Gitpod

Ephemeral cloud workspaces. Full support; worth pre-installing in the image.

Gitpod workspaces run the extension host next to your files, so every feature works.

The thing that matters in Gitpod is that workspaces are ephemeral. Anything not in the image is fetched again each time you start one.

Install for one workspace

Extensions view, search Vulnetix. Gitpod uses Open VSX.

Install for everyone, every time

# .gitpod.yml
image:
  file: .gitpod.Dockerfile

vscode:
  extensions:
    - vulnetix.vulnetix

tasks:
  - name: vulnetix
    init: curl -fsSL https://cli.vulnetix.com/install.sh | sh

Better still, bake the CLI into the image so it is not re-downloaded per workspace:

# .gitpod.Dockerfile
FROM gitpod/workspace-full
RUN curl -fsSL https://cli.vulnetix.com/install.sh | sudo sh -s -- --install-dir /usr/local/bin

Credentials

Two options, and the choice depends on whether the workspace is shared.

Interactive, per workspace. Run Vulnetix: Sign In and approve in a browser tab. Fine for personal workspaces; it has to be repeated per workspace because the credential lives in the workspace’s secret storage.

A Gitpod environment variable, for a workspace many people or many sessions use:

gp env VULNETIX_API_TOKEN=...

The extension picks it up automatically. Use a service-account credential rather than a personal one: an environment variable is visible to every process in the workspace and to anyone with access to it.

Prebuilds

A prebuild can run the first scan so results are ready when the workspace opens:

tasks:
  - name: vulnetix
    init: |
      curl -fsSL https://cli.vulnetix.com/install.sh | sh
      vulnetix scan --path . || true

|| true matters: vulnetix scan exits non-zero when the quality gate is breached, and a failing prebuild over an existing vulnerability is rarely what you want.