ansible-lint export to sast, convert_to_sast fails to parse location output

Summary

When convert_to_sast enabled for ansible-lint it can produce reports which are not parsed by Gitlab. The report contains locations with position information that is not handled by convert_to_sast and generates start_line and end_line values gthat are null.

Steps to reproduce

Create a project with ansible code that causes linting issues that results in positional information being included in the results:

---
- name: test for linting
  ansible.builtin.debug:
    msg: This is a test again

Include the following action in your pipeline .gitlab-ci.yml:

---
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'

include:
  - component: $CI_SERVER_FQDN/components/code-quality-oss/codequality-os-scanners-integration/ansible-lint@1.1.5
    inputs:
      stage: test
      convert_to_sast: true
      ansible_lint_args: '-v'

Create MR to trigger the pipeline and see that the ansible-lint job is failed and that the ansible-lint-code_quality_to_sast is passed.

On the pipeline select the security tab and see that errors are displayed:

image.png

Example Project

ansible-lint-example

What is the current bug behavior?

  • Errors are displayed in the Security tab.
  • Details of findings are not displayed in Scan details section.

What is the expected correct behavior?

  • Not errors are seen
  • Details of all findings are displayed in the Scan details section
  • For example when there are ansible-lint issues but no positional information it works as expected:

image.png

Relevant logs and/or screenshots

See screenshots above.

The example project has example output from different stages of the process reproduced locally.

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

N/A

Results of GitLab application Check

N/A

Possible fixes

Fix in or around this section of code to handle positional information in the location.

Edited by James H.