Support ignoring build errors in Security Code Scan
With the upgrade of Security Code Scan to version 5.2.1 of the underlying analyzer, we should add support for the new --ignore-msbuild-errors parameter which will allow us to ignore build failures.
This should be managed by the existing FAIL_NEVER CI/CD variable. This variable is currently used by our SpotBugs analyzer for Java projects, and it makes sense to stay consistent with variable names.
Merge Requests
-
Implement support for --ignore-msbuild-errorsin Security Code Scan -
Determine if it skips modules/files that it cannot build, resulting in possible blind spots -
Update SAST documentation -
Optional - Utilize https://gitlab.com/gitlab-org/security-products/tests/dotnet5 to demonstrate a successful scan with FAIL_NEVERset, when it would fail otherwise.
Related to #338168 (closed).
Edited by rossfuhrman