Skip to main content

Build Type: GitLab CI

This is a SLSA Provenance buildType that describes the execution of a GitLab CI/CD pipeline.

This build type was inspired by the GitHub Actions build type described here.

Description

"buildType": "https://docs.cimon.build/provenance/buildtypes/gitlab/v1"

The GitLab build type describes the execution of a GitLab CI/CD pipeline that builds a software artifact.

Build Definition

External parameters

All external parameters are REQUIRED unless empty.

ParameterTypeDescription
workflowobjectThe workflow that was run
workflow.namestringThe full name of the GitLab job
workflow.repositorystringURI of the git repository (if exists)
workflow.refstringA git reference to the commit (if exists)
workflow.filePathstringThe default GitLab CI workflow file
jobobjectThe currently running stage of the GitLab job
job.jobNamestringThe stage name currently running
job.jobIdstringThe current job id
buildobjectThe specific build that generated the provenance
build.buildRunstringThe build run ID
build.buildRunAttemptstring-
build.buildUrlstringThe full web URL for the build

Example:

"externalParameters": {
"workflow": {
"name": "Gitlab CI/CD pipeline",
"repository": "https://gitlab.com/cycodelabs/cimon-attest-gitlab-tests/debug-pipeline",
"ref": "main",
"filePath": ".gitlab-ci.yml"
},
"job": {
"jobName": "run-cimon",
"jobId": "6412263894"
},
"build": {
"buildRun": "1216772341",
"buildUrl": "https://gitlab.com/cycodelabs/cimon-attest-gitlab-tests/debug-pipeline/-/pipelines/1216772341"
}
}

Internal parameters

All internal parameters are OPTIONAL.

The internal parameters contain the CI environment variables as they appear in the build. This is how the internal parameters look for this type of build type:

"internalParameters": {
"CI_COMMIT_BRANCH": "main",
"CI_COMMIT_REF_NAME": "main",
"CI_COMMIT_REF_PROTECTED": "true",
"CI_COMMIT_SHA": "054b8ab29cfba661c3e830c9f4845dd07b385a1a",
"CI_CONFIG_PATH": ".gitlab-ci.yml",
"CI_JOB_ID": "123123",
"CI_JOB_NAME": "build",
"CI_JOB_URL": "https://gitlab.com/group/project/-/jobs/123123",
"CI_PIPELINE_CREATED_AT": "2024-01-01T00:00:00Z",
"CI_PIPELINE_ID": "123123",
"CI_PIPELINE_SOURCE": "push",
"CI_PROJECT_ID": "123123",
"CI_PROJECT_NAMESPACE_ID": "123123",
"CI_PROJECT_PATH": "group/project",
"CI_PROJECT_URL": "https://gitlab.com/group/project",
"CI_RUNNER_EXECUTABLE_ARCH": "linux/amd64",
"CI_RUNNER_VERSION": "16.6.0",
"CI_SERVER_URL": "https://gitlab.com",
"GITLAB_USER_EMAIL": "actor@email.com",
"GITLAB_USER_ID": "123123",
"GITLAB_USER_LOGIN": "actor-id"
}

Resolved Dependencies

The resolvedDependencies SHOULD contain an entry identifying the resolved git commit ID corresponding to externalParameters.workflow. The dependency's URI MUST be in SPDX Download Location format, i.e., "git+" + workflow.uri + "@" + workflow.ref.

"resolvedDependencies": [
{
"uri": "git+https://gitlab.com/cycodelabs/cimon-attest-gitlab-tests/debug-pipeline@main",
"digest": {
"gitCommit": "5bd5af481363b91878f8f3e55262c6ecc3169f59"
},
"annotations": {
"signedStatus": "signed",
"gpgKeyId": "B5690EEEBB952194"
}
}
]

Each referenced commit contains signing information as well. The signedStatus field will receive one of three values:

  • signed: Confirmed that the commit is signed. In that case, gpgKeyId will also be included. The GPG Key ID should look similar to the command output: git log --show-signature -s.
  • unsigned: Confirmed that the commit is not signed.
  • unknown: The commit signing information could not be verified.

Run Details

Builder

The builder.id MUST represent the entity that generated the provenance, as per the SLSA Provenance documentation. In the case of GitLab CI, this should represent the agent that have been running the build. Based on this information, the provenance consumer can decide whether the build environment is secure enough to trust the produced attestation.

Example:

"builder": {
"id": "https://gitlab.com/cycodelabs/cimon-attest-gitlab-tests/debug-pipeline/.gitlab-ci.yml@main"
}

Metadata

The invocationId SHOULD be set to the GitLab Job URL.

Example:

"metadata": {
"invocationID": "https://gitlab.com/cycodelabs/cimon-attest-gitlab-tests/debug-pipeline/-/jobs/1082984328"
}