Update the latest SAST Artifact URL across all Downstream Projects
Problem
After the recent migration to integration-test
based approach for all SAST Analyzers, the folder structure qa/expect
containing expected artifacts has changed in some of the Analyzer repositories. Since the scheduled QA jobs use the same set of artifacts to check against the scan results of downstream projects, it has caused some of the QA jobs to fail(ex).
Additionally, some downstream projects still refer to the unsupported analyzers artifact URL, ex: Go or JS downstream projects. Since the downstream projects' content rarely changes, the older artifacts worked fine.
Proposal
Update the artifact URL(SAST_REPORT_URL
) in .gitlab-ci.yml
in all the [downstream projects](downstream projects) pointing to the actual/latest report URL of respective analyzers.
Implementation Plan
Instead of checking for every analyzer's downstream projects, I've borrowed the list from the migration issue since the responsibilities have already been distributed. Some analyzers may not have changed qa/expect
folder structure and their downstream projects might be pointing to the right artifact URL -- we can mark them as checked with the same indication.
-
Semgrep -
go and c downstream projects @theoretick -
js downstream projects @vbhat161 -
python downstream projects @vbhat161 -
java downstream projects @vbhat161 -
csharp downstream projects @zrice
-
-
Kics downstream projects : @willmeek (gitlab-org/security-products/tests/terraform!3 (merged), gitlab-org/security-products/tests/ansible!7 (merged), gitlab-org/security-products/tests/cloudformation!3 (merged)) -
brakeman downstream projects: @vbhat161 -
kubesec downstream projects : @arpitgogia -
mobsf downstream projects @vbhat161 -
phpcs-security-audit downstream projects -
pmd-apex downstream projects @rossfuhrman -
security-code-scan downstream projects -
sobelow downstream projects @rossfuhrman -
spotbugs downstream projects @vbhat161 -
secrets downstream projects @theoretick
Future Scope?
Post complete migration to integration-test
, move the scheduled QA regression happening on the projects present in the qa/fixtures
folder of each Analyzer. It can lead to a single source against which both, Integration and QA Regression tests run.
/cc @willmeek