stages:
- build
- scan
variables:
# Replace {slug} with your organization's tenant identifier
BINARLY_AUTH_URL: https://auth-{slug}.binarly.cloud/realms/BinarlyRealm/protocol/openid-connect/token
BINARLY_API_URL: https://dashboard-{slug}.binarly.cloud
build:
stage: build
script:
- make firmware
artifacts:
paths:
- build/firmware.bin
binarly-scan:
stage: scan
image: alpine:3.20
needs:
- build
before_script:
- apk add --no-cache curl jq
# Access tokens expire after 30 minutes, so the job requests a new one
# before each group of API calls
- |
get_token() {
curl -sS --fail-with-body \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "grant_type=client_credentials" \
--data-urlencode "client_id=${BINARLY_CLIENT_ID}" \
--data-urlencode "client_secret=${BINARLY_CLIENT_SECRET}" \
"$BINARLY_AUTH_URL" | jq -er '.access_token'
}
script:
# Generate upload URL
- |
TOKEN=$(get_token)
UPLOAD_RES=$(curl -sS --fail-with-body -X POST -H "Authorization: Bearer $TOKEN" \
"$BINARLY_API_URL/api/v4/products/${BINARLY_PRODUCT_ID}/tempFiles:generateUploadUrl")
UPLOAD_URL=$(echo "$UPLOAD_RES" | jq -er '.uploadUrl')
TEMP_ID=$(echo "$UPLOAD_RES" | jq -er '.id')
# Upload binary
- curl -sS --fail-with-body -X PUT --data-binary @./build/firmware.bin "$UPLOAD_URL"
# Create image and start scan
- |
IMAGE_RES=$(curl -sS --fail-with-body -X POST \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d "$(jq -n --arg id "$TEMP_ID" --arg name "GitLab Pipeline $CI_PIPELINE_ID" --arg version "1.0.$CI_PIPELINE_IID" \
'{tempFileId: $id, name: $name, version: $version, filename: "firmware.bin"}')" \
"$BINARLY_API_URL/api/v4/products/${BINARLY_PRODUCT_ID}/images")
IMAGE_ID=$(echo "$IMAGE_RES" | jq -er '.id')
echo "Image ID: $IMAGE_ID"
# Poll for completion
- |
STATUS="new"
while [ "$STATUS" == "new" ] || [ "$STATUS" == "running" ]; do
sleep 30
TOKEN=$(get_token)
SCAN_RES=$(curl -sS --fail-with-body -H "Authorization: Bearer $TOKEN" \
"$BINARLY_API_URL/api/v4/products/${BINARLY_PRODUCT_ID}/images/$IMAGE_ID/scans")
STATUS=$(echo "$SCAN_RES" | jq -r '.scans[0].latestScanState.type')
echo "Scan status: $STATUS"
done
if [ "$STATUS" != "done" ]; then
echo "Scan did not finish successfully: $STATUS"
exit 1
fi
echo "Scan completed successfully"
# Verify Results
- |
FAIL_ON_STATUS="${FAIL_ON_STATUS:-new,inProgress}"
echo "Binarly Security Verification"
echo "Failing on statuses: ${FAIL_ON_STATUS}"
echo ""
TOKEN=$(get_token)
# Find the image uploaded before this one, to compare against
IMAGES_RES=$(curl -sS --fail-with-body -H "Authorization: Bearer ${TOKEN}" \
"${BINARLY_API_URL}/api/v4/products/${BINARLY_PRODUCT_ID}/images")
PREVIOUS_ID=$(echo "$IMAGES_RES" | jq -r --arg id "$IMAGE_ID" '
(.images[] | select(.id == $id) | .createTime) as $created
| [.images[] | select(.createTime < $created)]
| sort_by(.createTime) | last | .id // empty')
if [ -n "$PREVIOUS_ID" ]; then
echo "Comparing images:"
echo " Previous: ${PREVIOUS_ID}"
echo " Latest: ${IMAGE_ID}"
echo ""
# Count RESOLVED findings (only in previous image = left side)
RESOLVED=$(curl -sS --fail-with-body -X POST \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"filters": [
{"field": "compareLeftImageId", "value": "'"${PREVIOUS_ID}"'", "comparator": "equals"},
{"field": "compareRightImageId", "value": "'"${IMAGE_ID}"'", "comparator": "equals"},
{"field": "compareSide", "value": "left", "comparator": "equals"}
]
}' \
"${BINARLY_API_URL}/api/v4/grids/findings:gridList" | jq -e '.total')
# Count UNCHANGED findings (present in both images)
UNCHANGED=$(curl -sS --fail-with-body -X POST \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"filters": [
{"field": "compareLeftImageId", "value": "'"${PREVIOUS_ID}"'", "comparator": "equals"},
{"field": "compareRightImageId", "value": "'"${IMAGE_ID}"'", "comparator": "equals"},
{"field": "compareSide", "value": "both", "comparator": "equals"}
]
}' \
"${BINARLY_API_URL}/api/v4/grids/findings:gridList" | jq -e '.total')
# Count NEW findings (only in latest image = right side)
NEW_ISSUES=$(curl -sS --fail-with-body -X POST \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"filters": [
{"field": "compareLeftImageId", "value": "'"${PREVIOUS_ID}"'", "comparator": "equals"},
{"field": "compareRightImageId", "value": "'"${IMAGE_ID}"'", "comparator": "equals"},
{"field": "compareSide", "value": "right", "comparator": "equals"}
]
}' \
"${BINARLY_API_URL}/api/v4/grids/findings:gridList" | jq -e '.total')
echo "Comparison Statistics:"
printf " Resolved from previous: %6d\n" "$RESOLVED"
printf " Unchanged (still present): %6d\n" "$UNCHANGED"
printf " Newly introduced: %6d\n" "$NEW_ISSUES"
echo ""
fi
# Count findings in this image with the configured statuses
# Convert comma-separated statuses to a JSON array
STATUSES_JSON=$(echo "$FAIL_ON_STATUS" | tr -d ' ' | tr ',' '\n' | jq -R . | jq -s .)
TOTAL_ACTIONABLE=$(curl -sS --fail-with-body -X POST \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{
"filters": [
{"field": "imageId", "value": "'"${IMAGE_ID}"'", "comparator": "equals"},
{"field": "issueStatus", "value": '"${STATUSES_JSON}"', "comparator": "in"}
]
}' \
"${BINARLY_API_URL}/api/v4/grids/findings:gridList" | jq -e '.total')
echo "Statuses checked: ${FAIL_ON_STATUS}"
echo "Total actionable findings: ${TOTAL_ACTIONABLE}"
echo ""
# Pass/Fail decision
if [ "$TOTAL_ACTIONABLE" -gt 0 ]; then
echo "BUILD FAILED: ${TOTAL_ACTIONABLE} actionable finding(s)"
exit 1
fi
echo "BUILD PASSED: No actionable findings"
