NAME
glab-dependency-firewall-package - Check a package against the GitLab Dependency Firewall. (BETA)
SYNOPSIS
glab dependency-firewall package [flags]
DESCRIPTION
Check a single package coordinate against the GitLab Dependency Firewall policy for the current project and report the outcome (allow, warning, blocked). No package manager binary is required.
Supported package URL (PURL) types are npm, pypi, maven, gem, cargo, and golang. The PURL must include a version, for example pkg:npm/[email protected]. For golang, the module path keeps its case, for example pkg:golang/github.com/BurntSushi/[email protected].
An allowed package prints one line, for example, [email protected]: allowed by the Dependency Firewall. A warned or blocked package prints the same summary as the package manager commands.
This command does not write to the CI log at .gitlab/df/ci-log.json, so glab dependency-firewall ci-summary does not include its result.
Exit codes:
| Exit code | Meaning |
| 0 | Allowed or warned, or the Dependency Firewall is not evaluating the project. |
| 1 | The PURL is invalid or has no version, the project or credentials can't be resolved, or the request to GitLab failed. |
| 3 | Blocked. |
An exit code of 0 does not always mean GitLab checked the package. If the Dependency Firewall is not evaluating the project, the command prints a line that ends with the Dependency Firewall is not evaluating this project; allowing.
Unlike the package manager commands, this command does not block the package when the request to GitLab fails. It exits with 1 instead.
This feature is in beta and might not be ready for production use. It might be unstable and breaking changes can occur outside of major releases. For more information, see https://docs.gitlab.com/policy/development_stages_support/.
OPTIONS INHERITED FROM PARENT COMMANDS
-h, --help[=false]
Show help for this command.
EXAMPLE
# Check an npm package version glab dependency-firewall package pkg:npm/[email protected] # Check a PyPI package version glab dependency-firewall package pkg:pypi/[email protected] # Check a Maven package version glab dependency-firewall package pkg:maven/org.slf4j/[email protected] # Check a RubyGems package version glab dependency-firewall package pkg:gem/[email protected] # Check a Cargo package version glab dependency-firewall package pkg:cargo/[email protected] # Check a Go module version glab dependency-firewall package pkg:golang/github.com/pkg/[email protected]