gitlab-security-setuplisted

# GitLab Security Setup Full security stack for your company's GitLab.com projects on the Free tier. Covers: pnpm 11 supply chain, Trivy weekly scan, HTML email reports via Gmail. > **Placeholder:** `{report_recipients}` is a comma-separated list of email > addresses that receive the vulnerability reports (e.g. `you@example.com, teammate@example.com`). > Replace it everywhere it appears below with your own recipient address(es) before running. ## What gets set up 1. **pnpm 11** with supply chain protection (`minimumReleaseAge`, overrides) 2. **Trivy** vulnerability + secret scanner via GitLab CI 3. **Weekly scheduled pipeline** (Monday 8am Madrid) with HTML email report 4. **Composer audit** for PHP/Laravel projects 5. **Gmail SMTP** delivery via GitLab CI/CD variables --- ## Step 1 — pnpm 11 Supply Chain ### `pnpm-workspace.yaml` (create or update) ```yaml # WARNING: single-package repos do NOT need a `packages:` block on pnpm 11. # BUT on pnpm 9 (Vercel default for older projects) the mere presence of this # file REQUIRES a non-empty `packages:` or install dies with # "packages field missing or empty". If targeting pnpm 9, add `packages: ['.']`. minimumReleaseAge: 4320 # packages must be 72h old before install (minutes) # Block transitive deps from git repos / raw tarball URLs (needs pnpm 10.26+, # silently inert below). See supply-chain-security skill for the full checklist. blockExoticSubdeps: true # Allowlist for postinstall/build scripts. pnpm 10+ blocks AL