gitlab-security-setup

name	gitlab-security-setup
description	Sets up a full security stack on your company's projects hosted on GitLab.com (non-PrestaShop: Laravel, Astro, TanStack, etc.). Use ONLY when the project is a GitLab.com Free tier project. Triggers when the user asks to add dependency scanning, vulnerability alerts, security setup, Trivy, pnpm supply chain protection, or wants email reports of vulnerabilities. Do NOT use for GitHub-hosted projects, personal projects, or PrestaShop projects — use ps-security-audit skill instead for any PrestaShop project.
version	0.2.1
metadata	{"author":"Eduardo Calvo"}

GitLab Security Setup

Full security stack for your company's GitLab.com projects on the Free tier. Covers: pnpm 11 supply chain, Trivy weekly scan, HTML email reports via Gmail.

Placeholder: {report_recipients} is a comma-separated list of email addresses that receive the vulnerability reports (e.g. [e-mail], [e-mail]). Replace it everywhere it appears below with your own recipient address(es) before running.

What gets set up

1. pnpm 11 with supply chain protection (minimumReleaseAge, overrides)
2. Trivy vulnerability + secret scanner via GitLab CI
3. Weekly scheduled pipeline (Monday 8am Madrid) with HTML email report
4. Composer audit for PHP/Laravel projects
5. Gmail SMTP delivery via GitLab CI/CD variables

---

Step 1 — pnpm 11 Supply Chain

pnpm-workspace.yaml (create or update)

# WARNING: single-package repos do NOT need a `packages:` block on pnpm 11.
# BUT on pnpm 9 (Vercel default for older projects) the mere presence of this
# file REQUIRES a non-empty `packages:` or install dies with
# "packages field missing or empty". If targeting pnpm 9, add `packages: ['.']`.

minimumReleaseAge: 4320   # packages must be 72h old before install (minutes)

# Block transitive deps from git repos / raw tarball URLs (needs pnpm 10.26+,
# silently inert below). See supply-chain-security skill for the full checklist.
blockExoticSubdeps: true

# Allowlist for postinstall/build scripts. pnpm 10+ blocks ALL by default.
# List ONLY packages that genuinely need to compile. pnpm will prompt you to
# add new entries when you install a dep with a blocked build script.
allowBuilds:
  esbuild: true
  sharp: true
  # lightningcss-cli: true   # uncomment if using lightningcss

overrides:
  form-data: ">=4.0.6"
  axios: ">=1.15.2"
  lodash: ">=4.18.0"
  picomatch: ">=4.0.4"
  qs: ">=6.14.2"
  shell-quote: ">=1.8.4"

Rules:

• minimumReleaseAge is in minutes (4320 = 72h). Blocks supply chain attacks via typosquatting/fast-publish.
• blockExoticSubdeps needs pnpm 10.26+ — silently inert below. Check the pinned version.
• allowBuilds — pnpm 10+ blocks all postinstall scripts by default. Add ONLY packages that need to compile. pnpm 11 will tell you during install if a new dep needs adding here.
• overrides pins known vulnerable transitive deps. Add new entries as CVEs appear.
• Do NOT put minimumReleaseAge in .npmrc — pnpm 11 reads it from pnpm-workspace.yaml only.
• Real test is CI: pnpm install --frozen-lockfile on a clean machine enforces all policies; a warm local cache skips them.

package.json additions

{
  "packageManager": "pnpm@11.1.2",
  "private": true
}

Pin the exact version (not 11.x.x) so CI/Vercel use the version you tested. Remove any overrides or pnpm.overrides blocks from package.json — they belong in pnpm-workspace.yaml for pnpm 11.

publicar deploy script (if project has one)

#!/bin/bash
php artisan migrate --force
pnpm build

Ensure it uses pnpm, not npm run.

