GitLab CI

Integrate netbobr firewall rule analysis into GitLab CI/CD pipelines. netbobr's exit codes separate policy failures (2) from tool errors (1), so allow_failure can tolerate findings without ever hiding a broken run.

Basic Pipeline

A minimal .gitlab-ci.yml job that fails on high or critical findings:

firewall-analysis:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

The job fails when the CLI exits non-zero:

• 2: a flow has a finding at or above --fail-on, or a DENY verdict.
• 1: an error, such as a missing file, an invalid config or an invalid flow.

With SARIF Output

artifacts:reports:sast expects GitLab's own SAST report schema (gl-sast-report.json), not SARIF, so do not declare netbobr's SARIF output as a sast report.

GitLab's dedicated artifacts:reports:sarif ingests SARIF 2.1.0 files into the pipeline Security tab and the vulnerability report. It is a GitLab Ultimate feature, generally available from GitLab 19.2 (behind the sarif_ingestion feature flag from 18.11). GitLab ingests the findings only when the job succeeds. So run the SARIF job report-only (--fail-on none), and gate in a separate job:

# Publishes findings; fails only on tool errors (exit 1)
firewall-sarif:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on none --output sarif --output-file netbobr.sarif
  artifacts:
    when: always
    reports:
      sarif: netbobr.sarif
    paths:
      - netbobr.sarif

# Blocks the pipeline on high/critical findings or DENY verdicts
firewall-gate:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high --quiet

On GitLab tiers or versions without reports:sarif, keep only the paths entry: the SARIF file is then a downloadable job artifact.

With PDF Report Artifact

Generate a PDF compliance report and make it downloadable from the pipeline:

firewall-report:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze rules.json --fail-on none --output pdf --output-file report.pdf
  artifacts:
    when: always
    paths:
      - report.pdf
    expire_in: 30 days

Severity Gating with allow_failure

Combine a blocking job and a non-blocking job to get two thresholds:

# Blocks the pipeline: high or critical findings, DENY verdicts, or any error
firewall-gate:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high

# Warns only: medium findings show as "passed with warnings";
# errors (exit 1) still fail the job
firewall-review:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on medium
  allow_failure:
    exit_codes:
      - 2

Only ever list exit code 2 under allow_failure: exit_codes. Exit code 1 means netbobr did not finish: a typo in a flag, an unreadable file, an invalid config, invalid flows or a crash. Tolerating it would let a broken analysis pass.

With Configuration

Load zones and zone policies, custom rules, zone attributes and disabled rules from a session saved in the web app. A flow between zones whose policy is Deny, or one matched by a custom rule with a DENY override, fails the gate at any --fail-on level except none.

To override the default risk score weights or thresholds, add flat weights and thresholds keys to the config file (see Thresholds). A session's old riskWeights block is ignored with a warning.

firewall-analysis:
  image: node:20
  stage: test
  script:
    - npx --yes @netbobr/cli@2 analyze rules.json --config netbobr-config.json --fail-on medium

Cloud exports and Terraform source work the same way. Use --cloud-format aws-sg, azure-nsg, gcp-fw, tf-plan, tf-hcl, k8s-netpol or auto:

    - npx --yes @netbobr/cli@2 analyze main.tf --cloud-format tf-hcl --fail-on high

Exit Code Reference

--fail-on takes info, low, medium (the default), high, critical or none. none is report-only: it never exits 2, and errors still exit 1.