Metadata-Version: 2.4
Name: glsec
Version: 1.26.0
Summary: Security linter for GitLab CI/CD pipelines
License-Expression: Apache-2.0
License-File: LICENSE
Project-URL: Homepage, https://glsec.github.io
Project-URL: Source, https://github.com/glsec/glsec
Project-URL: Issues, https://github.com/glsec/glsec/issues
Project-URL: Changelog, https://github.com/glsec/glsec/releases
Keywords: gitlab,ci,cd,security,linter,sast,supply-chain
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Description-Content-Type: text/markdown

# glsec

Security linter for GitLab CI/CD pipelines. glsec reads `.gitlab-ci.yml` and
reports mutable images, unpinned includes, hardcoded secrets, script
injection, token exfiltration, unrestricted OIDC tokens and more, mapped to
the OWASP Top 10 CI/CD Security Risks. It runs offline and needs no access to
your GitLab instance.

```sh
pipx install glsec      # or: uv tool install glsec
uvx glsec .gitlab-ci.yml
```

This package ships the prebuilt binary of the GitHub release with the same
version; the archive it was taken from carries build provenance from the
release workflow. Documentation, rules and other install methods:
https://github.com/glsec/glsec
