Ticket Sync with GitLab and openCode
DevGuard can open a GitLab issue for every dependency vulnerability above a threshold and keep it in sync. This works out of the box on gitlab.com and gitlab.opencode.de.
Steps
Invite the DevGuard bot
In your GitLab project go to Manage → Members and invite the bot user with the Reporter role.
| Instance | Bot user | User ID |
|---|---|---|
| gitlab.opencode.de | devguard | 9457 |
| gitlab.com | devguard-bot | 28777095 |
Add a webhook
In your GitLab project go to Settings → Webhooks and click Add new webhook. Use the URL of your DevGuard instance:
| DevGuard instance | Webhook URL |
|---|---|
| devguard.opencode.de | https://api.devguard.opencode.de/api/v1/webhook/ |
| devguard.org | https://api.devguard.org/api/v1/webhook/ |
| Self hosted | https://<your api host>/api/v1/webhook/ |
Select the triggers Issue events, Confidential issue events, Comments and Confidential comments. Keep SSL verification enabled and save.
Enable ticket sync in DevGuard
Open the repository settings in DevGuard, enable the reporting range and set a CVSS or risk threshold. See Configure Automatic Ticket Creation.
DevGuard now creates issues for vulnerabilities above the threshold. You can manage them with slash commands in issue comments.