Feature: gitlab support

[dgutson]

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through the open issues for a duplicate request.

What's the problem this feature will solve?

Is there any interest in supporting gitlab as well?
If so, besides the yaml layout, what would it take?

Describe the solution you'd like

zizmor features for gitlab CI files

Additional context

No response

[woodruffw]

Thanks for filing an issue @dgutson!

Is there any interest in supporting gitlab as well?

Yes, although it's very preliminary/abstract interest 🙂. I've thought a bit about this, but it's non-trivial:

• We'd need an equivalent of github-action-models for GitLab's CI models. Someone would probably need to hand-write this to ensure that the models are of reasonable quality.
• We'd need to figure out a way to shoehorn GitLab into the existing audit structure, or create a parallel structure just for GitLab.
• We'd need to figure out what the appropriate "discovery" flow is (retain GitHub only by default and require --gitlab or similar for GitLab? Discover files for both?)

In addition to these technical elements, this would also require someone to step up and volunteer to be the technical expert on GitLab's CI/CD -- I'm generally familiar with it, but someone who knows it much better than I do would ideally contribute review and audit development time.

All in all, I would be happy to plan for this feature, but I think it's too big for the current 1.0 roadmap. If people would like to continue discussing it, it's something we could think about for a 2.0 roadmap.

[woodruffw]

Per above, I'm going to move this to a discussion. Thanks again @dgutson!