[predictor2718]

Closes #24.

What changed

A new page, /gitlab-ultimate/ ("GitLab Ultimate: vulnerability report and policies"). The reports page links to it from the GitLab SAST section. It is in the sitemap, but not in the header nav.

1. SAST report: four screenshots from the test project glsec-io/ultimate-lab:

   • the vulnerability report
   • one vulnerability's detail page
   • the merge request security widget
   • the merge request Reports tab

   Below them is the line-shift limitation: GitLab matches findings by file and line, so a shifted line shows as fixed and new at once. A tracking signature didn't change that in the test.

2. Pipeline execution policy: both files (policy.yml and glsec-policy.yml with rules: - when: always, no_repo_config, no_ignores), plus what happened in the test:

   • .pipeline-policy-pre skips the project's jobs when the policy job fails.
   • A .glsec.yml or # glsec:ignore in a merge request has no effect.
   • The component reference needs the v of the tag.
   • A project job with the same name gets the policy job renamed.
   • The policy adds extra branch pipelines.

   The component reference and the glsec version are filled in from the build, the same way as in the reports page's publishing jobs, so the example follows each release. The text matches the component README, which the page links.

3. Scan execution policy and GL082: SAST_DISABLED doesn't switch off a policy-enforced SAST job (tested on 2026-10-27), with a link to /rules/GL082/#scan-execution-policies.

Screenshots

• Source: taken by hand on 2026-10-27, logged in, from the test project.
• Cropped: the GitLab sidebar and top bar (logo, avatars), the GitLab Duo review comment and the reviewer list are cut off. No logo is used as decoration.
• No link: visitors who aren't project members get a 404 for the vulnerability report and no security widget in the merge request, so the figures don't link to GitLab.
• Format: the four images are from before glsec 1.25.0's native --format gitlab-sast. The only visible difference is that 1.25.0 also lists the CWE as an identifier. The first caption says so.

Wording on GitLab

• The page says glsec is independent and not affiliated with or endorsed by GitLab.
• The footer says "GitLab is a trademark of GitLab Inc." and links GitLab's docs for the tiers.
• I checked the GitLab for Open Source Program Agreement (revision 2022-08-19). It says nothing about screenshots. 3.2(e) forbids publishing performance information or benchmarks of GitLab, which this page doesn't do. It grants no trademark rights, so the page only uses the name to describe the integration.

Checks

• go test ./..., including the SEO test.
• html-validate, stylelint, and axe (0 violations).
• Lighthouse locally: accessibility and SEO 100. Performance swings between 75 and 100 on my machine, and /reports/ swings the same way; the page has no script.
• /gitlab-ultimate/ added to .github/site-checks/pages.txt.
• The test fixtures got a minimal GL082 doc for the link check, and the rule counts in two tests were adjusted.

How to test

go test ./...
./scripts/build.sh
python3 -m http.server -d _site 8000   # http://localhost:8000/gitlab-ultimate/