# Takumi Guard Now Officially Supports GitLab CI/CD

Takumi Guard now officially supports GitLab CI/CD on GitLab.com. In addition to GitHub Actions, by signing in to Shisho Cloud as a bot with OIDC authentication from GitLab CI/CD jobs, without long-lived secrets, package downloads through Takumi Guard are now recorded in your organization's installation logs.

![Takumi Guard now officially supports GitLab CI/CD](/docs/_md-assets/e0b17fa411-eyecatch.png)

## Overview {#overview}

A GitLab CI/CD job authenticates to Shisho Cloud as a bot using OIDC. The ID token is verified against the bot's GitLab CI/CD trust condition, and on success a short-lived access token is issued. No API keys or tokens need to be stored in your CI environment.

You could already use Takumi Guard from GitLab CI/CD as a bot, but the details were not recorded. Now, as with GitHub Actions, package downloads made with this access token are recorded in your organization's [installation logs](/docs/t/guard/features/installation-logs).

It works with all ecosystems: npm, PyPI, RubyGems, Go modules, and Packagist.

## Getting Started {#getting-started}

First, create a bot in Shisho Cloud and set up a GitLab CI/CD trust condition for the target project. The trust condition matches on the project path. See [Bot authentication](/docs/c/bot/authentication#gitlab-ci-oidc) for how to set it up.

Next, add steps to your job in `.gitlab-ci.yml` that sign in as the bot with shishoctl, obtain an access token, and configure your package manager with it. For npm, the job looks like this:

```yaml
build:
  image: node:22-bookworm
  id_tokens:
    ID_TOKEN:
      aud: https://gitlab.com
  variables:
    SHISHOCLOUD_BOT_ID: "BT01EXAMPLE..." # Copy from Shisho Cloud console
  before_script:
    # Install shishoctl
    - SHISHOCTL_URL="https://shisho.dev/releases/shishoctl-0.15.0-x86_64-unknown-linux-gnu"
    - curl -L $SHISHOCTL_URL -o /usr/local/bin/shishoctl
    - chmod +x /usr/local/bin/shishoctl

    # Sign in (as bot) and take the access token
    - shishoctl auth signin:bot
      --bot ${SHISHOCLOUD_BOT_ID}
      <<< ${ID_TOKEN}
      --expires-in-minutes 30 # Default 30 (max 1440). Adjust to your job
    - export ACCESS_TOKEN="$(shishoctl auth print-access-token)"

    # Use the access token for npm
    - npm config set registry https://npm.flatt.tech/
    - npm config set //npm.flatt.tech/:_authToken "$ACCESS_TOKEN"
  script:
    - npm install
    - npm test
```

The access token expires after 30 minutes by default (configurable up to 24 hours via `--expires-in-minutes`).

For how to write the job, including for other ecosystems, see the GitLab CI/CD tab in the CI/CD section of each quickstart:

- [npm](/docs/t/guard/quickstart/npm#setup-ci)
- [PyPI](/docs/t/guard/quickstart/pypi#setup-ci)
- [RubyGems](/docs/t/guard/quickstart/rubygems#setup-ci)
- [Go modules](/docs/t/guard/quickstart/golang#setup-ci)
- [Packagist](/docs/t/guard/quickstart/packagist#setup-ci)