Documentation
¶
Overview ¶
Package gitlab implements the gitlab source plugin: lists projects ("repositories") under a single GitLab group and emits the cross-vendor git_repository evidence type — suitable for SOC 2 / ISO 27001 branch-protection and code-review policies.
GitLab is one of several substitutable source-code platforms (GitHub, Bitbucket, future Gitea/Azure DevOps); a policy accepts the git_repository evidence type, not a vendor, so this plugin is immediately usable by every policy that already consumes GitHub repositories (the substitutability principle — docs/architecture/04a-evidence-type-registry.md).
Per the KISS-no-DRY axiom (docs/architecture/04-source-plugins.md §The plugin contract), the plugin caches nothing across Collect calls. N policies bound to this plugin → N invocations of Collect.
Test injection: the API interface mirrors the github plugin — the concrete *sdkAPI (backed by gitlab.com/gitlab-org/api/client-go) satisfies it, and unit tests inject an in-memory fake. The real SDK adapter is exercised by an httptest-backed test; live integration tests against gitlab.com are deferred to the testing revamp.
WU-2.1 scope: this plugin emits only git_repository. The group's directory_user emission (members → MFA/admin/active) lands in WU-2.2 as a second emitted type on the same plugin.
Index ¶
Constants ¶
const EvidenceTypeRepository = "git_repository"
EvidenceTypeRepository is the cross-vendor git_repository shape this plugin emits.
const SourceID = "gitlab"
SourceID is the registered ID for the gitlab plugin instance.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API interface {
// ListRepos returns all projects under the configured group,
// normalized into the git_repository contract. Implementations must
// page transparently — callers receive the full list in one slice.
ListRepos(ctx context.Context) ([]Repo, error)
}
API is the subset of the GitLab REST API the plugin uses. Defining it as an interface lets tests inject a fake without making real network calls; the concrete *sdkAPI satisfies it.
type Options ¶
type Options struct {
API API
// Now is injected so tests can produce deterministic CollectedAt
// values. Production callers leave it nil → time.Now().UTC().
Now func() time.Time
}
Options is the constructor input.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin is the in-process gitlab source.
func New ¶
New constructs a Plugin around an explicit API implementation. Callers using the real GitLab REST API should use NewFromToken.
func NewFromToken ¶
NewFromToken constructs a Plugin backed by the real GitLab REST API for the given group, using the supplied personal-access/group token. A blank baseURL defaults to gitlab.com; self-managed instances pass their own URL. Live integration tests are deferred.
func (*Plugin) Collect ¶
func (p *Plugin) Collect(ctx context.Context, req core.SlotRequest) ([]core.EvidenceRecord, error)
Collect returns one git_repository record per project under the group, sorted by ID (the project path). A slot that does not accept git_repository is rejected.
type Repo ¶
type Repo struct {
Name string
DefaultBranch string
ProtectionOn bool
RequiredReviews int
RequiresSignedCommits bool
RequiresLinearHistory bool
AllowsForcePush bool
DismissStaleReviews bool
RequireCodeOwnerReviews bool
IsPrivate bool
Archived bool
SecretScanningEnabled bool
PushProtectionEnabled bool
DependabotAlertsEnabled bool
CodeScanningEnabled bool
}
Repo is the subset of fields the plugin extracts from a GitLab project, normalized into the git_repository contract. Every field maps to a property of the git_repository evidence type so policies never read an absent field.
Fields without a read-only GitLab API analog are left at their zero value and documented at the mapping site (sdkAPI.ListRepos):
- SecretScanningEnabled / CodeScanningEnabled / DependabotAlertsEnabled (GitLab pipeline SAST/Secret/Dependency scanning is configured in .gitlab-ci.yml, not exposed as a project-settings boolean).
Source Files