glab dependency-firewall ci-summary
Summarize Dependency Firewall activity from the CI log. (BETA)
Synopsis
Read .gitlab/df/ci-log.json and print blocked and flagged packages
recorded during a glab dependency-firewall run.
The log is read from the current working directory. Run this command from
the same directory as the glab dependency-firewall run that wrote the
log, otherwise no activity is reported.
To fail a CI/CD job when any package was blocked, run this command as the
last command in script. This catches a block even when a package
manager continues after a refused download. In after_script, the
command prints the report but can’t fail the job, because GitLab ignores
after_script exit codes.
install:
variables:
GLAB_ENABLE_CI_AUTOLOGIN: "true"
script:
- glab dependency-firewall npm ci
- glab dependency-firewall pip install -r requirements.txt
- glab dependency-firewall ci-summaryEntries accumulate across runs, and the command never clears them. A block
from an earlier run keeps the command exiting with 3 until you delete
.gitlab/df/ci-log.json.
| Exit code | Meaning |
|---|---|
0 | No blocked entries in the log (allow-only or warnings). |
1 | The log could not be read. |
3 | At least one entry in the log is blocked. |
This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/.
glab dependency-firewall ci-summary [flags]Examples
# Show blocked and flagged packages from the last firewall run
glab dependency-firewall ci-summary
Options inherited from parent commands
-h, --help Show help for this command.