> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/2-integration-with-sec1/6-ci-cd-integrations/6-gitlab-cicd-integration.md).

# Gitlab CI/CD Component

## Overview

This Gitlab CI/CD component integrates [Sec1](https://sec1.io/) to conduct vulnerability scans on your Gitlab projects. Sec1 is a powerful tool that helps identify security vulnerabilities within your codebase.

## Obtaining your Sec1 API Key

To use Sec1 in your workflow, you need to obtain an API key. Follow these steps:

1. **Navigate to Sec1 Website:**
   * Visit [Sec1 portal](https://scopy.sec1.io/) and log in using your SCM credentials.
2. **Generate API Key:**
   * In the "Settings" section, locate the "API key" and click on "Generate API key."
3. **Copy the API Token:**
   * Copy the generated API token.
4. **Add API Key in Gitlab Project Environment Variables:**

   * Add the copied API key to your Gitlab Project as Environment Vairable . Refer to [Gitlab's documentation](https://docs.gitlab.com/ee/ci/variables/#for-a-project) for creating environment variable at project level.
   * Use the key as SEC1\_API\_KEY. In the value field, copy the Sec1 API token.

   Sec1 recommends masking the variable and, if you use protected variables, protecting it.

## Example Workflow

### Scan with Sec1 Security

Below is an example of using the Sec1 Security component in your Gitlab CICD pipeline. This example runs the Sec1 scan in test stage.

In your repository, create .gitlab-ci.yml. Copy below code in .gitlab-ci.yml file to add Sec1 Security.

```yaml
include:
  - component: gitlab.com/sec0ne/sec1-security/sec1-security@v1.0.1
```

### Customizing Scan Thresholds for Sec1 Security

Sec1 scan supports setting up threshold values. If the scan reports vulnerabilities exceeding the specified thresholds, Sec1 Security will mark the build as failed. You can set threshold values for different severities such as critical, high, medium, and low.

You can configure threshold at Gitlab project level, set an environment variable SEC1\_SCAN\_THRESHOLD as key and in the value you can use one severity keys to define threshold.

Example :

| Key                   | Value                            |
| --------------------- | -------------------------------- |
| SEC1\_API\_KEY        | Your Sec1 API Key                |
| SEC1\_SCAN\_THRESHOLD | critical=0 high=0 medium=0 low=0 |

In your repository, create .gitlab-ci.yml. Copy below code in .gitlab-ci.yml file to add Sec1 Security.

```yaml
include:
  - component: gitlab.com/sec0ne/sec1-security/sec1-security@v1.0.1
```

Now, your Gitlab project is set up to leverage Sec1 for continuous security checks in your projects.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.sec1.io/user-docs/2-integration-with-sec1/6-ci-cd-integrations/6-gitlab-cicd-integration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.