# Create a virtual environment
python3 -m venv venv
source venv/bin/activate

# Install required libraries
# python-gitlab: Official GitLab API wrapper
# python-dotenv: For secure environment variable management
pip install python-gitlab python-dotenv requests

# Initialize project
npm init -y

# Install dependencies
# @gitbeaker/rest: The most robust GitLab SDK for JS
# dotenv: For managing environment variables
npm install @gitbeaker/rest dotenv

import gitlab
import os
from dotenv import load_dotenv

# Load environment variables from.env file
load_dotenv()

class GitLabSecurityAuditor:
    def __init__(self):
        self.gl = None
        self.token = os.getenv("GITLAB_TOKEN")
        self.url = os.getenv("GITLAB_URL", "https://gitlab.com")

    def connect(self):
        """Initializes the GitLab connection with error handling."""
        try:
            self.gl = gitlab.Gitlab(self.url, private_token=self.token)
            self.gl.auth()
            print(f"[+] Connected to GitLab: {self.gl.user.username}")
        except Exception as e:
            print(f"[!] Connection Failed: {e}")
            raise

    def audit_project_secrets(self, project_id):
        """
        Scans project for sensitive files that should not be present
        (e.g.,.env,.pem, credentials.json).
        """
        try:
            project = self.gl.project(project_id)
            # Get file list from the main branch
            files = project.files.get(ref='main', path='.env')
            print(f"[!] SECURITY ALERT: Sensitive file '.env' found in repository!")
            return True
        except gitlab.exceptions.GitlabFileNotFoundError:
            print("[+] Audit: No sensitive.env file detected in root.")
            return False
        except Exception as e:
            print(f"[-] Audit Error: {e}")
            return None

if __name__ == "__main__":
    # Replace with your actual Project ID from GitLab UI
    PROJECT_ID = "12345678" 
    
    auditor = GitLabSecurityAuditor()
    auditor.connect()
    auditor.audit_project_secrets(PROJECT_ID)

import { Gitlab } from '@gitbeaker/rest';
import * as dotenv from 'dotenv';

dotenv.config();

interface AuditResult {
    isSecure: boolean;
    message: string;
}

class GitLabGuard {
    private api: Gitlab;

    constructor() {
        this.api = Gitlab({
            baseUrl: process.env.GITLAB_URL || 'https://gitlab.com',
            token: process.env.GITLAB_TOKEN || '',
        });
    }

    /**
     * Checks if the project has any high-severity vulnerabilities 
     * reported via GitLab's built-in security scanning.
     */
    async checkVulnerabilities(projectId: string): Promise<AuditResult> {
        try {
            // Fetch vulnerabilities for the specific project
            const vulnerabilities = await this.api.Project.Vulnerabilities.list(projectId);
            
            if (vulnerabilities.length > 0) {
                return {
                    isSecure: false,
                    message: `Found ${vulnerabilities.length} vulnerabilities reported.`
                };
            }

            return { isSecure: true, message: "No vulnerabilities reported." };
        } catch (error) {
            console.error("Error fetching vulnerabilities:", error);
            throw new Error("Failed to audit project security.");
        }
    }
}

// Execution
(async () => {
    const guard = new GitLabGuard();
    const PROJECT_ID = '12345678'; // Replace with target ID

    console.log("--- Initiating Security Scan ---");
    try {
        const result = await guard.checkVulnerabilities(PROJECT_ID);
        console.log(`Status: ${result.isSecure? '✅ SECURE' : '❌ VULNERABLE'}`);
        console.log(`Detail: ${result.message}`);
    } catch (err) {
        console.error("Critical Failure during scan:", err.message);
    }
})();

# GitLab API Configuration
GITLAB_URL=https://gitlab.com
GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxxxxxx
PROJECT_ID=12345678

audit_security:
  stage: test
  image: python:3.9
  script:
    - pip install python-gitlab python-dotenv
    - python security_audit.py
  only:
    - merge_requests