $CI_PIPELINE_SOURCE == "web" # manual "Run pipeline"
24  variables:
25    PIP_DISABLE_PIP_VERSION_CHECK: "1"
26    GITLAB_GROUP: $CI_PROJECT_ROOT_NAMESPACE
27  before_script:
28    - apt-get update && apt-get install -y --no-install-recommends git
29    - git clone --depth 1 https://github.com/audit-labs/audit-tools.git
30    - pip install -r audit-tools/requirements.txt
31    - pip install "audit-report @ git+https://github.com/audit-labs/audit-report"
32  script:
33    # Writes $CI_PROJECT_DIR/output/gitlab_audit_<group>_<date>/ against this
34    # instance's API ($CI_API_V4_URL is provided automatically by GitLab).
35    - >
36      python audit-tools/applications/gitlab/audit.py
37      --group "$GITLAB_GROUP" --url "$CI_API_V4_URL"
38      --out "$CI_PROJECT_DIR/output"
39    - PKG=$(ls -d "$CI_PROJECT_DIR"/output/*_audit_* | sort | tail -n1)
40    - audit-report "$PKG" --format md,html,json --out ./report
41    - audit-report "$PKG" --fail-on high
42  artifacts:
43    when: always
44    paths:
45      - report/
46    expire_in: 90 days