Support ignoring build errors in Security Code Scan

With the upgrade of Security Code Scan to version 5.2.1 of the underlying analyzer, we should add support for the new --ignore-msbuild-errors parameter which will allow us to ignore build failures.

This should be managed by the existing FAIL_NEVER CI/CD variable. This variable is currently used by our SpotBugs analyzer for Java projects, and it makes sense to stay consistent with variable names.

Merge Requests

  • Implement support for --ignore-msbuild-errors in Security Code Scan
  • Determine if it skips modules/files that it cannot build, resulting in possible blind spots
  • Update SAST documentation
  • Optional - Utilize https://gitlab.com/gitlab-org/security-products/tests/dotnet5 to demonstrate a successful scan with FAIL_NEVER set, when it would fail otherwise.

Related to #338168 (closed).

Edited Jan 25, 2022 by rossfuhrman
Assignee Loading
Time tracking Loading