Integrating outside security scanners

Many teams are committed to using one or more security scanners that are not part of GitLab’s security offering. Never fear – it’s usually possible to integrate outside scanners into your GitLab CI/CD pipelines.

Integration has two parts. First, you need to tell your pipeline to trigger the outside scanner. This is easy, so long as your scanner comes packaged in a Docker image and can be run from the command line:

1. Create a new pipeline job in the test stage (unless there’s a reason to run it elsewhere).
2. Use the images keyword in the job definition to specify the location of the Docker image that contains the scanner you’d like to add to your pipeline.
3. In the script section of the job definition, trigger the scanner using whatever CLI command you use when you run it manually. You might need to pass some options to the CLI command to control where it generates its results file, and what format...