schema.json

{
  "schema": {
    "name": "GitLabHound",
    "display_name": "GitLab (GitLabHound)",
    "version": "v0.0.1",
    "namespace": "GL"
  },
  "node_kinds": [
    {
      "name": "GL_AccessToken",
      "display_name": "Access Token",
      "description": "Base type for GitLab access tokens",
      "is_display_kind": true,
      "icon": "key",
      "color": "#F5A623"
    },
    {
      "name": "GL_Bot",
      "display_name": "GitLab Bot",
      "description": "GitLab bot / service account",
      "is_display_kind": true,
      "icon": "robot",
      "color": "#FF8E40"
    },
    {
      "name": "GL_Branch",
      "display_name": "GitLab Branch",
      "description": "A branch within a repository",
      "is_display_kind": true,
      "icon": "code-branch",
      "color": "#FF80D2"
    },
    {
      "name": "GL_Group",
      "display_name": "GitLab Group",
      "description": "GitLab group (namespace for projects and subgroups)",
      "is_display_kind": true,
      "icon": "user-group",
      "color": "#C06EFF"
    },
    {
      "name": "GL_GroupAccessToken",
      "display_name": "Group Access Token",
      "description": "Access token scoped to a specific GitLab group",
      "is_display_kind": true,
      "icon": "key",
      "color": "#F5A623"
    },
    {
      "name": "GL_GroupRole",
      "display_name": "Group Role",
      "description": "Permission role within a specific group (Minimal Access, Guest, Planner, Reporter, Developer, Maintainer, Owner, or custom)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#D0B0FF"
    },
    {
      "name": "GL_GroupVariable",
      "display_name": "Group CI/CD Variable",
      "description": "CI/CD variable defined at group scope",
      "is_display_kind": true,
      "icon": "sliders",
      "color": "#E63946"
    },
    {
      "name": "GL_Instance",
      "display_name": "GitLab Instance",
      "description": "The GitLab instance being analyzed",
      "is_display_kind": true,
      "icon": "building",
      "color": "#5FED83"
    },
    {
      "name": "GL_InstanceRole",
      "display_name": "Instance Role",
      "description": "Instance-level permission role (Unauthenticated, External, Member, or Administrator)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#BFFFD1"
    },
    {
      "name": "GL_InstanceVariable",
      "display_name": "Instance CI/CD Variable",
      "description": "CI/CD variable defined at instance scope",
      "is_display_kind": true,
      "icon": "sliders",
      "color": "#E63946"
    },
    {
      "name": "GL_Job",
      "display_name": "GitLab Job",
      "description": "An individual job within a pipeline",
      "is_display_kind": true,
      "icon": "gear",
      "color": "#B388FF"
    },
    {
      "name": "GL_JobArtifact",
      "display_name": "Job Artifact",
      "description": "Artifact archive produced by a job",
      "is_display_kind": true,
      "icon": "file-zipper",
      "color": "#8ED1B2"
    },
    {
      "name": "GL_JobLog",
      "display_name": "Job Log",
      "description": "Execution trace / log of a job",
      "is_display_kind": true,
      "icon": "scroll",
      "color": "#A3A3A3"
    },
    {
      "name": "GL_LeakedSecret",
      "display_name": "Secret",
      "description": "A credential or secret value discovered in the GitLab instance (e.g. in CI/CD variables or job logs)",
      "is_display_kind": true,
      "icon": "key",
      "color": "#FFC800"
    },
    {
      "name": "GL_PersonalAccessToken",
      "display_name": "Personal Access Token",
      "description": "Personal access token belonging to a GitLab user",
      "is_display_kind": true,
      "icon": "key",
      "color": "#F5A623"
    },
    {
      "name": "GL_Pipeline",
      "display_name": "GitLab Pipeline",
      "description": "A CI/CD pipeline run",
      "is_display_kind": true,
      "icon": "angles-right",
      "color": "#6EC6FF"
    },
    {
      "name": "GL_PipelineSchedule",
      "display_name": "Pipeline Schedule",
      "description": "A scheduled trigger for pipelines",
      "is_display_kind": true,
      "icon": "clock-rotate-left",
      "color": "#FFD166"
    },
    {
      "name": "GL_PipelineVariable",
