Pipeline is not triggered for the latest Secure template when using Scan Execution Policy

Summary

When a Scan Execution Policy is configured to use the latest template for a secure analyzer, like Secret Detection or SAST, neither the Branch nor Merge Request pipeline is triggered on commit changes.

Note:

• This behavior is tested on Secret Detection and SAST analyzers at this time.
• This behavior is observed only for projects without a .gitlab-ci.yml file where SEP implicitly creates one.

Steps to reproduce

1. Initialize a new or choose a project that doesn't have .gitlab-ci.yml file present in it. As per docs, security policies implicitly creates .gitlab-ci.yml for its reference.

2. Create a new Scan Execution Policy for Secret Detection analyzer using the latest template running for all branches.

   Example SEP

   scan_execution_policy:
   - name: Secret Detection using internal GitLab CI/CD Template
     description: Uses the latest secret detection CI template
     enabled: true
     rules:
     - type: pipeline
       branch_type: all
     actions:
     - scan: secret_detection
       template: latest
     skip_ci:
       allowed: true
       allowlist:
         users: []
   

3. Create a new branch and add a commit to it. Observe that the Branch pipeline does not trigger for secret detection.

4. Create a new Merge Request from the new branch against the default branch. Observe that the Merge Request pipeline does not trigger either. You may add subsequent commits to confirm the same behavior.

Example Project

• Sample Project
• Policy Project for the Sample Project

What is the expected correct behavior?

A Branch pipeline should trigger when a new commit is added to the branch whereas a Merge Request pipeline should trigger for merge requests.