Configure security features in Auto DevOps
Description
Users can tune Auto DevOps to skip security checks by setting environment variables. We should create the option to automatically tune them in the Application Control Panel (https://gitlab.com/gitlab-org/gitlab-ce/issues/38542) as well, so defining the security policy will be very easy.
Proposal
Add a set of checkboxes in the Application Control Panel to enable/disable security features.
Something like this:
-
Enable Security Tests -
Enable SAST -
Enable Dependency Scanning -
Enable Container Scanning -
Enable DAST
-
Everything is on
by default, users can turn off
specific features or the whole security suite if they want. This will set/unset environment variables.
Edited by Fabio Busatto