      "display_name": "Pipeline Schedule Variable",
      "description": "Variable defined in a pipeline schedule",
      "is_display_kind": true,
      "icon": "sliders",
      "color": "#E63946"
    },
    {
      "name": "GL_Project",
      "display_name": "GitLab Project",
      "description": "GitLab project",
      "is_display_kind": true,
      "icon": "diagram-project",
      "color": "#009CE0"
    },
    {
      "name": "GL_ProjectAccessToken",
      "display_name": "Project Access Token",
      "description": "Access token scoped to a specific GitLab project",
      "is_display_kind": true,
      "icon": "key",
      "color": "#F5A623"
    },
    {
      "name": "GL_ProjectRole",
      "display_name": "Project Role",
      "description": "Permission role within a specific project (Minimal Access, Guest, Planner, Reporter, Developer, Maintainer, or Owner)",
      "is_display_kind": true,
      "icon": "user-tie",
      "color": "#DEFEFA"
    },
    {
      "name": "GL_ProjectVariable",
      "display_name": "Project CI/CD Variable",
      "description": "CI/CD variable defined at project scope",
      "is_display_kind": true,
      "icon": "sliders",
      "color": "#E63946"
    },
    {
      "name": "GL_Repository",
      "display_name": "GitLab Repository",
      "description": "Git repository associated with a project",
      "is_display_kind": true,
      "icon": "box-archive",
      "color": "#9EECFF"
    },
    {
      "name": "GL_Runner",
      "display_name": "GitLab Runner",
      "description": "A CI/CD runner that executes jobs",
      "is_display_kind": true,
      "icon": "gears",
      "color": "#FF4D4D"
    },
    {
      "name": "GL_RunnerManager",
      "display_name": "Runner Manager",
      "description": "A runner manager process (gitlab-runner agent)",
      "is_display_kind": true,
      "icon": "server",
      "color": "#FFB347"
    },
    {
      "name": "GL_SecureFile",
      "display_name": "Secure File",
      "description": "Secure file stored in a project",
      "is_display_kind": true,
      "icon": "file-shield",
      "color": "#E63946"
    },
    {
      "name": "GL_User",
      "display_name": "GitLab User",
      "description": "GitLab user account",
      "is_display_kind": true,
      "icon": "user",
      "color": "#FF8E40"
    },
    {
      "name": "GL_Variable",
      "display_name": "CI/CD Variable",
      "description": "Base type for CI/CD variables across all scopes",
      "is_display_kind": true,
      "icon": "sliders",
      "color": "#E63946"
    }
  ],
  "relationship_kinds": [
    {
      "name": "GL_ArchiveProject",
      "description": "Role can archive this project",
      "is_traversable": false
    },
    {
      "name": "GL_AssignedTo",
      "description": "Group runner is registered to / assigned to this group",
      "is_traversable": false
    },
    {
      "name": "GL_BuildsAsSystem",
      "description": "Pipelines on this branch run on a shell executor and execute as the runner manager's system user",
      "is_traversable": true
    },
    {
      "name": "GL_BuildsOn",
      "description": "Pipelines on this branch may execute on this runner",
      "is_traversable": false
    },
    {
      "name": "GL_CanAssumeIdentity",
      "description": "Pipelines on this branch can assume this Entra service principal identity via federated credentials",
      "is_traversable": true
    },
    {
      "name": "GL_CanCreateGroup",
      "description": "User or group role is allowed to create top-level groups or subgroups",
      "is_traversable": false
    },
    {
      "name": "GL_CanCreateProject",
      "description": "User or group role is allowed to create projects",
      "is_traversable": false
    },
    {
      "name": "GL_CanMerge",
      "description": "Role can merge merge requests into this branch",
      "is_traversable": true
    },
    {
      "name": "GL_CanPull",
      "description": "Role can pull/clone from this repository (including unauthenticated/member access to public/internal projects)",
      "is_traversable": false
    },
    {
      "name": "GL_CanPush",
      "description": "Role can push commits to this branch",
      "is_traversable": true
    },
    {
      "name": "GL_CanReadSecret",
