GitLab MR Vulnerability Widget Extension Chrome

Adds a widget to GitLab merge request page showing vulnerabilities detected by Container Scanning.

Latest Version

Version

0.0.1

Update

October 22, 2024

Size

25.64KiB

Developer

GitLab MR Vulnerability Widget Extension

This extension adds a widget in the Gitlab merge request page showing critical and high vulnerabilities of a container image generated in the associated pipeline.

A container scanning job must exist in the pipeline. This job must generate a container scanning report artifact. To add a container scanning job, follow the steps defined here: https://docs.gitlab.com/ee/user/application_security/container_scanning/

The free version of Gitlab supports container scanning but does not support decoration of the merge request with vulnerability details. This extension fills that gap by decorating the merge request with a vulnerability widget.

Note: The extension requires configuring a personal access token with \"read_api\" scope to allow fetching the pipeline artifacts. This token is saved in Chrome storage with encryption and never leaves your browser. To create a personal access token, follow the steps here: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html

Reference:
Container scanning job: https://docs.gitlab.com/ee/user/application_security/container_scanning/
Container scanning report artifact: https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscontainer_scanning
Personal access token: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html

Source Manifest.json

{"update_url": "https://clients2.google.com/service/update2/crx", "manifest_version": 3, "name": "GitLab MR Vulnerability Widget", "version": "0.0.1", "description": "Adds a widget to GitLab merge request page showing vulnerabilities detected by Container Scanning.", "permissions": ["activeTab", "storage"], "host_permissions": [ "https://gitlab.com/*" ], "background": { "service_worker": "background.js" }, "content_scripts": [ { "matches": ["https://gitlab.com/*/merge_requests/*"], "js": ["content.js"] } ], "options_page": "options.html", "icons": { "128": "icons/icon-128.png" }}