GitLab SAST

Connection methods

• CI/CD pipeline scan API
• SAST platform REST API
• Pull request decoration webhooks
• SARIF or CSV finding exports

Documentation topics

Review the following areas in GitLab SAST admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

GitLab SAST integrates with ComplAI to support Propel Ready Solutions's GRC program. Built-in static application security testing in GitLab CI/CD pipelines. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Open code findings by severity
• Scan frequency per repository
• Developer fix rates
• Release gate pass/fail metrics
• Pipeline SAST metrics and configuration evidence
• Multi-language metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in GitLab SAST
• GitLab SAST product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan GitLab SAST integration scope

   Confirm which Pipeline SAST and Multi-language capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Integrate SAST into CI/CD

   Enable pipeline scans for all production repositories with quality gates on critical/high findings.

3. Step 3

   Connect SAST platform API

   Pull scan results, fix rates, and release gate status from SonarQube, Checkmarx, Veracode, Snyk, or GitLab.

4. Step 4

   Map findings to SDLC controls

   Link secure coding requirements to ISO A.8.25–A.8.28 and store scan reports as control evidence.

5. Step 5

   Track developer remediation

   Monitor open finding age, false-positive rates, and release blocking events in ComplAI dashboards.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Secure development lifecycle evidence for ISO A.8.25–A.8.28
• Developer remediation metrics for DevSecOps maturity programs
• Release gate compliance for change management (A.8.32)

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting