Advanced SAST C/C++ (clangsa) documentation and template missing for offline deployments

Summary

When C/C++ support was added to GitLab Advanced SAST in 18.6 (epic &14271 (closed)), the offline mirroring template and offline documentation were not updated to include the new clangsa analyzer image. As a result, offline / air-gapped customers following the official Secure Binaries template today cannot run Advanced SAST on C/C++ — the gitlab-advanced-sast-cpp job will fail because the clangsa image is never mirrored into their registry.

Note for triage: #601776 already covers part of point (2) below (adding clangsa to the SAST docs page's image list). This issue captures the broader gap — particularly the Secure-Binaries template bug, which is not tracked anywhere. Feel free to split into separate issues as needed.

Steps to reproduce

  1. Set up an offline GitLab instance following Defining offline environments.
  2. Include the official Security/Secure-Binaries.gitlab-ci.yml template in your mirror project to download analyzer images.
  3. Enable Advanced SAST C/C++ analysis via GITLAB_ADVANCED_SAST_CPP_ENABLED: "true" per the Advanced SAST C/C++ docs.
  4. Run an Advanced SAST scan on a C/C++ project.

Current behavior

  • The gitlab-advanced-sast-cpp job tries to pull $SECURE_ANALYZERS_PREFIX/clangsa:1 from the local registry.
  • The image is not present — Secure-Binaries.gitlab-ci.yml never mirrored it.
  • Job fails; C/C++ Advanced SAST cannot run in offline environments.

Expected behavior

The official Secure Binaries template should mirror the clangsa image by default, and offline documentation should clearly list it as a required image for Advanced SAST C/C++.

Evidence

# Finding
1 lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml → gitlab-advanced-sast-cpp pulls $SECURE_ANALYZERS_PREFIX/clangsa:$SAST_ANALYZER_IMAGE_TAG (currently tag 1)
2 lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml has no clangsa job and clangsa is not in the default SECURE_BINARIES_ANALYZERS list
3 gitlab-advanced-sast (multi-language) is mirrored, but per docs it covers "all supported languages except C and C++" — C/C++ requires the separate GITLAB_ADVANCED_SAST_CPP_ENABLED flag, which triggers the clangsa image
4 The Advanced SAST C/C++ docs page has no offline/air-gapped section
5 The offline deployments docs page never mentions clangsa or gitlab-advanced-sast-cpp
6 Related, partial: #601776 tracks adding clangsa to one section of the SAST _index.md docs page, but does not address the template or the C/C++-specific docs page

Proposal — three changes (split as the team sees fit)

1. Bug: add clangsa to the Secure-Binaries template (primary)

In lib/gitlab/ci/templates/Security/Secure-Binaries.gitlab-ci.yml:

  • Add a clangsa job using the existing .download_images pattern with SECURE_BINARIES_ANALYZER_VERSION: "1".
  • Add clangsa to the default SECURE_BINARIES_ANALYZERS list.

2. Docs: offline section on the Advanced SAST C/C++ page

Add an "Offline environment" section to doc/user/application_security/sast/advanced_sast_cpp.md noting that the clangsa:1 image must be mirrored, with a link to the Secure Binaries template and the SAST offline image list.

3. Docs: include clangsa in offline image references

Customer workaround until fixed

Manually mirror registry.gitlab.com/security-products/clangsa:1 into $SECURE_ANALYZERS_PREFIX, or append this override job in the mirror project:

clangsa:
  extends: .download_images
  variables:
    SECURE_BINARIES_ANALYZER_VERSION: "1"
  rules:
    - if: '$SECURE_BINARIES_DOWNLOAD_IMAGES == "true" && $SECURE_BINARIES_ANALYZERS =~ /\bclangsa\b/'

…and add clangsa to the SECURE_BINARIES_ANALYZERS variable.

Environment

  • GitLab version: 18.6+ (when Advanced SAST C/C++ was introduced)
  • Deployment type: Self-Managed (offline / air-gapped)
  • Affected feature: GitLab Advanced SAST C/C++ analyzer (gitlab-advanced-sast-cpp job, clangsa image)

Related

/cc the groupstatic analysis team

Filed via the GitLab Issue Agent on behalf of a Support Engineer.

Edited by Ross Cain