GitLab CI/CD

Add the CI/CD Catalog component to your pipeline and every merge request gets an offline compliance scan with a SARIF artifact. No API key, and your code never leaves your runner.

01 · Setup

2 steps.

01Add the component

Reference the Scrutora component in your .gitlab-ci.yml. It runs on merge requests and pushes.

include:
  - component: gitlab.com/scrutora-group/scrutora-scan/scan@~latest
    inputs:
      frameworks: dpdpa,hipaa
      fail_on: high        # none|low|medium|high|critical

02Run the pipeline

The scan runs offline in the job and writes a SARIF artifact you can download or wire into your merge-request workflow. With fail_on set, a finding at or above that severity fails the pipeline and blocks the merge.

02 · What you get

After the first run.

Merge-request gating

fail_on stops non-compliant changes before they merge.

SARIF artifact

Standard SARIF v2.1.0 attached to the job for download or downstream tooling.

Obligation citations

Each finding maps to the exact DPDPA/HIPAA/GDPR obligation.

SaaS or self-managed

Runs offline on GitLab.com or your own runners, with no egress required.

03 · Questions

The ones people actually ask.

Does it work on self-managed GitLab?

Yes. The scan runs entirely inside the job container, so it works on GitLab.com and self-managed instances, including air-gapped runners.

Which frameworks can I scan for?

DPDPA, HIPAA, GDPR, PCI-DSS, RBI and more, set the frameworks input.

Is it free?

Yes, the CI scanning is free with no API key. The Scrutora platform adds cloud posture, consent, RoPA and audit evidence.

GitLab CI/CD Catalog

04 · Try itPUBLIC REPOSITORIES

Wire it into a build.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.