IaC SAST job is hard to use because of its base job

Summary

Problem

It's not possible to re-use the SAST IaC scanner if the user does not have a stage named test

Context

The IaC scanner consists of 2 templates and 2 jobs:

  • Security/SAST-IaC.latest.gitlab-ci.yml
    • it does nothing, just includes the other template (why does it exist?)
  • Jobs/SAST-IaC.latest.gitlab-ci.yml
    • iac-sast - the base job
    • kics-iac-sast - a higher level job that extends the base job

The stage: test is defined on the base job. As it is a real job, the CI validation will always fail.

Steps to reproduce

  1. Start a new project
  2. Set up CI as in https://gitlab.com/nagyv-gitlab/sast-iac-customization

Example Project

https://gitlab.com/nagyv-gitlab/sast-iac-customization

What is the current bug behavior?

CI validation fails because of the base job

What is the expected correct behavior?

CI validation should pass

Relevant logs and/or screenshots

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes