GitLab CI

Integrate Cloud Cost Analyzer into your GitLab CI/CD pipelines.

Recommended: CI/CD Component

The fastest path is the CCA CI/CD Component. Add two lines to your .gitlab-ci.yml and CCA runs the scan, publishes results.json, and renders findings inline in the merge-request Code Quality widget, no comment bot required:

# .gitlab-ci.yml
include:
  - component: $CI_SERVER_FQDN/dragon-fractal/cloud-cost-analyzer/ci/scan@1
    inputs:
      provider: aws
      mode: managed
      fail_on_critical: true

Define CCA_API_KEY (masked) and your cloud credentials under Settings > CI/CD > Variables.

Input	Default	Description
provider	aws	Cloud provider (aws, azure)
regions	(all default)	Comma-separated regions
mode	managed	Scan mode (managed needs CCA_API_KEY)
stage	test	Stage the scan job runs in
cca_version	latest	Released version to download
fail_on_critical	false	Fail the job on any Critical finding
job_name	cca-scan	Name of the generated job

The manual setups below still work if you prefer to wire the binary yourself.

Quick Start (manual setup)

Add this job to your .gitlab-ci.yml:

# .gitlab-ci.yml
cost-analysis:
  image: ubuntu:latest
  stage: test
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
    CCA_API_KEY: $CCA_API_KEY
  script:
    - apt-get update && apt-get install -y curl
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca
    - ./cca scan --provider aws --mode managed --output json > results.json
  artifacts:
    paths:
      - results.json
    expire_in: 1 week
  only:
    - main
    - schedules

Configuration

CI/CD Variables

Add these variables in Settings > CI/CD > Variables:

Variable	Protected	Masked	Description
AWS_ACCESS_KEY_ID	Yes	No	AWS access key
AWS_SECRET_ACCESS_KEY	Yes	Yes	AWS secret key
CCA_API_KEY	Yes	Yes	CCA API key

For Azure:

Variable	Protected	Masked	Description
AZURE_CLIENT_ID	Yes	No	Service principal client ID
AZURE_CLIENT_SECRET	Yes	Yes	Service principal secret
AZURE_TENANT_ID	Yes	No	Azure AD tenant ID
AZURE_SUBSCRIPTION_ID	Yes	No	Subscription to scan

Use Cases

Scheduled Pipeline

Run cost analysis on a schedule:

# .gitlab-ci.yml
stages:
  - analyze

cost-analysis:
  stage: analyze
  image: ubuntu:latest
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
    CCA_API_KEY: $CCA_API_KEY
  before_script:
    - apt-get update && apt-get install -y curl jq
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca
  script:
    - ./cca scan --provider aws --mode managed --output json > results.json
    - echo "Total savings identified:"
    - jq '.summary.total_monthly_savings' results.json
  artifacts:
    paths:
      - results.json
    expire_in: 30 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

Create a pipeline schedule at CI/CD > Schedules:

• Interval: 0 9 * * 1 (Weekly on Monday at 9am)
• Target branch: main

Merge Request Analysis

Add cost analysis to merge requests:

# .gitlab-ci.yml
stages:
  - test
  - analyze

cost-impact:
  stage: analyze
  image: ubuntu:latest
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
  before_script:
    - apt-get update && apt-get install -y curl jq
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca
  script:
    - ./cca scan --provider aws --output json > results.json
    - |
      SAVINGS=$(jq '.summary.total_monthly_savings' results.json)
      FINDINGS=$(jq '.findings | length' results.json)
      echo "## Cost Analysis Results" > cost-report.md
      echo "" >> cost-report.md
      echo "| Metric | Value |" >> cost-report.md
      echo "|--------|-------|" >> cost-report.md
      echo "| Findings | $FINDINGS |" >> cost-report.md
      echo "| Monthly Savings | \$$SAVINGS |" >> cost-report.md
  artifacts:
    paths:
      - results.json
      - cost-report.md
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

Multi-Cloud Analysis

Scan multiple cloud providers:

# .gitlab-ci.yml
stages:
  - analyze

.cca-setup: &cca-setup
  before_script:
    - apt-get update && apt-get install -y curl
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca

aws-analysis:
  <<: *cca-setup
  stage: analyze
  image: ubuntu:latest
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
    CCA_API_KEY: $CCA_API_KEY
  script:
    - ./cca scan --provider aws --mode managed
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

azure-analysis:
  <<: *cca-setup
  stage: analyze
  image: ubuntu:latest
  variables:
    AZURE_CLIENT_ID: $AZURE_CLIENT_ID
    AZURE_CLIENT_SECRET: $AZURE_CLIENT_SECRET
    AZURE_TENANT_ID: $AZURE_TENANT_ID
    AZURE_SUBSCRIPTION_ID: $AZURE_SUBSCRIPTION_ID
    CCA_API_KEY: $CCA_API_KEY
  script:
    - ./cca scan --provider azure --mode managed
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

Compliance Gate

Fail pipeline on critical findings:

# .gitlab-ci.yml
cost-compliance:
  stage: test
  image: ubuntu:latest
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
  before_script:
    - apt-get update && apt-get install -y curl jq
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca
  script:
    - ./cca scan --provider aws --output json > results.json
    - |
      CRITICAL=$(jq '[.findings[] | select(.severity == "Critical")] | length' results.json)
      echo "Critical findings: $CRITICAL"
      if [ "$CRITICAL" -gt 0 ]; then
        echo "ERROR: Critical cost findings detected!"
        jq '.findings[] | select(.severity == "Critical")' results.json
        exit 1
      fi
  allow_failure: false

Docker-Based Analysis

Use a pre-built Docker image:

# .gitlab-ci.yml
cost-analysis:
  image: dragonfractal/cca:latest
  stage: analyze
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
    CCA_API_KEY: $CCA_API_KEY
  script:
    - cca scan --provider aws --mode managed

Caching

Cache the CCA binary to speed up pipelines:

# .gitlab-ci.yml
cost-analysis:
  image: ubuntu:latest
  stage: analyze
  cache:
    key: cca-binary
    paths:
      - .cca/
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
  before_script:
    - apt-get update && apt-get install -y curl
    - |
      if [ ! -f .cca/cca ]; then
        mkdir -p .cca
        curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
        tar -xzf cca-linux-amd64.tar.gz -C .cca
      fi
  script:
    - .cca/cca scan --provider aws --mode managed

Parent-Child Pipelines

Trigger cost analysis from a parent pipeline:

# .gitlab-ci.yml (parent)
stages:
  - build
  - analyze

trigger-cost-analysis:
  stage: analyze
  trigger:
    include: ci/cost-analysis.gitlab-ci.yml
    strategy: depend
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# ci/cost-analysis.gitlab-ci.yml
stages:
  - analyze

aws-scan:
  stage: analyze
  image: ubuntu:latest
  variables:
    AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
    AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
    AWS_REGION: us-east-1
    CCA_API_KEY: $CCA_API_KEY
  script:
    - apt-get update && apt-get install -y curl
    - curl -LO https://releases.dragonfractal.com/cca/latest/cca-linux-amd64.tar.gz
    - tar -xzf cca-linux-amd64.tar.gz
    - chmod +x cca
    - ./cca scan --provider aws --mode managed --output json > results.json

Next Steps

• GitHub Actions - GitHub Actions integration
• Jenkins - Jenkins pipeline integration
• CLI Reference - Full CLI documentation