glab(1)

📦
version 1.128.0 · 4 versions
, in arch rolling

✨ glab(1) — the dependency-firewall glow-up ✨

okay bestie, you're looking at the manual page for glab, specifically the glab-dependency-firewall command. she's in BETA rn (we'll get to that, don't worry 🫶).

💅 NAME

glab-dependency-firewall — configure and monitor GitLab Dependency Firewall for your local package managers. yes, that Dependency Firewall. and yes, she is (BETA) 🔥

🎀 SYNOPSIS

glab dependency-firewall  [flags]

🌸 DESCRIPTION

These are the commands that configure GitLab Dependency Firewall for your local package managers, run a local package manager with a lil summary of what got blocked or flagged, and let you peek at the activity from the current session. it's giving security guard but make it cute 👑

Every package manager command — like glab dependency-firewall npm — runs the actual package manager binary and forwards every argument to it verbatim. no edits, no vibes-based filtering, just straight through. and while the package manager runs, the command does this whole sequence:

  1. Starts a local proxy and routes the package manager's HTTPS traffic through it. 🛰️
  2. Reads the name and version of every package the package manager downloads or publishes. 👀
  3. Asks GitLab to evaluate each package against the policies for the project in your Git remote. 💌
  4. Refuses blocked packages with a 403 Forbidden response, and lets allowed and warned packages through. blocked = not today, bestie 💀
  5. Records blocked and warned packages in .gitlab/df/ci-log.json and prints a summary. 📝

When the package manager finishes, the command prints a summary of the packages that matched your policies. a ✖ marks a blocked package, and a ▲ marks a package with a warning. if no package matched, the command prints no summary at all (silence is golden ✨). a run with at least one blocked package prints the summary to standard error. a run with only warnings prints it to standard output.

Evaluation results are cached for the length of a run, so a package that shows up like fifty times in a dependency tree only gets evaluated once. efficient icon behavior 🧚

If GitLab can't evaluate a package, the command blocks it. and if the Dependency Firewall isn't evaluating the project at all, the command allows every package. no cap, that's just how it goes.

🚨 the command does not change your registry configuration. for the length of the run, it sets environment variables that route the package manager's traffic through the proxy and make the package manager trust the proxy certificate. your existing CA bundles stay trusted, periodt.

To reach package registries, the proxy uses the outbound proxy in HTTPS_PROXY — including any credentials in its URL — and connects directly to the hosts listed in NO_PROXY. the proxy setting in your glab configuration applies only to GitLab API calls, so don't get it twisted.

Connections to package registries trust:

  • the system certificates
  • the certificate in the ca_cert setting for your GitLab host
  • the CA bundles in SSL_CERT_FILE, REQUESTS_CA_BUNDLE, PIP_CERT, TWINE_CERT, NODE_EXTRA_CA_CERTS, BUNDLE_SSL_CA_CERT, and CARGO_HTTP_CAINFO

GitLab API calls trust only the system certificates and ca_cert — so if your outbound proxy uses a private certificate authority, set ca_cert to that CA to cover both. that's the move. 🎯 Module downloads by glab dependency-firewall go trust only the system certificates or SSL_CERT_FILE.

The command writes .gitlab/df/ci-log.json to the working directory on every run, including local runs. so please, for the love of everything, add .gitlab/df/ to your .gitignore. 🙈

🦋 running it in CI/CD

To run a package manager command in a GitLab CI/CD job, set GLAB_ENABLE_CI_AUTOLOGIN to true so the command signs in with the CI/CD job token. and heads up: when the firewall blocks a package, the install fails, and so does the job. 💀

For more information, see CI/CD auto-login at https://docs.gitlab.com/cli/authentication/#auto-login.

install:
  variables:
    GLAB_ENABLE_CI_AUTOLOGIN: "true"
  script:
    - glab dependency-firewall npm ci

⭐ exit codes, aka what the girlies return

Package manager commands exit with the following codes:

  • the package manager's exit code — the package manager ran and exited. simple as that.
  • 1 — the package manager was not found on your PATH or could not start. 😭
  • 130 — the run was interrupted or stopped, for example with Ctrl+C or when a CI/CD job is canceled.
💜 beta warning, and this one's real: this feature is in beta and might not be ready for production use. it might be unstable and breaking changes can occur outside of major releases. for more information, see https://docs.gitlab.com/policy/development_stages_support/.

✨ OPTIONS INHERITED FROM PARENT COMMANDS ✨

  • -h, --help[=false] — show help for this command. the classic. the icon. 🫶

🌈 SEE ALSO

okay that's the whole page, bestie, you ate that 🍓 auto generated by spf13/cobra, dated Nov 2026, and this lil glab(1) page says byeeee 💅✨

📦 where this page comes from