cinetic-security-setup

name	cinetic-security-setup
description	Sets up the full Cinetic security stack on Cinetic projects hosted on GitLab.com (non-PrestaShop: Laravel, Astro, TanStack, etc.). Use ONLY when the project is a Cinetic company project on GitLab.com Free tier. Triggers when the user asks to add dependency scanning, vulnerability alerts, security setup, Trivy, pnpm supply chain protection, or wants email reports of vulnerabilities. Do NOT use for GitHub-hosted projects, personal projects, or PrestaShop projects — use ps-security-audit skill instead for any PrestaShop project.
version	0.1.0

Cinetic Security Setup

Full security stack for Cinetic projects on GitLab.com Free tier. Covers: pnpm 11 supply chain, Trivy weekly scan, HTML email reports via Gmail.

What gets set up

1. pnpm 11 with supply chain protection (minimumReleaseAge, overrides)
2. Trivy vulnerability + secret scanner via GitLab CI
3. Weekly scheduled pipeline (Monday 8am Madrid) with HTML email report
4. Composer audit for PHP/Laravel projects
5. Gmail SMTP delivery via GitLab CI/CD variables

---

Step 1 — pnpm 11 Supply Chain

pnpm-workspace.yaml (create or update)

minimumReleaseAge: 2880   # packages must be 48h old before install (minutes)

overrides:
  form-data: ">=4.0.4"
  axios: ">=1.15.2"
  lodash: ">=4.18.0"
  picomatch: ">=4.0.4"
  qs: ">=6.14.2"

Rules:

• minimumReleaseAge is in minutes (2880 = 48h). Blocks supply chain attacks via typosquatting/fast-publish.
• overrides pins known vulnerable transitive deps. Add new entries as CVEs appear.
• Do NOT put minimumReleaseAge in .npmrc — pnpm 11 reads it from pnpm-workspace.yaml only.

package.json additions

{
  "packageManager": "pnpm@11.x.x"
}

Remove any overrides or pnpm.overrides blocks from package.json — they belong in pnpm-workspace.yaml for pnpm 11.

publicar deploy script (if project has one)

#!/bin/bash
php artisan migrate --force
pnpm build

Ensure it uses pnpm, not npm run.

GitHub Actions lint workflow (if exists)

Replace npm ci / npm install / npm run with:

- run: npm install -g pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm run format
- run: pnpm run lint

---

Step 2 — GitLab CI Trivy Scan

Create or update .gitlab-ci.yml:

dependency-scan:
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]         # required — Trivy image has no shell by default
  before_script:
    - apk add --no-cache curl python3 py3-packaging
  script:
    # JSON report (structured data) — vuln + secret scan
    - trivy fs --exit-code 0 --scanners vuln,secret --format json -o trivy-report.json . 2>/dev/null

    # HTML report artifact
    - trivy fs --exit-code 0 --scanners vuln,secret --format template --template "@/contrib/html.tpl" -o trivy-report.html . 2>/dev/null || true

    # Parse JSON → build HTML email
    - |
      python3 << 'PYEOF'
      import json, os

      with  
            

          

      
                
               
            [    , ,  ,  ,  ,  }

         , []
             , []
                , , , 
                , 
                , 
                , 
                

              
                  []  { [],  [],  ,  [],  []}

                []
               ,   [], 
                  []  
              
                  []
              
                  []

      
            []
          
              
                  , 
              
                  
           ,   [][]    

        
      
          []  []

        [], 

        {       []      [, , , ]}

        {
           , ,
           , ,
           , ,
           , ,
      }

        
      
          ,   [], , 
            []  []  
            [][]   {[]}   []    
            
               
               
               
               
               {}{} {[]}
            
               
          

        [
            {[][]}{[][]}  {[][]}
        
           
               
               
               
               
               
          
        
        {}
      

             

      
        [
              {} {}   {}
          ,
          ,
          ,
      ]
      
            []  []  
            []
           {[]}  {[]}  {}  {[]}  {} 

        [
          ,
          ,
          ,
          ,
      ]
        

       ,  
          

        , , , 
        
            
           
                        
           
       {} ,  [{}]    {,} , {,}    
        , 
            {}
         {}   {}
        {}
        {}
        {}
        {}
         
