Update Secure-Binaries template to exclude End of Support SAST analyzers by default

Problem

The Secure-Binaries.gitlab-ci.yml template used for offline environments still includes SAST analyzers that have reached End of Support status. According to the documentation, several analyzers have been deprecated and replaced by the Semgrep-based analyzer with GitLab-managed rules, including:

  • Bandit (End of Support in %15.4)
  • Brakeman (End of Support in %17.0)
  • ESLint (End of Support in %15.4)
  • Flawfinder (End of Support in %17.0)
  • gosec (End of Support in %15.4)
  • MobSF (End of Support in %17.0)
  • NodeJsScan (End of Support in %17.0)
  • phpcs-security-audit (End of Support in %17.0)
  • Security Code Scan (End of Support in %16.0)
  • SpotBugs (partial End of Support in %15.4 and %17.0, still supported for Groovy)
  • License-Finder (End of Support in %16.3)

The current template continues to download these deprecated analyzers by default, which is misleading for users and potentially causes them to rely on analyzers that no longer receive updates.

The Proposed Solution

Update the Secure-Binaries.gitlab-ci.yml template to:

  1. Remove deprecated analyzers from the default SECURE_BINARIES_ANALYZERS variable
  2. Add a comment in the template that clearly identifies which analyzers are officially supported
  3. Keep the individual job definitions for deprecated analyzers but mark them with comments indicating their End of Support status for backward compatibility

This will ensure customers are guided toward using only supported analyzers when setting up offline environments while maintaining backward compatibility for those who explicitly choose to use deprecated analyzers.

Implementation Plan

  1. Update the SECURE_BINARIES_ANALYZERS variable in the template to include only officially supported analyzers:

    SECURE_BINARIES_ANALYZERS: >-
  gitlab-advanced-sast, spotbugs, secrets, sobelow, pmd-apex, kics, kubesec, semgrep, gemnasium, gemnasium-maven, gemnasium-python, dependency-scanning, dast, dast-runner-validation, api-security

  2. Add a comment section before the variable definition explaining which analyzers are officially supported and which have reached End of Support

  3. Add comments to each deprecated analyzer job definition indicating its End of Support status. For example:

    # End of Support in GitLab 15.4
bandit:
  extends: .download_images
  ...
Edited by Adam Cohen