GitLab CI/CD

This page explains how to integrate HoundDog.ai’s code scanner with GitLab CI/CD pipelines.

Defining the Required CI/CD Variables

First, follow the steps in API Keys to generate a HoundDog.ai organization API key. Then follow the steps in the GitLab documentation to create a masked CI/CD variable named HOUNDDOG_API_KEY with the value of your key. GitLab allows you to define CI/CD variables at multiple levels (instance, group, or project) — any level works.

Defining the Scan Job in .gitlab-ci.yml

Next, add a new job in the .gitlab-ci.yml file in your project. Here is an example which scans your repository and uploads the results to the HoundDog.ai Cloud Platform:

hounddog:
  allow_failure: true
  image:
    name: hounddogai/hounddog
    pull_policy: always
  script:
    - hounddog scan

Note that the HOUNDDOG_API_KEY variable is not referenced explicitly — GitLab automatically injects CI/CD variables into the build environment.

Here is another example for GitLab Ultimate users who prefer to manage their findings in GitLab’s vulnerability report:

hounddog:
  allow_failure: true
  image:
    name: hounddogai/hounddog
    pull_policy: always
  script:
    - hounddog scan --output-format=gitlab --output-path=hounddog.json --no-cloud-upload
  artifacts:
    reports:
      # Upload to GitLab's vulnerability report dashboard.
      sast: hounddog.json

Blocking the Pipeline Upon Detecting Vulnerabilities

In the examples above, allow_failure: true keeps the pipeline green regardless of the scan outcome. To fail the pipeline upon detecting vulnerabilities, remove allow_failure (it defaults to false) and provide the --fail-severity-threshold option to the hounddog scan command:

hounddog:
  image:
    name: hounddogai/hounddog
    pull_policy: always
  script:
    # Fail if a risky dataflow with severity "medium" or higher is detected.
    - hounddog scan --fail-severity-threshold=medium

The scan results still upload to the Cloud Platform before the job fails, so the platform always reflects the latest scan.

To view all available command-line options for the hounddog scan command, see Scanner Configuration.