DependencyTrack / DependencyTrack/dependency-track

Native GitLab integration for automatic discovery of registries

Open
#5,713 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency-Track does not provide any native integration with GitLab Package Registry.

When using GitLab-hosted PyPI registries, all repositories must be managed externally through custom automation:

The GitLab REST API is queried to enumerate all accessible groups.

For each group, the following endpoint must be called to detect the presence of a PyPI registry:
`GET /api/v4/groups/:id/packages?package_type=pypi`

For each group exposing at least one PyPI package, a repository must be created or updated manually in Dependency-Track using:
`PUT /api/v1/repository`

Obsolete repositories must be deleted explicitly via:
`DELETE /api/v1/repository/:uuid`

when groups are removed or when credentials are rotated.

This leads to:
* A mandatory external synchronization layer implemented in CI/CD.
* A large number of individually managed repository definitions and credentials.

There is currently no built-in mechanism in Dependency-Track to:
* Discover GitLab-hosted package registries automatically.
* Periodically resynchronize repositories with a GitLab instance.
* Manage GitLab credentials and repository lifecycle in a centralized manner.

As a result, maintaining GitLab PyPI registries in Dependency-Track requires continuous custom automation outside of Dependency-Track.

### Proposed Behavior

Dependency-Track should provide a native integration with GitLab Package Registry to manage package repositories automatically.

Specifically, Dependency-Track should be able to:

* Connect to a GitLab instance using API token.
* Discover available package registries automatically by querying GitLab APIs.
* Support filtering by:
* Package type (e.g. PYPI, NPM, Maven)
* Group or namespace scope
* Create, update, and delete Dependency-Track repositories automatically based on the current state of GitLab.
* Periodically resynchronize repositories to:
* Add newly created GitLab registries
* Remove registries that no longer exist
* Refresh credentials when tokens are rotated

This integration could be exposed as:

* A new **Repository Connector** for GitLab in the Dependency-Track UI.
* A background synchronization job with configurable schedule.
* A configuration allowing:
* GitLab base URL
* API token
* Package types to import
* Optional group include/exclude filters

With this behavior:

* No external CI/CD automation would be required to keep repositories in sync.
* Repository lifecycle and credentials would be managed centrally by Dependency-Track.
* Large GitLab instances with many groups and registries could be handled reliably and consistently.

This would align GitLab Package Registry integration with existing native integrations and significantly reduce operational complexity for users relying on GitLab-hosted package registries.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.