Skip to content

Scan

pipeleek gl cicd scan

Scan CI/CD YAML configurations for secrets

Synopsis

Scan the fully compiled .gitlab-ci.yml configuration of accessible projects for secrets.

Unlike "gl scan", this command only fetches and scans each project's merged CI/CD YAML - it does not scan job logs or artifacts.

1
pipeleek gl cicd scan [flags]

Examples

1
2
3
4
5
6
7
8
# Scan the CI/CD YAML of all accessible projects
pipeleek gl cicd scan --token glpat-xxxxxxxxxxx --url https://gitlab.example.com

# Scan a single repository
pipeleek gl cicd scan --token glpat-xxxxxxxxxxx --url https://gitlab.example.com --repo mygroup/myproject

# Scan all repositories in a namespace
pipeleek gl cicd scan --token glpat-xxxxxxxxxxx --url https://gitlab.example.com --namespace mygroup

Options

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
      --confidence strings         Filter for confidence level, separate by comma if multiple. See readme for more info.
  -h, --help                       help for scan
      --hit-timeout duration       Maximum time to wait for hit detection per scan item (e.g., 30s, 2m, 1h) (default 1m0s)
  -m, --member                     Scan projects the user is member of
  -n, --namespace string           Namespace to scan (all repos in the namespace will be scanned)
  -o, --owned                      Scan only user owned repositories
  -q, --queue string               Relative or absolute folderpath where the queue files will be stored. Defaults to system tmp. Non-existing folders will be created.
  -r, --repo string                Single repository to scan, format: namespace/repo
  -s, --search string              Query string for searching projects
      --threads int                Number of concurrent threads for scanning (default 4)
      --truffle-hog-verification   Enable TruffleHog credential verification to actively test found credentials and only report verified ones (enabled by default, disable with --truffle-hog-verification=false) (default true)

Options inherited from parent commands

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
      --color                   Enable colored log output (auto-disabled when using --logfile) (default true)
      --config string           Config file path. Example: ~/.config/pipeleek/pipeleek.yaml
      --http-timeout duration   HTTP request timeout, e.g. 30s or 2m (default: no timeout)
      --ignore-proxy            Ignore HTTP_PROXY environment variable
      --json                    Use JSON as log output format
      --log-level string        Set log level globally (debug, info, warn, error). Example: --log-level=warn
  -l, --logfile string          Log output to a file
      --proxy string            Proxy URL, e.g. http://127.0.0.1:8080 or socks5://127.0.0.1:1080 (takes precedence over HTTP_PROXY)
      --tls-verification        Enable TLS certificate verification (by default verification is skipped to support self-signed certificates)
  -t, --token string            GitLab API Token
  -u, --url string              GitLab instance URL
  -v, --verbose                 Enable debug logging (shortcut for --log-level=debug)

SEE ALSO