GitLab CI/CD

OX Security integrates with GitLab CI/CD pipelines to detect vulnerabilities in Docker-based jobs.

To run scans on merge requests before they are merged, you must enable merge request pipelines in your GitLab CI/CD settings.

Prerequisites

• Docker support: Your GitLab runners must support Docker and be able to run Docker-based jobs.

Required environment variables

Variable	Description
OX_API_KEY	The OX Security API key.

Optional environment variables

Variable	Description
OX_OVERRIDE_BLOCKING	Set to true to override job failure caused by blocking issues.
OX_TIMEOUT	Maximum duration of the scan, in minutes.
OX_FAIL_ON_TIMEOUT	Set to true to fail the job if a scan times out.
OX_FAIL_ON_ERROR	Set to true to fail the job if a system or network error occurs.

Advanced environment variables

Variable	Description
ox_disable_ssl_validation	Set to true to disable SSL certificate validation for self-signed certificates in on-premise environments.
CF_ACCESS_CLIENT_ID	Sent as the CF-Access-Client-Id request header on requests to the OX API. Set this only when your OX deployment sits behind an access proxy that requires service-token headers, such as Cloudflare Access.
CF_ACCESS_CLIENT_SECRET	Sent as the CF-Access-Client-Secret request header on requests to the OX API. Use together with CF_ACCESS_CLIENT_ID.

Integration example (.gitlab-ci.yml)

stages:
  - test

ox_security_scan:
  stage: test
  image: oxsecurity/ox-block-mode:latest
  variables:
    OX_API_KEY: $OX_API_KEY
    # OX_OVERRIDE_BLOCKING: false
    # OX_TIMEOUT: 20
    # OX_FAIL_ON_TIMEOUT: false
    # OX_FAIL_ON_ERROR: false
  script:
    - ox-block-mode
  allow_failure: false