Skip to content

Use historic mode when running scheduled scan execution policies

Alan (Maciej) Paruszewski requested to merge 391278-ensure-that-historical-scan-is-triggered-for-scheduled-scan-execution-policy into master

What does this MR do and why?

This MR updates how we execute scheduled Scan Execution Policy with secret_detection enabled. We are setting SECRET_DETECTION_HISTORIC_SCAN to true in this case.

How to set up and validate locally

  1. Create project
  2. Create Scan Execution Policy (https://docs.gitlab.com/ee/user/application_security/policies/) with secret_detection scheduled to given cadence, add variables section to try to disable it SECRET_DETECTION_HISTORIC_SCAN:
---
scan_execution_policy:
- name: Enforce scheduled secret detection 
  description: ''
  enabled: true 
  rules:
  - type: schedule
    cadence: '0 10 * * *'
  actions:
  - scan: secret_detection
    variables:
      SECRET_DETECTION_HISTORIC_SCAN: 'false'
  1. Create MR with policy update and merge it.
  2. Wait and observe CI/CD -> Pipelines to see if scan was scheduled with SECRET_DETECTION_HISTORIC_SCAN enabled.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #391278 (closed)

Merge request reports