Takumi Guard Now Officially Supports GitLab CI/CD

Takumi Guard now officially supports GitLab CI/CD on GitLab.com. In addition to GitHub Actions, by signing in to Shisho Cloud as a bot with OIDC authentication from GitLab CI/CD jobs, without long-lived secrets, package downloads through Takumi Guard are now recorded in your organization's installation logs.

Overview

A GitLab CI/CD job authenticates to Shisho Cloud as a bot using OIDC. The ID token is verified against the bot's GitLab CI/CD trust condition, and on success a short-lived access token is issued. No API keys or tokens need to be stored in your CI environment.

You could already use Takumi Guard from GitLab CI/CD as a bot, but the details were not recorded. Now, as with GitHub Actions, package downloads made with this access token are recorded in your organization's installation logs.

It works with all ecosystems: npm, PyPI, RubyGems, Go modules, and Packagist.

Getting Started

First, create a bot in Shisho Cloud and set up a GitLab CI/CD trust condition for the target project. The trust condition matches on the project path. See Bot authentication for how to set it up.

Next, add steps to your job in .gitlab-ci.yml that sign in as the bot with shishoctl, obtain an access token, and configure your package manager with it. For npm, the job looks like this:

build:
  image: node:22-bookworm
  id_tokens:
    ID_TOKEN:
      aud: https://gitlab.com
  variables:
    SHISHOCLOUD_BOT_ID: "BT01EXAMPLE..." # Copy from Shisho Cloud console
  before_script:
    # Install shishoctl
    - SHISHOCTL_URL="https://shisho.dev/releases/shishoctl-0.15.0-x86_64-unknown-linux-gnu"
    - curl -L $SHISHOCTL_URL -o /usr/local/bin/shishoctl
    - chmod +x /usr/local/bin/shishoctl

    # Sign in (as bot) and take the access token
    - shishoctl auth signin:bot
      --bot ${SHISHOCLOUD_BOT_ID}
      <<< ${ID_TOKEN}
      --expires-in-minutes 30 # Default 30 (max 1440). Adjust to your job
    - export ACCESS_TOKEN="$(shishoctl auth print-access-token)"

    # Use the access token for npm
    - npm config set registry https://npm.flatt.tech/
    - npm config set //npm.flatt.tech/:_authToken "$ACCESS_TOKEN"
  script:
    - npm install
    - npm test

The access token expires after 30 minutes by default (configurable up to 24 hours via --expires-in-minutes).

For how to write the job, including for other ecosystems, see the GitLab CI/CD tab in the CI/CD section of each quickstart:

• npm
• PyPI
• RubyGems
• Go modules
• Packagist