Documentation
¶
Overview ¶
Package securityscanprofiles implements MCP tools for GitLab security scan profiles through the GraphQL API.
Security scan profiles bundle a security scanning configuration (for example the built-in dependency_scanning profile) that can be attached to, or detached from, projects and groups. The package attaches and detaches profiles, lists the per-project scan profile statuses, and renders the results as Markdown.
The package wraps the GitLab GraphQL security scan profile mutations and queries:
Index ¶
- Constants
- func ActionSpecs(client *gitlabclient.Client) []toolutil.ActionSpec
- func FormatListProjectStatusesMarkdown(out ListProjectStatusesOutput) string
- func FormatMutationMarkdown(out MutationOutput) string
- type AttachInput
- type DetachInput
- type ListProjectStatusesInput
- type ListProjectStatusesOutput
- type MutationOutput
- type ScanProfile
- type ScanProfileStatus
Constants ¶
const DefaultProfileFloors = "" /* 246-byte string literal not displayed */
DefaultProfileFloors says from which GitLab release each name of DefaultProfileNames exists, in the words every text offering the names adds after them, so a caller of an older instance is not handed a name its GitLab refuses. secret_detection is as old as scan profiles themselves (18.7), which is the floor of the whole domain and needs no word of its own. Read from Security::DefaultScanProfilesHelper at every stable branch from 18-7 to 19-5 and on master: sast arrives at 18.10 and dependency_scanning at 18.11, both behind a feature flag until 19.0, dependency_scanning_post_processing at 19.2, the Triage and Remediation presets at 19.4, business_logic at 19.5 and skillguard at 19.6.
const DefaultProfileNames = "" /* 215-byte string literal not displayed */
DefaultProfileNames lists the names attach takes in place of a persisted profile's ID, written as the sentence fragment every text that offers them repeats: the input's description, the attach usage line, the attach error hint and the meta-tool group description in internal/tools.
They are the preset keys of the default profiles GitLab defines (Security::DefaultScanProfilesHelper on master, b03c97a8, 2026-10-29): a key is the profile's scan type, except for the three Triage and Remediation presets, which GitLab 19.4 added behind the triage_and_remediation_profile flag, on by default. For such a name attach finds or creates the namespace's default profile. They are not the SecurityScanProfileType enum: container_scanning is a scan type GitLab defines no default profile for, and FindOrCreateService answers it by name with "Could not find a default scan profile for this type", which the mutation turns into a resource-not-available error (see RefusedByName). The package's tests hold this list to that enum, so a scan type GitLab adds fails them until someone decides which side of the line it falls on: business_logic gained its default profile in 19.5 (a31b9ef3, "Enable BLSA through a security scan profile") and skillguard in 19.6 (f2f4fc16, "Enable SkillGuard through a security scan profile"), which the re-pin of 2026-10-29 found.
It is one literal rather than two joined with a plus, for the reason [errDetachIdentifier] gives: a plus at package level is a mutant no test can reach.
const RefusedByName = "" /* 136-byte string literal not displayed */
RefusedByName names the SecurityScanProfileType values attach refuses by name, in the sentence every text offering DefaultProfileNames adds. One is the scan type GitLab builds no default profile for; the other is the scan type whose default profiles are keyed by preset, so the bare type is the key of none of them. FindOrCreateService answers each with "Could not find a default scan profile for this type", which the attach mutation replaces with a generic resource-not-available error naming none of this, and that is why the handler's hint says it (upstream register, "the scan profile attach mutation drops the reason it refused a name").
Variables ¶
This section is empty.
Functions ¶
func ActionSpecs ¶
func ActionSpecs(client *gitlabclient.Client) []toolutil.ActionSpec
ActionSpecs returns canonical specs for security scan profile actions.
func FormatListProjectStatusesMarkdown ¶
func FormatListProjectStatusesMarkdown(out ListProjectStatusesOutput) string
FormatListProjectStatusesMarkdown renders per-project scan profile statuses as a Markdown table: a collection of objects that share columns. The profile ID is a column because it is what the detach action takes, and the list used to be the only place a reader could have found it.
func FormatMutationMarkdown ¶
func FormatMutationMarkdown(out MutationOutput) string
FormatMutationMarkdown renders an attach or detach confirmation as the card of one result: what GitLab did, the profile it did it with, and the targets the request named.
Types ¶
type AttachInput ¶
type AttachInput struct {
SecurityScanProfileID string `` /* 908-byte string literal not displayed */
ProjectIDs []int64 `json:"project_ids,omitempty" jsonschema:"Numeric IDs of the projects to attach the profile to"`
GroupIDs []int64 `json:"group_ids,omitempty" jsonschema:"Numeric IDs of the groups to attach the profile to"`
}
AttachInput holds parameters for attaching a security scan profile to projects and/or groups.
type DetachInput ¶
type DetachInput struct {
SecurityScanProfileID string `` /* 286-byte string literal not displayed */
ProjectIDs []int64 `json:"project_ids,omitempty" jsonschema:"Numeric IDs of the projects to detach the profile from"`
GroupIDs []int64 `json:"group_ids,omitempty" jsonschema:"Numeric IDs of the groups to detach the profile from"`
}
DetachInput holds parameters for detaching a security scan profile from projects and/or groups.
type ListProjectStatusesInput ¶
type ListProjectStatusesInput struct {
ProjectFullPath string `` /* 162-byte string literal not displayed */
}
ListProjectStatusesInput holds parameters for listing the scan profile statuses of a project.
type ListProjectStatusesOutput ¶
type ListProjectStatusesOutput struct {
toolutil.HintableOutput
ProjectFullPath string `json:"project_full_path"`
Statuses []ScanProfileStatus `json:"statuses"`
}
ListProjectStatusesOutput contains the scan profile statuses for a project.
func ListProjectStatuses ¶
func ListProjectStatuses(ctx context.Context, client *gitlabclient.Client, input ListProjectStatusesInput) (ListProjectStatusesOutput, error)
ListProjectStatuses returns the scan profile statuses for a project.
type MutationOutput ¶
type MutationOutput struct {
toolutil.HintableOutput
Status string `json:"status"`
Message string `json:"message"`
SecurityScanProfileID string `json:"security_scan_profile_id"`
ProjectIDs []int64 `json:"project_ids,omitempty"`
GroupIDs []int64 `json:"group_ids,omitempty"`
}
MutationOutput confirms a security scan profile attach or detach operation and echoes the resolved targets.
func Attach ¶
func Attach(ctx context.Context, client *gitlabclient.Client, input AttachInput) (MutationOutput, error)
Attach attaches a security scan profile to the given projects and/or groups.
func Detach ¶
func Detach(ctx context.Context, client *gitlabclient.Client, input DetachInput) (MutationOutput, error)
Detach detaches a security scan profile from the given projects and/or groups.
type ScanProfile ¶
type ScanProfile struct {
ID string `json:"id"`
Name string `json:"name"`
ScanType string `json:"scan_type"`
}
ScanProfile represents a security scan profile.
type ScanProfileStatus ¶
type ScanProfileStatus struct {
Status string `json:"status"`
ScanProfile ScanProfile `json:"scan_profile"`
}
ScanProfileStatus represents the status of a scan profile for a project.
Source Files