GitHub Actions lint workflow (if exists)

Replace npm ci / npm install / npm run with:

- run: npm install -g pnpm
- run: pnpm install --frozen-lockfile
- run: pnpm run format
- run: pnpm run lint

---

Step 2 — GitLab CI Trivy Scan

Create or update .gitlab-ci.yml:

dependency-scan:
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  before_script:
    - apk add --no-cache curl python3 py3-packaging
  script:
    # JSON report (structured data) — vuln + secret scan
    - trivy fs --exit-code 0 --scanners vuln,secret --format json -o trivy-report.json . 2>/dev/null

    # HTML report artifact
    - trivy fs --exit-code 0 --scanners vuln,secret --format template --template "@/contrib/html.tpl" -o trivy-report.html . 2>/dev/null || true

    # Parse JSON and build HTML email
    - |
      python3 << 'PYEOF'
      import json, os

      with open("trivy-report.json") 
            

          

      
                
               
            [    , ,  ,  ,  ,  }

         , []
             , []
                , , , 
                , 
                , 
                , 
                
              
                  []  { [],  [],  ,  [],  []}
                []
               ,   [], 
                  []  
              
                  []
              
                  []

      
            []
          
              
                  , 
              
                  
           ,   [][]    

        
      
          []  []
        [], 

        {       []      [, , , ]}
        

        {
           , , ,
               , , ,
             , , ,
                , , ,
      }

        , 
        , 
        , 
        , 
        , 
      
        , 
        , 
        []    
        , ,     

       , 
            []
             []
               
                   {}{}
              
                  
            
             
                 {} 
           

        {
             
                 
               
                  
      }

        { ,  ,  ,  }

        
       , 
          ,   [],   
            []  []  
            []
                    
             
              {}{[]}
              {},,,{[]}
              {},,,{}
              {}
               {} {[]}
            
              {}{}
          

        [
            {[][]}      
        
           
                
                
                
                
                
          
        
        {}
      

             

        [
              {} {}   {}  {}
          ,
          ,
      ]
      
            []  []  
           {[]}  {[]}  {}  {[]}  {[]} 
        [, ,
          ]
        

       ,  
          

        , , , 

        {} {      }   
      
            {},,{}    

          {}[{}]    {,} {,}{} {} {} {}   
             
             
              
           ,,
                
           ,,,, ,,,,
                 ,,
           
                 ,,
           
               
           
             
           ,,
            ,,,{}
          
                 ,, 
           
           ,,  
                
           ,,
             {}
             {}
          {}
           {}
           ,,  {}
          {}{}      
                   
          
                 
            
           {}  
              
          
                 ,,
           
                 
             ,,
           ,,       
             ,,    ,, 
          
          
      

       ,  
          

        {}  {[]},  {[]}
      

       
    
       
       
       
      
  
        

Key implementation details:

• entrypoint: [""] — mandatory; Trivy Docker image has no shell otherwise (exit code 127)
• --exit-code 0 — never fail the pipeline; email even when clean
• --scanners vuln,secret — covers both dependency CVEs and leaked secrets
• rules: schedule — only runs on scheduled pipelines, not every push
• Vulnerabilities grouped by (package, installed_version) — one row per package, showing highest severity and best fix version
• py3-packaging via apk — not pip (pip is blocked in Alpine CI)
• Recipients are parametrized via the REPORT_RECIPIENTS CI/CD variable (comma-separated) in BOTH the Python To: header and the curl --mail-rcpt loop — never hardcode addresses in the job.
• "DepSheriff" branded email — modern Untitled-UI HTML (Inter font, rounded severity pills, orange accent, logo). Trivy's contrib/html.tpl artifact still ships too.
• CVE → NVD links via cve_links() (first 5 linked, rest collapsed to +N more).
• Scan date/timestamp from CI_PIPELINE_CREATED_AT, shown in the header and the subject ([proj] Security Scan · 2C 5H · YYYY-MM-DD).
• "Paste to Agent" block — a markdown table of findings ready to drop into any AI agent for fix recommendations.
• The logo (ik.imagekit.io/.../security-logo.png) and footer credit are the DepSheriff brand — keep or swap for your own.

---

Step 3 — Gmail CI/CD Variables

In GitLab project: Settings → CI/CD → Variables

Variable	Value	Protected	Masked
GMAIL_USER	[e-mail]	No	No
GMAIL_APP_PASS	App password from Google	No	Yes
REPORT_RECIPIENTS	[e-mail],[e-mail] (comma-separated)	No	No

Set REPORT_RECIPIENTS to your own recipient address(es) — this is who receives the vulnerability report email.

