Skip to content
Firmis

GitLab CI

Every merge request that ships without a security scan is a gamble. This one takes five minutes to set up and surfaces findings inline in every MR from that point on.

Quickstart

Section titled “Quickstart”

Add a firmis-scan job to your .gitlab-ci.yml to scan on every push.

.gitlab-ci.yml
firmis-scan:
  stage: test
  image: node:20-slim
  script:
    - npx firmis ci --fail-on high --format sarif --output firmis.sarif
  artifacts:
    reports:
      sast: firmis.sarif
    paths:
      - firmis.sarif
    expire_in: 30 days
  allow_failure: false

Pipeline examples

Section titled “Pipeline examples”

Minimal job that fails the pipeline on high or critical findings.

.gitlab-ci.yml
stages:
  - test


firmis-scan:
  stage: test
  image: node:20-slim
  script:
    - npx firmis ci --fail-on high
  allow_failure: false

Viewing results in GitLab

Section titled “Viewing results in GitLab”

After the pipeline runs with reports.sast, findings appear in two places.

Merge request security widget

Section titled “Merge request security widget”

When a merge request triggers the pipeline, GitLab adds a Security scanning widget at the bottom of the MR. It shows a diff of new threats introduced by the branch compared to the target branch.

Security Dashboard

Section titled “Security Dashboard”

Go to Security → Security Dashboard in your project or group to see all findings across branches and time periods.

Block merges on security findings

Section titled “Block merges on security findings”

To prevent merging when Firmis detects high-severity threats, configure an approval rule.

  1. Go to Settings → Merge requests in your GitLab project.

  2. Under Merge request approvals, click Add approval rule.

  3. Name it Security scan must pass and set the required approvals to 1.

  4. Alternatively, use Security Approvals (GitLab Ultimate): go to Security → Policies and create a scan result policy that requires approval for critical or high findings.

  5. Enable Pipelines must succeed under Merge checks to block merges if the firmis-scan job fails.

With allow_failure: false on the job and Pipelines must succeed enabled, any build with high or critical findings will block the merge.

Multi-project pipelines

Section titled “Multi-project pipelines”

If you use GitLab’s parent-child pipeline feature, you can run Firmis as a child pipeline for a specific subdirectory.

.gitlab-ci.yml
trigger-firmis:
  stage: test
  trigger:
    include: .gitlab/firmis-pipeline.yml
    strategy: depend
.gitlab/firmis-pipeline.yml
firmis-scan:
  stage: test
  image: node:20-slim
  script:
    - cd $CI_PROJECT_DIR
    - npx firmis ci --fail-on high --format sarif --output firmis.sarif
  artifacts:
    reports:
      sast: firmis.sarif
    expire_in: 30 days

Scheduled scans

Section titled “Scheduled scans”

Run a nightly scan against your main branch to catch newly published vulnerabilities (OSV database is queried at scan time).

.gitlab-ci.yml
firmis-nightly:
  stage: test
  image: node:20-slim
  script:
    - npx firmis ci --fail-on medium --format json --output firmis-nightly.json
  artifacts:
    paths:
      - firmis-nightly.json
    expire_in: 7 days
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

Create the schedule at CI/CD → Schedules in your GitLab project, targeting your default branch.

What to do next

Section titled “What to do next”