      "description": "Role can read a secret",
      "is_traversable": true
    },
    {
      "name": "GL_CanRequestAccess",
      "description": "Instance members can request access to this group",
      "is_traversable": false
    },
    {
      "name": "GL_CanSignUp",
      "description": "Open registration is enabled; unauthenticated users can create an account (edge property require_admin_approval indicates whether the account requires admin approval before activation)",
      "is_traversable": false
    },
    {
      "name": "GL_CanUseRunner",
      "description": "Group or project is allowed to use this runner for its pipelines",
      "is_traversable": false
    },
    {
      "name": "GL_ContainsCredentialsFor",
      "description": "Node (CI/CD variable, job log, or artifact) contains credentials for the target secret",
      "is_traversable": true
    },
    {
      "name": "GL_Contributed",
      "description": "User opened, closed, or commented on issues or merge requests in this project",
      "is_traversable": false
    },
    {
      "name": "GL_Created",
      "description": "User created another user (admin action), a project, or triggered a pipeline",
      "is_traversable": false
    },
    {
      "name": "GL_Defines",
      "description": "Instance, group, project, or pipeline schedule defines this CI/CD variable",
      "is_traversable": true
    },
    {
      "name": "GL_DeleteProject",
      "description": "Role can delete this project",
      "is_traversable": false
    },
    {
      "name": "GL_Developed",
      "description": "User pushed code or merged / approved merge requests in this project",
      "is_traversable": false
    },
    {
      "name": "GL_DownloadJobArtifacts",
      "description": "Instance or project role can download job artifacts",
      "is_traversable": false
    },
    {
      "name": "GL_DownloadSecureFiles",
      "description": "Role can download secure files from this project",
      "is_traversable": false
    },
    {
      "name": "GL_ExecutedBy",
      "description": "Job was executed by this runner",
      "is_traversable": false
    },
    {
      "name": "GL_ForkedFrom",
      "description": "Project was forked from the target project",
      "is_traversable": false
    },
    {
      "name": "GL_HasBaseRole",
      "description": "Role subsumes all permissions of the lower role (permission hierarchy); also models instance Admin holding Owner in all top-level groups and user-owned projects",
      "is_traversable": true
    },
    {
      "name": "GL_HasBranch",
      "description": "Repository contains this branch",
      "is_traversable": false
    },
    {
      "name": "GL_HasGroup",
      "description": "Instance contains this top-level group",
      "is_traversable": false
    },
    {
      "name": "GL_HasJob",
      "description": "Pipeline contains this job",
      "is_traversable": false
    },
    {
      "name": "GL_HasPipeline",
      "description": "Project contains this pipeline run",
      "is_traversable": false
    },
    {
      "name": "GL_HasPipelineSchedule",
      "description": "Project has this pipeline schedule",
      "is_traversable": false
    },
    {
      "name": "GL_HasPrivilegeOf",
      "description": "Entity inherits the privileges of the target (e.g. a token with equivalent scope to a user)",
      "is_traversable": true
    },
    {
      "name": "GL_HasProject",
      "description": "Group namespace or user personal namespace owns this project",
      "is_traversable": false
    },
    {
      "name": "GL_HasRepo",
      "description": "Project has this associated git repository",
      "is_traversable": false
    },
    {
      "name": "GL_HasRole",
      "description": "User holds an instance/group/project role",
      "is_traversable": true
    },
    {
      "name": "GL_HasToken",
      "description": "Acess token defined by the respective entity (user, project, or group)",
      "is_traversable": false
    },
    {
      "name": "GL_HostedOn",
      "description": "Runner manager process is hosted on this Active Directory computer",
      "is_traversable": false
    },
    {
      "name": "GL_InheritRole",