           {} 
                
          
        
           
      

       ,  
          

        {}  {[]},  {[]}
      

       
    
       
       
       
      
  
        

Key implementation details:

• entrypoint: [""] — mandatory; Trivy Docker image has no shell otherwise (exit code 127)
• --exit-code 0 — never fail the pipeline; email even when clean
• --scanners vuln,secret — covers both dependency CVEs and leaked secrets
• rules: schedule — only runs on scheduled pipelines, not every push
• Vulnerabilities grouped by (package, installed_version) — one row per package, showing highest severity and best fix version
• py3-packaging via apk — not pip (pip is blocked in Alpine CI)

---

Step 3 — Gmail CI/CD Variables

In GitLab project: Settings → CI/CD → Variables

Variable	Value	Protected	Masked
GMAIL_USER	[e-mail]	No	No
GMAIL_APP_PASS	App password from Google	No	Yes

Getting Gmail App Password:

1. Google Account → Security → 2-Step Verification (must be ON)
2. Search "App passwords" → Create → name it "GitLab CI"
3. Copy the 16-char password → paste as GMAIL_APP_PASS

---

Step 4 — Weekly Scheduled Pipeline

Create via GitLab API (run once per project):

curl --request POST \
  --header "PRIVATE-TOKEN: <your-gitlab-token>" \
  "https://gitlab.com/api/v4/projects/<PROJECT_ID>/pipeline_schedules" \
  --form "description=Weekly security scan" \
  --form "ref=main" \
  --form "cron=0 7 * * 1" \
  --form "cron_timezone=Europe/Madrid"

• 0 7 * * 1 = Monday 07:00 UTC = 08:00/09:00 Madrid (winter/summer)
• ref = default branch (main or develop)
• PROJECT_ID = GitLab project → Settings → General

Or via UI: CI/CD → Schedules → New schedule

Trigger manually to test:

curl --request POST \
  --header "PRIVATE-TOKEN: <token>" \
  "https://gitlab.com/api/v4/projects/<PROJECT_ID>/pipeline_schedules/<SCHEDULE_ID>/play"

---

Step 5 — PHP/Composer Projects (Laravel)

Add composer audit to the CI job's script block (before trivy):

    - |
      if [ -f composer.json ]; then
        composer audit --format=plain 2>/dev/null || true
      fi

For fixing PHP vulnerabilities locally:

# Update specific packages
composer update "symfony/*" --with-all-dependencies

# Update all PHP deps (careful — test after)
composer update

Common PHP transitive dep CVEs — update these when flagged:

• symfony/* — update to latest patch on your major (e.g. 7.4.x)
• phpunit/phpunit + pestphp/pest — must update together: composer update phpunit/phpunit pestphp/pest --with-all-dependencies
• league/commonmark, psy/psysh — composer update <package>

---

Updating overrides for new CVEs

When the scan reports a fixable HIGH/CRITICAL on a transitive dep:

1. Check if it's in pnpm-workspace.yaml overrides already → bump version
2. If new package → add entry: package-name: ">=fixed-version"
3. Run pnpm install to regenerate lockfile
4. Commit + push → next weekly scan should show it resolved

Skip alpha/RC fixes: If the only fix is an alpha (e.g. 8.0.0-alpha.17), skip — wait for stable release.

---

Adapting for different project types

Project type	Notes
Laravel	Include composer audit step; publicar = php artisan migrate --force && pnpm build
Astro	No composer step; publicar = pnpm build
TanStack / pure frontend	No composer step; check pnpm-workspace.yaml at root
No Node	Skip pnpm setup; Trivy still scans PHP deps

---

Checklist for new project

• pnpm-workspace.yaml created with minimumReleaseAge: 2880 + overrides
• package.json has "packageManager": "pnpm@11.x.x", no overrides block
• .gitlab-ci.yml has dependency-scan job (Step 2)
• GitLab CI/CD variables set: GMAIL_USER, GMAIL_APP_PASS
• Pipeline schedule created (Monday 8am Madrid)
• Manual trigger test → email received by both [e-mail] and [e-mail]
• pnpm install runs clean locally