Code Report

Code Report runs the security and dependency tools enabled for a project, then sends the results to GitOps. Use it locally or in CI to keep vulnerabilities, leaked credentials, licenses, and SBOM data connected to the service that produced them.

What Code Report scans

The project controls which tools a scan runs. Supported tools are:

Tool	Reports
Trivy	Vulnerabilities and license findings.
Syft	Software bill of materials and license data.
Gitleaks	Exposed credentials and other secrets.

Configure your project

Enable Code Report for the project, then choose the tools to run from Code Report > Settings > Tools. Create a project-scoped server key or API key with the required Code Report permission for the machine that runs scans.

Install the CLI on that machine:

npm install --global @getgitops/cli

Run a scan

Run the command from the repository root. Provide the Git metadata that identifies the revision being scanned:

gops creport scan 
	--api-url https://cloud.getgitops.com/api 
	--api-key "$GOPS_API_KEY" 
	--service billing-service 
	--project core-platform 
	--git-branch main 
	--git-repo-url https://github.com/acme/billing-service 
	--git-author "Dev Name" 
	--git-version v1.2.0 
	--git-commit a1b2c3d4 
	--tags production payments

The CLI resolves the enabled tools for the service, executes each locally, and reports its state independently as in_progress, completed, or failed. Use gops creport scan --help to see all supported options.

Every option can also be supplied as an environment variable: API_URL, API_KEY, SERVICE, PROJECT, GIT_BRANCH, GIT_REPO_URL, GIT_AUTHOR, GIT_VERSION, GIT_COMMIT, and TAGS.

Review the results

Open Code Report in your project to inspect the dashboard, scan history, service-level reports, CVEs, and security policies. Each scan is linked to the service and Git revision provided to the CLI, making it possible to compare results across deployments.