Step-by-step guide to integrating Vulnetix CLI into GitLab CI/CD pipelines. Upload SARIF, CycloneDX, SPDX reports and run native SCA scans.
Add Vulnetix to GitLab CI/CD
Create .gitlab-ci.yml and run the Vulnetix CLI in your GitLab CI/CD pipeline. It collects SARIF, CycloneDX and SPDX artifacts automatically and uploads them for centralised vulnerability management:
stages:
- security
vulnetix:
stage: security
image: alpine:3.20
variables:
VULNETIX_VERSION: latest
before_script:
- apk add --no-cache bash ca-certificates curl tar
- curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir /usr/local/bin --version "$VULNETIX_VERSION"
script:
- vulnetix auth verify
- vulnetix scan --severity high
Why run Vulnetix in GitLab CI/CD?
Every scan from every job lands in one queue, deduplicated and prioritised with EPSS, CISA KEV and Coalition ESS exploit intelligence, so your GitLab CI/CD pipeline gates merges on what is actually exploitable, not raw scanner noise.