Getting Gmail App Password:

1. Google Account → Security → 2-Step Verification (must be ON)
2. Search "App passwords" → Create → name it "GitLab CI"
3. Copy the 16-char password → paste as GMAIL_APP_PASS

---

Step 4 — Weekly Scheduled Pipeline

Create via GitLab API (run once per project):

curl --request POST \
  --header "PRIVATE-TOKEN: <your-gitlab-token>" \
  "https://gitlab.com/api/v4/projects/<PROJECT_ID>/pipeline_schedules" \
  --form "description=Weekly security scan" \
  --form "ref=main" \
  --form "cron=0 7 * * 1" \
  --form "cron_timezone=Europe/Madrid"

• 0 7 * * 1 = Monday 07:00 UTC = 08:00/09:00 Madrid (winter/summer)
• ref = default branch (main or develop)
• PROJECT_ID = GitLab project → Settings → General

Or via UI: CI/CD → Schedules → New schedule

Trigger manually to test:

curl --request POST \
  --header "PRIVATE-TOKEN: <token>" \
  "https://gitlab.com/api/v4/projects/<PROJECT_ID>/pipeline_schedules/<SCHEDULE_ID>/play"

---

Step 5 — PHP/Composer Projects (Laravel)

The Trivy fs scan above already reads composer.lock and reports PHP CVEs in the email — so PHP deps are covered out of the box. composer audit adds the Packagist Security Advisories feed on top (some advisories land there before a CVE is assigned).

Do NOT add composer audit inline to the dependency-scan job — the aquasec/trivy Alpine image has no PHP/Composer binary, so it would silently no-op. Add a separate job with a composer image instead:

# Packagist advisory audit — complements the Trivy composer.lock scan.
# Output goes to the job log (not the email). Non-blocking.
composer-audit:
  image: composer:2
  script:
    - composer audit --no-interaction --format=plain || true
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  allow_failure: true

For fixing PHP vulnerabilities locally:

# Update specific packages
composer update "symfony/*" --with-all-dependencies

# Update all PHP deps (careful — test after)
composer update

Common PHP transitive dep CVEs — update these when flagged:

• symfony/* — update to latest patch on your major (e.g. 7.4.x)
• phpunit/phpunit + pestphp/pest — must update together: composer update phpunit/phpunit pestphp/pest --with-all-dependencies
• league/commonmark, psy/psysh — composer update <package>

---

Updating overrides for new CVEs

When the scan reports a fixable HIGH/CRITICAL on a transitive dep:

1. Check if it's in pnpm-workspace.yaml overrides already → bump version
2. If new package → add entry: package-name: ">=fixed-version"
3. Run pnpm install to regenerate lockfile
4. Commit + push → next weekly scan should show it resolved

Skip alpha/RC fixes: If the only fix is an alpha (e.g. 8.0.0-alpha.17), skip — wait for stable release.

---

Adapting for different project types

Project type	Notes
Laravel	Include composer audit step; publicar = php artisan migrate --force && pnpm build
Astro	No composer step; publicar = pnpm build
TanStack / pure frontend	No composer step; check pnpm-workspace.yaml at root
No Node	Skip pnpm setup; Trivy still scans PHP deps

---

Checklist for new project

• pnpm-workspace.yaml created with minimumReleaseAge: 4320 + blockExoticSubdeps: true + overrides + allowBuilds (add only what compiles)
• package.json has "packageManager": "pnpm@11.x.x" (exact version), "private": true, no overrides block
• Verified with clean pnpm install --frozen-lockfile (not just warm cache)
• .gitlab-ci.yml has dependency-scan job (Step 2) with recipients via REPORT_RECIPIENTS (never hardcoded)
• Laravel/PHP: separate composer-audit job added (Step 5) — NOT inline in the trivy job
• GitLab CI/CD variables set: GMAIL_USER, GMAIL_APP_PASS, REPORT_RECIPIENTS
• Pipeline schedule created (Monday 8am Madrid)
• Manual trigger test → email received by every address in REPORT_RECIPIENTS
• pnpm install runs clean locally