Custom SAST jobs support

Following #5232 (closed), we could let the users use their own, custom docker images for SAST. For example, some users have issues with the current SAST image, as it requires docker:dind to work correctly. Therefore, they are running directly the new Java Maven image (https://gitlab.com/gitlab-org/gitlab-ee/issues/5232#note_68246830), by naming the job sast. While this is working fine, it's limiting the options to only one job (Java Maven in this case).

This issue is to allow users to create sast:<custom job name> jobs.

Requirements:

  • The job name is a convention, and must start with sast:
  • The job must create an artifact named gl-sast-report.json

Tasks:

  • Specify the format for gl-sast-report.json
  • Update backend to aggregate all artifacts in one report (this is transparent for FrontEnd).

Note: sast:container is going to disappear in %11.0, and the artifact won't match the required name, so it will be ignored silently for SAST.

Edited May 30, 2018 by Fabien Catteau
Assignee Loading
Time tracking Loading