Repositories

Most repositories arrive automatically. When a project is activated, the repositories provisioned during onboarding are synced from the project's GitLab group(s) and registered here — along with their containers — with no manual step.

You can also manage the list directly:

• Add Repository — Create a new repository from a template. The template matches the project type: code repositories for code projects, container-upload repositories for upload projects (each container-upload repo automatically appears as a container).
• Associate Existing Repository — Link a repository that already exists in GitLab (from the Add Repository split-button menu).
• Sync Repositories — Reconcile the list with live GitLab: add newly created repositories, mark deleted ones, and refresh metadata. Archived GitLab repositories are excluded.

Hiding and Removing

• Hide a repository to keep it in the project but out of the default list (toggle with Show N hidden).
• Remove a repository to disassociate it from the project (toggle with Show N removed). Removing does not delete anything in GitLab, and a removed repository will not be re-added by a future sync. You can Restore it later.

Each repository is displayed as a row showing key information at a glance:

• Repository name — Links to the repository in GitLab.
• Default branch — The primary branch (e.g., main), shown as a chip.
• Pipeline status — The state of the latest pipeline (success, failed, running, etc.).
• Security scan indicator — A shield icon showing whether the latest pipeline ran a Trivy scan and its result (clean, vulnerabilities found, or no scan).
• Open merge requests — A count of open MRs, clickable to view them in GitLab.
• Description and last activity from GitLab.

Repositories are grouped into collapsible sections by their GitLab subgroup (folder path).

Repository Status

IronSled tracks the accessibility of each repository:

Non-active repositories display a status badge and an error message, and remain listed so the team is aware. Hidden and removed repositories carry their own badges.

• Search — Filter repositories by name (case-insensitive).
• Pipeline status filter — Success, Failed, Running, or Pending.
• Security filter — Scan Passed, Scan Failed, or No Scan.
• Sort by — Name, Last Activity, or Created Date, ascending or descending.

A repository count badge shows how many match the current filters.

A Latest Release Tags panel summarizes the most recent release across the project's repositories. Click Load to populate it (or Refresh to update). For each repository it shows:

• The latest release tag and how long ago it was cut.
• Pipeline and security status for that release.
• A count of unreleased commits since the latest tag.

For monorepos that build multiple containers, release tags are broken down per component, so each published component shows its own latest tag and unreleased-commit count.

Each repository has an expandable Branches section showing the most recently active branches, sorted by last commit date. For each branch:

• Branch name — With a lock icon if protected.
• Last commit date.
• Compare — Opens a comparison against the default branch in GitLab.

A branch/tag selector in the CI/CD area lets you switch refs; the default branch is starred and tags are marked with a tag icon. Selecting a different ref reloads its pipeline history.

Expanding CI/CD Pipelines shows the pipeline history for the selected branch or tag.

Latest Pipeline

• Pipeline status — success, failed, running, pending, canceled, created, manual, scheduled.
• Security scan status — Whether a Trivy scan ran and its result.
• View pipeline / Security / SBOM — Links to the pipeline, the scan report, and the SBOM in GitLab.

Recent Runs

The five most recent runs are listed compactly with the pipeline ID, status icon, security indicator, timestamp, and View/Security buttons.

Pipeline Statuses

IronSled integrates with Trivy, which runs as part of the CI/CD pipeline. When a pipeline includes a Trivy scan job (scan_container_trivy), IronSled extracts and displays the results.

Vulnerability Summary

Viewing the Full Scan Report

1. Click the Security button on a pipeline.
2. A dialog shows the full Trivy container scanning report.
3. Each vulnerability lists its CVE identifier, affected package, installed version, fixed version (if available), and severity.

Reports are pulled from the pipeline artifact (gl-container-scanning-report.json); if the artifacts have expired, the report is unavailable.

Project-Level Security Aggregation

At the project dashboard level, IronSled aggregates vulnerability data across all active repositories. The Pipeline Vulnerabilities KPI shows the total across all repos with a severity breakdown — a single view of the project's security posture.

When a Trivy scan runs, it also generates a Software Bill of Materials in CycloneDX format documenting every component, dependency, and library in the image.

1. Click the SBOM button on a pipeline that includes a Trivy scan.
2. A dialog shows the component inventory — packages, versions, licenses, and dependency relationships.

The SBOM is sourced from the pipeline artifact (gl-sbom-scanning-report.json) and is only available while the artifacts have not expired.

The open merge request count is shown on each repository as a badge; clicking it opens the MR list in GitLab. Only open MRs are counted.

Several elements link directly to GitLab: the repository name, pipeline IDs / View pipeline, the MR count badge, Compare, Commits, and Contributors. All external links open in a new tab.

Repositories are kept current in three ways:

• Automatic sync on activation — repositories provisioned during onboarding register automatically when the project becomes active.
• Manual sync — the Sync Repositories button reconciles the list with live GitLab on demand (adds new, marks deleted, updates metadata, excludes archived).
• Per-load fetch — branches, pipelines, and merge request counts are fetched from GitLab when the section loads or when you switch branches, with independent loading states per repository.