DOCS / GUIDES / GITLAB CI

Integrate CDK with GitLab CI

5 min read Requires: project maintainer access

This guide adds CDK to an existing GitLab CI/CD pipeline. By the end, every deployment will generate a signed attestation automatically — no changes to how your team ships code.

01 Add the job

CDK authenticates using GitLab's OIDC ID tokens, so no long-lived secrets are stored in your project. Add a job that runs after your deploy stage:

.gitlab-ci.yml

attest:
  stage: attest
  id_tokens:
    CDK_ID_TOKEN:
      aud: https://cdk.dev
  script:
    - cdk attest --policy release-policy-v3
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

02 Point it at a policy

The --policy flag references a policy you've already defined in CDK — the same one your Policy Engine evaluates on every deployment. If you haven't created one yet, CDK ships a permissive default so this step never blocks your first attestation.

03 What you get

On the next deployment, this job produces a signed node in your Evidence Graph automatically:

An attestation linking the deployment to its approving merge request
A verified identity for whoever triggered the pipeline
A policy evaluation result, pass or fail
A record visible immediately in the Enterprise console — no export required

Full example

A complete pipeline, including the deploy stage it runs alongside:

.gitlab-ci.yml

stages:
  - deploy
  - attest

deploy:
  stage: deploy
  script:
    - ./scripts/deploy.sh
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

attest:
  stage: attest
  needs: ["deploy"]
  id_tokens:
    CDK_ID_TOKEN:
      aud: https://cdk.dev
  script:
    - cdk attest --policy release-policy-v3
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

Next steps

Read the Trust Graph Specification→ See how this evidence maps to SOC 2→ Explore the Enterprise console→