Avoid duplicated security jobs when enforcing them via scan execution policy

Proposal

When we configure security jobs both by Scan Execution Policy and through the gitlab-ci.yml file of a project, security jobs are injected into the pipeline for each case. Due to higher resource consumption, efficiency and additional pipeline execution time, we would like to enforce the security jobs without duplicating them.

• We want to enforce SAST in the main branch, so we set the following policy.

name: Enforce SAST in master
description: Enforce SAST in master
enabled: true
actions:
- scan: sast
rules:
- type: pipeline
  branches:
  - main

• In the project's local gitlab-ci.yml configuration file, we have configured the security jobs through the GitLab template, which apply to all branches.

include:
  
  - template: Security/SAST.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml

• When we run the pipeline in main, we have a duplicate SAST jobs in the pipeline.

• Disable SAST for the main branch in the project's gitlab-ci.yml configuration file via workflow rules to avoid duplicated jobs.

workflow:
  rules:
    - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH
      variables:
        SAST_DISABLED: "true"  #

This could be replicated to other security scans.

Implementation plan

• documentation add information about possible duplicated scans when Scan Execution Policies are enforced,