      "description": "Subgroup role inherits from the equivalent parent group role, or a project role is inherited from the equivalent parent group role",
      "is_traversable": true
    },
    {
      "name": "GL_InviteGroups",
      "description": "Role can invite groups into this group or project",
      "is_traversable": false
    },
    {
      "name": "GL_InvitedTo",
      "description": "Group is shared/invited into another group or project",
      "is_traversable": true
    },
    {
      "name": "GL_IsToken",
      "description": "Variable or secret value is or contains a valid GitLab access token",
      "is_traversable": true
    },
    {
      "name": "GL_ManageDeployKeys",
      "description": "Role can manage deploy keys",
      "is_traversable": false
    },
    {
      "name": "GL_ManageMembers",
      "description": "Role grants permission to add/remove group or project members",
      "is_traversable": true
    },
    {
      "name": "GL_ManageProjectAccessTokens",
      "description": "Role can create and revoke project access tokens",
      "is_traversable": false
    },
    {
      "name": "GL_ManageProtectedBranches",
      "description": "Role can configure protected branch rules",
      "is_traversable": false
    },
    {
      "name": "GL_ManageProtectedTags",
      "description": "Role can configure protected tag rules",
      "is_traversable": false
    },
    {
      "name": "GL_ManageReleases",
      "description": "Role can create and manage releases",
      "is_traversable": false
    },
    {
      "name": "GL_ManageRunners",
      "description": "Role can enable/disable runners for this project",
      "is_traversable": false
    },
    {
      "name": "GL_ManageSecureFiles",
      "description": "Role can upload/delete secure files",
      "is_traversable": false
    },
    {
      "name": "GL_ManageVariables",
      "description": "Role can manage variables",
      "is_traversable": false
    },
    {
      "name": "GL_ManageWebHooks",
      "description": "Role can manage webhooks",
      "is_traversable": false
    },
    {
      "name": "GL_ManagedBy",
      "description": "Runner instance is managed by this runner manager process",
      "is_traversable": false
    },
    {
      "name": "GL_MemberOf",
      "description": "Subgroup belongs to the parent group, or a group role grants membership in the group",
      "is_traversable": true
    },
    {
      "name": "GL_Owns",
      "description": "User created and owns this pipeline schedule",
      "is_traversable": true
    },
    {
      "name": "GL_Produced",
      "description": "Job produced this artifact archive or execution log",
      "is_traversable": false
    },
    {
      "name": "GL_PushedTo",
      "description": "User pushed commits to this branch",
      "is_traversable": false
    },
    {
      "name": "GL_RenovateInviteAndTakeover",
      "description": "Renovate bot can invite itself to the target group or project and take over its resources",
      "is_traversable": true
    },
    {
      "name": "GL_RunCICD",
      "description": "Role can trigger CI/CD pipelines in this project",
      "is_traversable": false
    },
    {
      "name": "GL_RunsOn",
      "description": "Pipeline was run against this branch/ref",
      "is_traversable": false
    },
    {
      "name": "GL_SyncedTo",
      "description": "Entra or Active Directory user is linked / synced to this GitLab user via SSO (SAML, OAuth, OIDC, or LDAP)",
      "is_traversable": true
    },
    {
      "name": "GL_TransferProject",
      "description": "Role can transfer this project to another namespace",
      "is_traversable": false
    },
    {
      "name": "GL_Triggers",
      "description": "A branch push or pipeline schedule triggered this pipeline run",
      "is_traversable": false
    },
    {
      "name": "GL_ViewJobLogs",
      "description": "Instance or project role can view job logs",
      "is_traversable": false
    }
  ],
  "environments": [
    {
      "environment_kind": "GL_Instance",
      "source_kind": "GL_Base",
      "principal_kinds": [
        "GL_User",
        "GL_Group",
        "GL_Project",
        "GL_Repository",
        "GL_Branch"
      ]
    }
  ],
  "relationship_findings": []
}