Supply Chain Security
Supply Chain Security tests how GitLab controls what enters your build: third-party dependencies, container images, licenses, and the evidence you keep about them. The exam distinguishes caching, scanning, and attestation.
Dependency and image controls
The Dependency Proxy caches and serves upstream container images and packages so builds pull through GitLab rather than directly from the internet. It can reduce exposure to upstream outages and give a central point for retention, but it is not a vulnerability scanner. The container registry stores images built by pipelines; cleanup policies and immutable tags help control what can be deployed. Dependency Scanning checks libraries, Container Scanning checks images, and License Compliance evaluates licenses against a policy.
SBOM and evidence
GitLab can generate a CycloneDX SBOM from dependency scanning data and expose it in the pipeline and dependency list. The SBOM describes components and versions; it is not itself a list of vulnerabilities, though it supports vulnerability analysis. The dependency list shows detected components and their licenses. Keeping SBOMs and scan reports as pipeline artifacts provides evidence for audits.
Worked example
A team builds an image that installs npm packages. They route base images through the dependency proxy, run Dependency Scanning on the lockfile and Container Scanning on the built image, generate an SBOM, and apply a license policy that flags a copyleft license. The proxy controls retrieval; the scanners produce findings; the SBOM records components. None of these steps alone gives full supply chain assurance.
Traps
The dependency proxy does not scan what it caches. Dependency Scanning and Container Scanning cover different layers, and an image scan does not replace a lockfile scan. License Compliance is separate from vulnerability scanning. An SBOM is inventory, not a verdict. Also confirm which branch or pipeline produced the artifact you are relying on; a clean scan on an old commit says little about the current build.