Add input for Advanced SAST incremental scanning

Patrequested to merge
psa_ifm/sast:add-incremental-scan-input into main

What does this MR do and why?

Adds the run_advanced_sast_incremental_scan input, so component users can turn on incremental scanning for GitLab Advanced SAST. Today the component cannot offer it at all: the analyzer fetches its taint signature cache, ts-cache.sqlite.gz, from the job artifacts of a previous pipeline, and the component's gitlab-advanced-sast job does not store that file. By the documented mechanism, setting GITLAB_ADV_SAST_INCR_SCAN alone therefore never finds a cache.

  • New boolean input, default false, that sets GITLAB_ADV_SAST_INCR_SCAN.
  • ts-cache.sqlite.gz added to the job's artifact paths, as in the bundled Jobs/SAST.gitlab-ci.yml since gitlab-org/gitlab!228788 (merged).
  • No expire_in, following gitlab-org/gitlab!254613 (merged): it would expire the SAST report together with the cache.
  • Documented in the input description only, not in the README, following the review on !40 (merged).

!40 (comment 2851791488) considered reusing advanced_sast_partial_scan with a value like incremental. A separate boolean is proposed instead, because incremental scanning shipped as its own variable and combines with diff-based scanning, which a single string input could not express.

How was this validated?

Check Result
POST /projects/:id/ci/lint with include_merged_yaml, input true valid; GITLAB_ADV_SAST_INCR_SCAN: true, artifacts keep access: developer and reports:sast, paths gl-sast-report.json and ts-cache.sqlite.gz
Same, input omitted valid; GITLAB_ADV_SAST_INCR_SCAN: false, same artifacts
Pipeline run with the analyzer not done: I have no Ultimate project available to run Advanced SAST against this branch

So the cache retrieval itself (Failed to retrieve cache absent from the log on the second run) is not verified here. The change mirrors what the CI template already ships, but a run by someone with an Ultimate test project would close that gap.

Behaviour changes

  • Every Advanced SAST job now lists ts-cache.sqlite.gz as an artifact path. With the input off, the file is not produced and the job log shows a "no matching files" warning for it, as with the CI template.
  • The job always sets GITLAB_ADV_SAST_INCR_SCAN. A top-level variables: entry in a project's .gitlab-ci.yml no longer reaches the job, because the job-level value takes precedence; project or group CI/CD variables still override it. ADVANCED_SAST_PARTIAL_SCAN already behaves this way.

🤖 Generated with Claude Code

Merge request reports