---
title: GitLab
slug: docs/gitlab
description: Learn how to integrate GitLab repositories with TruffleHog. It offers YAML code examples for easy local configuration and provides a detailed list of supported options and capabilities. Discover the limitations of th
icon: {"faIcon":"fa-brands fa-gitlab"}
docTags: 
createdAt: 2024-04-17T14:46:08.908Z
---

# GitLab

:::BlockQuote
**Edition:** Enterprise + Open Source
:::

The GitLab integration scans repositories in GitLab for credentials and other sensitive data. To scan artifacts produced by GitLab CI pipelines, see [Scanning in CI](docId:8DqNVC9XDDXKjkD3dY8xU) instead.

## Dependencies (Self-Hosted Deployment Only) 

This setup requires specific tools for effective operation. Git is essential for repository management, while rpm2cpio, binutils, and cpio are necessary for extracting files from .rpm and .deb package formats.

- **Git**: For cloning repositories.
- **rpm2cpio**: To extract content from RPM packages.
- **binutils**: Includes the "ar" tool, crucial for extracting contents from .deb files.
- **cpio**: A versatile file archiver utility, compatible with various archive formats including .rpm and .deb.

### Installing Dependencies on Ubuntu

To install these dependencies on an Ubuntu system, follow these steps:

1. Open a terminal.
2. Update your package lists to ensure you get the latest version available:

```shell
$ sudo apt update
```

1. Install the required packages:

```shell
sudo apt install git rpm2cpio binutils cpio
```

## Configuration

The GitLab integration can be configured in TruffleHog under **Integrations**, or via a local configuration file (below).

### Web configuration

Configure this integration from the **Integrations** page in TruffleHog. You'll need either:

- A GitLab personal or project access token with the **read\_api** scope, or
- Basic auth credentials for a service account.

### Local configuration

Local configuration supports two authentication methods:

- **Access token** — uses a GitLab personal or project access token with the read\_api scope.
- **Basic auth** — uses a service account username and password.

**Access token**

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.GitLab
      endpoint: https\://gitlab.ourbusiness.com
      \# The GitLab token must be created with the \`read\_api\` scope.
      token: XXXXXXXXXXXXXXXXXXXXXXXXXX
      skipBinaries: true
    name: GitLab
    scanPeriod: 12h
    type: SOURCE\_TYPE\_GITLAB
    verify: true
:::

**Basic auth**

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.GitLab
      endpoint: https\://gitlab.ourbusiness.com
      basicAuth:
        username: svc-user
        password: XXXXXXXXXXXXXXX
      ignoreRepos:
        \- trufflesecurity/test\_keys
      skipBinaries: true
    name: GitLab
    scanPeriod: 12h
    type: SOURCE\_TYPE\_GITLAB
    verify: true
:::

## Configuration options

| Field        | Type    | Required | Description                                                                  |
| ------------ | ------- | -------- | ---------------------------------------------------------------------------- |
| endpoint     | string  | No       | The URL endpoint for the GitLab server. Defaults to GitLab Cloud.            |
| repositories | list    | No       | Explicit list of repository names to scan. Omit to enumerate instead.        |
| includeRepos | list    | No       | Repositories to include in organization scans. Supports glob patterns (\*).  |
| ignoreRepos  | list    | No       | Repositories to skip during organization scans. Supports glob patterns (\*). |
| skipBinaries | boolean | No       | Skip binary files.                                                           |
| skipArchives | boolean | No       | Skip archive files.                                                          |
| clonePath    | string  | No       | Directory on the scanner where repositories are cloned. Defaults to `/tmp`   |

## Capabilities

| Feature                    | Supported |
| -------------------------- | --------- |
| Scan archive files         | ✅         |
| Scan archived repositories | ✅         |
| Scan base64-encoded data   | ✅         |
| Scan binaries              | ✅         |
| Scan GitLab Actions        | ✅         |
| Include / exclude filters  | ✅         |
| Pre-commit                 | ✅         |
| Pre-receive                | ✅         |
| Auto-resume                | ✅         |

## Notes

- TruffleHog does not scan diffs larger than 1 GB.
- For artifacts produced by GitLab CI pipelines, use the GitLab CI source rather than this integration.

### Troubleshooting

| Error                                                                                   | Cause                                                                                                          | Solution                                                                                                                                                                                                                                                            |
| --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| cannot process 'refs/remotes/origin/...' and 'refs/remotes/origin/...' at the same time | Repository contains refs that conflict on disk during clone (e.g., a branch and a tag with overlapping paths). | Uncommon, but the scan will skip the affected repo and continue. If you need to scan a repo that consistently throws this error, [open a bug report ](https://trufflesecurity.atlassian.net/servicedesk/customer/portal/1/group/1/create/6)for workaround guidance. |