From 3c7dd62db707b5a7e12eaa5d70d19c9cc238b903 Mon Sep 17 00:00:00 2001 From: Valera Satsura Date: Sun, 12 Jul 2026 09:53:14 +0300 Subject: [PATCH 1/2] Clear the image entrypoint in the GitLab template --- templates/gitlab-ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/templates/gitlab-ci.yml b/templates/gitlab-ci.yml index 9037d9d..bd114e0 100644 --- a/templates/gitlab-ci.yml +++ b/templates/gitlab-ci.yml @@ -23,7 +23,12 @@ # unchanged code, so pushes alone never surface them. .cerberus: - image: ghcr.io/startmatter/cerberus:latest + image: + name: ghcr.io/startmatter/cerberus:latest + # The runner starts the job through a shell, so the image's own entrypoint + # must step aside — otherwise it receives the shell's flags as arguments + # and the job dies with "Unknown option '-c'". + entrypoint: [""] variables: # Full history: changed-file detection diffs against the previous commit. GIT_DEPTH: "0" From 7609d542fae823bfab8331f9d5058aff199209d3 Mon Sep 17 00:00:00 2001 From: Valera Satsura Date: Sun, 12 Jul 2026 11:00:02 +0300 Subject: [PATCH 2/2] Run in .post so projects with custom stages keep working --- templates/gitlab-ci.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/templates/gitlab-ci.yml b/templates/gitlab-ci.yml index bd114e0..cc012de 100644 --- a/templates/gitlab-ci.yml +++ b/templates/gitlab-ci.yml @@ -41,11 +41,13 @@ cerberus: extends: .cerberus - stage: test + # `.post` exists in every pipeline, whatever stages the project defines — + # a hardcoded stage breaks the projects that do not happen to have it. + stage: .post # Opt in by defining a scheduled pipeline with SECURITY_NIGHTLY=true. cerberus:nightly: extends: .cerberus - stage: test + stage: .post rules: - if: $CI_PIPELINE_SOURCE == "schedule" && $SECURITY_NIGHTLY == "true"