“Yes. GitLab CI supports both dependency scanning and container image scanning, and it can enforce security gates.”
+ dependency scanning
“Scan application dependencies (npm, Maven, Python, etc.) | Dependency Scanning | Ultimate”
+ container image scanning
“Scan Docker images for OS/package CVEs | Container Scanning (Trivy) | Free, Premium, Ultimate”
+ SBOM generation
“Generate SBOM | CycloneDX | Available through security scanning”
+ continuous vulnerability scanning
“Yes, with Continuous Vulnerability Scanning (GitLab Ultimate).”
+ merge request approval policies
“GitLab Ultimate provides Merge Request Approval Policies.”
− scanning does not block pipeline by default
“By default, GitLab security scanning jobs report vulnerabilities but pass the pipeline even when they find vulnerabilities.”
− continuous scanning does not fail completed pipelines
“Continuous scanning creates vulnerability records; it does not automatically fail an already-completed pipeline.”
− advisory delay
“It can take a few hours for newly published advisories to appear.”