Skip to content

package.md

Latest commit

 

History

History
73 lines (50 loc) · 2.88 KB

package.md

File metadata and controls

73 lines (50 loc) · 2.88 KB
Raw
title `glab dependency-firewall package`
stage AI Clients
group Developer Clients
info To determine the technical writer assigned to the Stage/Group associated with this page, see <https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments>

Check a package against the GitLab Dependency Firewall. (BETA)

Synopsis

Check a single package coordinate against the GitLab Dependency Firewall policy for the current project and report the outcome (allow, warning, blocked). No package manager binary is required.

Supported package URL (PURL) types are npm, pypi, maven, gem, cargo, and golang. The PURL must include a version, for example pkg:npm/left-pad@1.3.0. For golang, the module path keeps its case, for example pkg:golang/github.com/BurntSushi/toml@v1.4.0.

An allowed package prints one line, for example, left-pad@1.3.0: allowed by the Dependency Firewall. A warned or blocked package prints the same summary as the package manager commands.

This command does not write to the CI log at .gitlab/df/ci-log.json, so glab dependency-firewall ci-summary does not include its result.

Exit codes:

Exit code Meaning
0 Allowed or warned, or the Dependency Firewall is not evaluating the project.
1 The PURL is invalid or has no version, the project or credentials can't be resolved, or the request to GitLab failed.
3 Blocked.

An exit code of 0 does not always mean GitLab checked the package. If the Dependency Firewall is not evaluating the project, the command prints a line that ends with the Dependency Firewall is not evaluating this project; allowing.

Unlike the package manager commands, this command does not block the package when the request to GitLab fails. It exits with 1 instead.

This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/.

glab dependency-firewall package <purl> [flags]

Examples

# Check an npm package version
glab dependency-firewall package pkg:npm/left-pad@1.3.0

# Check a PyPI package version
glab dependency-firewall package pkg:pypi/requests@2.31.0

# Check a Maven package version
glab dependency-firewall package pkg:maven/org.slf4j/slf4j-api@2.0.13

# Check a RubyGems package version
glab dependency-firewall package pkg:gem/rails@7.1.3

# Check a Cargo package version
glab dependency-firewall package pkg:cargo/serde@1.0.197

# Check a Go module version
glab dependency-firewall package pkg:golang/github.com/pkg/errors@v0.9.1

Options inherited from parent commands

  -h, --help   Show help for this command.