GitLab shows up in Safeguard in two places: as a source code integration and as a CI/CD system. This short guide covers both, using only what the docs state.
What it is
On the Integrations page, GitLab is described as "Self-hosted or cloud GitLab". It sits in the Source Code (SCM) group with GitHub, Bitbucket and a generic Git URL. GitLab CI is also on the list of supported pipelines.
How to use it
The console workflow is shared across SCM providers.
- Open Integrations in the sidebar and pick the Source Code (SCM) filter.
- Click Connect on the GitLab card.
- Configure access. Private repositories need credentials, public ones need a URL.
- Review the repositories, set Branch/Tag, Project Name and Version, then connect.
- Open Projects to see status, findings and vulnerability counts.
The docs walk through screens for Bitbucket only. For GitLab they do not state the token type, scopes or the field used for a self-hosted address, so I am not going to guess. Use what the card asks for, and have your GitLab admin create a dedicated account for the connection.
The GitLab CI job
The CI/CD docs show a job named safeguard-scan in the test stage, using the ubuntu:24.04 image. It installs curl, installs the CLI, scans the directory and saves the results folder as an artifact.
safeguard-scan:
stage: test
image: ubuntu:24.04
script:
- apt-get update && apt-get install -y curl
- curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=<version> bash
- safeguard scan --dir . --output safeguard-results
artifacts:
paths:
- safeguard-results/
Two details from the docs matter here. safeguard scan needs syft and grype on the PATH, or a TOOLS_DIR that contains them. And its exit code is 0 if the scan ran regardless of findings, 2 if results were written but the vulnerability scan did not run, and 1 if the command failed.
Quick check
Does a clean exit code from safeguard scan mean no vulnerabilities?
No. Exit code 0 means the scan ran, regardless of findings.
