Sca on Software Factory

Secure

Mon, 01 Jan 0001 00:00:00 +0000

GitLab Ultimate embeds a suite of security scanners directly into your CI/CD pipelines. They cover two complementary approaches: static analysis (source code, dependencies, secrets) and dynamic analysis (running application). All results are centralised in a single vulnerability report within GitLab.

Tip

Not familiar with the terminology? See SAST, DAST, SCA and other security terms in the glossary.

Black Duck

Mon, 01 Jan 0001 00:00:00 +0000

Black Duck is the Software Factory’s most complete Software Composition Analysis (SCA ) solution. It combines four detection techniques to build a complete dependency inventory — including dependencies that other tools miss, such as copy-pasted open source code and components embedded in compiled binaries.

This process helps in identifying known security vulnerabilities (CVEs/BDSAs), license compliance violations, operational risks, and generating a comprehensive Bill of Materials (BOM) for your applications.

Black Duck SCA

Mon, 01 Jan 0001 00:00:00 +0000

This guide outlines practical, step-by-step instructions for integrating Black Duck SCA into your workflow, from initial project setup to CI/CD integration, advanced manual operations, and local IDE scanning.

Prerequisites: You must have Maintainer permissions for your GitLab repository and access to the Black Duck server.

How to Prepare Your Black Duck Project

Before analyzing your source code, you must provision a project space.

Log in to your account on the Black Duck server.
In the top-right corner of the dashboard, click + Create Project.
Enter your Project Name.
Enter an initial Version Name (e.g., main, v1.2.0).
Fill out the desired fields (like Tier or Phase) and click Save.
Ensure your user account (or service account) has Project Code Scanner permissions.

How to Generate and Secure an Authentication Token

Your tools need access to a token to communicate with the server. Never hardcode this token in your source code.

How to Enable GitLab Container Scanning

Mon, 01 Jan 0001 00:00:00 +0000

For more information, see SCA practice

Configure your pipeline

Add the following to your .gitlab-ci.yml and push to your repository:

How to Enable GitLab Dependency Scanning

Mon, 01 Jan 0001 00:00:00 +0000

For more information, see SCA practice

Add to your pipeline

Add the following to your .gitlab-ci.yml and push to your repository:

Software Composition Analysis (SCA)

Mon, 01 Jan 0001 00:00:00 +0000

GitLab provides Software Composition Analysis capabilities through two CI-integrated tools: Dependency Scanning and Container Scanning.
Both require GitLab Ultimate, which is included in the Software Factory at no additional cost.

For background on SCA concepts, see the SCA practice page.

Inventory Coverage

The table below maps GitLab SCA’s capabilities to the analysis approaches defined in the SCA practice.

Dependency Scanning parses language-specific lockfiles to build the dependency graph and produces a Source SBOM in CycloneDX format. It currently relies on the Gemnasium-based analyzer, which is deprecated by GitLab but remains the only generally available option. A newer SBOM-based analyzer is in development but not yet GA. See Supported languages and package types for the full list of supported ecosystems.

JFrog Xray

Mon, 01 Jan 0001 00:00:00 +0000

JFrog Xray is part of the Software Factory’s Software Composition Analysis (SCA ) offering, available with the DevSecOps package. It can be used standalone via the JFrog CLI, or coupled with JFrog Artifactory for end-to-end security and compliance management across your software supply chain.

Info

This page describes the tool independently of any platform-specific details. For the service URL and other platform-specific configuration, please refer to your platform’s dedicated page .