Skip to main content

GitLab CI

GitLab does not use Moatgator's OIDC exchange, so authenticate with an API key.

1. Store the key​

In Settings → CI/CD → Variables, add MOATGATOR_API_KEY with the value mg_live_… (scopes builds:write, builds:read). Turn on Mask variable and Protect variable, so it is only exposed to protected branches and tags.

2. Add the job​

.gitlab-ci.yml
moatgator:
  stage: deploy
  image: node:22-bookworm-slim
  rules:
    - if: $CI_COMMIT_TAG =~ /^v/ # tags only, never merge requests from forks
  needs: ["build_release"] # the job that produces the .aab
  script:
    - npx moatgator validate
    - npx moatgator scan app/build/outputs/bundle/release/app-release.aab --min-grade C
    - npx moatgator protect app/build/outputs/bundle/release/app-release.aab --app-version "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA"

The build job must expose the artifact:

build_release:
  stage: build
  script: ./gradlew bundleRelease
  artifacts:
    paths: ["app/build/outputs/bundle/release/*.aab"]

Notes​

  • A protected variable is only available on protected refs; mark v* as a protected tag pattern.
  • Exit codes are in the CI overview: a non-zero code fails the job.
  • Self-managed runners without internet access need api.moatgator.com allowed (or set MOATGATOR_API_URL).