glsec scans GitLab CI/CD pipelines. Its SARIF output (--format sarif) works with GitHub code scanning, for a GitLab pipeline file that lives in a GitHub repository, or a mirror of a GitLab project. Each finding becomes a code scanning alert, and on a pull request it shows up as an annotation on the changed line. Each rule links to its page on glsec.github.io.

The demo pull request #2 changes bad-pipeline.yml from a clean pipeline into one with the kind of mistakes glsec reports. It stays open on purpose.

.github/workflows/glsec.yml:

1. downloads the glsec release and checks it against checksums.txt and against the provenance of glsec's release workflow (gh attestation verify)
2. runs glsec --format sarif bad-pipeline.yml > glsec.sarif. glsec exits 1 when it finds something, so only exit code 2 (a file it can't parse) fails the job
3. uploads glsec.sarif with github/codeql-action/upload-sarif, with security-events: write and nothing else

For your own repository, change the file name in the scan step, or pass several files or a glob.

• Example reports: what every output format looks like for the same file
• GitLab examples: Catalog component, Code Quality, Docker image, binary