Update Dependency Scanning CI/CD templates (stable and latest) to stop uploading a DS report artifact
Why are we doing this work
As part of the process to migrate to the Dependency Scanning using SBOM, we must "disable" the upload of Dependency Scanning report artifacts container security scan results from the analysis done within the Gemnasium CI jobs.
This ensure going forward all Dependency Scanning security analysis will be done using the GitLab SBOM Vulnerability Scanner, independently from which analyzer is used (Gemnasium or the new DS analyzer).
Though, to avoid disrupting some CI based workflows, we've decided to keep producing a JSON security report but upload it as a standard job artifact (artifacts:paths) which won't be processed by the security reoprt ingestion logic of our vulnerability management system.
Relevant links
Non-functional requirements
-
Documentation: -
Feature flag: -
Performance: -
Testing: