gitlab: scan CI/CD YAML in gl scan and add gl cicd scan command

[frjcomp]

• gl scan now also fetches each project's merged .gitlab-ci.yml via the CI lint API and scans it for secrets, in addition to job logs/artifacts
• add new gl cicd scan subcommand that only scans CI/CD YAML (no job logs/artifacts), reusing the existing scan/queue infrastructure via a CICDYamlOnly mode
• add unit and e2e test coverage for both changes

[Copilot]

Pull request overview

This PR extends Pipeleek’s GitLab scanning capabilities by adding CI/CD YAML scanning (via the GitLab CI Lint merged YAML output) to the existing gl scan flow, and introducing a dedicated gl cicd scan command that scans only the merged .gitlab-ci.yml (no job logs/artifacts), reusing the existing scan queue infrastructure.

Changes:

• Enqueue and scan each project’s merged CI/CD YAML during GitLab scans (new queue item type + analyzer).
• Add new gl cicd scan subcommand that runs in “CI/CD YAML only” mode.
• Add unit + e2e coverage for both the enhanced gl scan behavior and the new command.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/e2e/gitlab/scan/scan_test.go	Adds e2e coverage that gl scan hits ci/lint and detects a secret in merged YAML.
tests/e2e/gitlab/cicd/scan/scan_test.go	New e2e tests for gl cicd scan behavior (YAML-only, repo flag, required flags).
pkg/gitlab/scan/queue.go	Adds QueueItemCICDYaml handling and analysis pipeline for merged CI/CD YAML.
pkg/gitlab/scan/pipeline.go	Adds CICDYamlOnly option and enqueues CI/CD YAML scan items per project.
internal/cmd/gitlab/cicd/scan/scan.go	New Cobra command implementation for gl cicd scan.
internal/cmd/gitlab/cicd/scan/scan_test.go	New unit tests verifying flags/bindings and handler wiring for gl cicd scan.
internal/cmd/gitlab/cicd/cicd.go	Registers the new scan subcommand under gl cicd.

Suppressed comments (1)

pkg/gitlab/scan/queue.go:237

• Log message uses YML; consider standardizing to YAML for consistency with the rest of the code/docs.

	if err != nil {
		log.Debug().Err(err).Int("project", item.Meta.ProjectId).Msg("Failed detecting secrets in CI/CD YML")
		return

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.