glsec

What it is

glsec is a Go security linter for .gitlab-ci.yml. The existing summary covers its purpose and output formats; the page adds the concrete operational surface — verification steps with an ordering constraint, exit-code semantics, and baseline/gating modes — that determine how you actually wire it into CI.

What to do

Install via go install github.com/glsec/glsec@latest (Go 1.25+) or grab a release binary. Basic scans:

glsec .gitlab-ci.yml            # exit 1 on error findings, 0 if clean, 2 on parse error
glsec --recursive .             # find all .gitlab-ci.yml in a tree
glsec --strict .gitlab-ci.yml   # treat warn as hard failure (exit 1)
glsec --no-exit-codes .gitlab-ci.yml  # advisory mode, always exit 0

Gate merge requests on "don't make it worse" rather than clean-slate:

glsec --generate-ignore .gitlab-ci.yml           # baseline current findings
glsec --new-only .gitlab-ci.yml                  # fail only on new findings vs .glsec-ignore
glsec --new-only --baseline main.json .gitlab-ci.yml
glsec --no-ignores .gitlab-ci.yml                # audit mode: bypass all suppressions

For GitLab specifically, --format codeclimate and --format junit both work on all tiers (inline MR findings / test widget), unlike SARIF SAST which needs Ultimate.

Verification — the ordering matters

Signing is keyless via Sigstore, so there is no public key to fetch. The critical detail: cosign verification is meaningless without the identity flags —

cosign verify ghcr.io/glsec/glsec:1.17.0 \
  --certificate-identity-regexp 'https://github.com/glsec/glsec/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The page warns that without both --certificate-* flags, cosign verify accepts a signature from any identity, defeating the purpose. For binaries, verify the attested checksums file first, then trust the digests it lists:

gh attestation verify checksums.txt --owner glsec
sha256sum -c checksums.txt --ignore-missing

Caveats

The per-archive .sbom.json files are plain release assets, not attestations — deliberately. Each lists only four entries (glsec, its sole dependency gopkg.in/yaml.v3, the Go stdlib, and the archive digest), the same information go.mod already exposes. A swapped SBOM cannot make a tampered archive verify because the archive itself is covered by provenance. If you need an end-to-end trustworthy SBOM, use the container image's signed SBOM attestation (cosign tree ghcr.io/glsec/glsec:1.17.0) or regenerate one from a verified archive with syft. Homebrew is listed as "coming soon."

Note glsec scans run: (CI/CD Steps) and CI/CD Catalog component templates (spec: header) automatically, skipping whole-pipeline rules a template fragment cannot satisfy.