DarkMoon in GitLab: a CI/CD Catalog component with native MR reports

On GitLab, security that shows up in the merge request gets fixed. The DarkMoon CI/CD component runs an autonomous pentest in your pipeline and reports it where reviewers already look, the Code Quality widget on the MR, with an optional SAST report on the Security tab.

Include one component

include:
  - component: $CI_SERVER_FQDN/darkmoon/scan@1
    inputs:
      target: "https://staging.example.com"
      mode: "pro"
      pro-url: "https://darkmoon.internal"
      fail-on: "critical,high"
      sast-report: true

The component (published on the GitLab CI/CD Catalog as Dark-Moon-X/darkmoon-scan) wraps the portable darkmoon-ci CLI. It does not embed the engine, it drives it, which keeps the contract small and auditable.

Native GitLab reports

A Python mapper turns findings into the formats GitLab renders on its own:

• gl-code-quality-report.json, so findings appear in the Code Quality widget and tab on the merge request.
• gl-sast-report.json (optional), so they appear on the Security tab.

Both are schema-validated in the pipeline that ships the component.

Inputs that match a real policy

• target, mode (auto, oss, pro), pro-url.
• focus and severity to shape and cap the run.
• fail-on (default critical,high), which fails the job on matching findings.
• OSS paths, output directory, image (default node:20-slim), and job placement (job-name, stage).

The repo ships a real gitlab-runner end-to-end flow so you can validate the whole thing before adding it to a protected pipeline. See the integrations catalog and the GitHub Action for the same pattern on GitHub.