Skip to content

Trigger gemnasium-python scanning when Pipfile.lock exists

What does this MR do and why?

Describe in detail what your merge request does and why.

  • The Dependency Scanning template will now trigger when a Pipfile.lock file exists. The existence of a Pipfile file is no longer a requirement.

Relates to Enable development dependency scanning in pipen... (#375505 - closed)

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

In GDK instance

  1. Set up a Pipenv project that uses the analyzer image with the feature enhancement.

    include:
      - template: Dependency-Scanning.gitlab-ci.yml
    gemnasium-python-dependency_scanning:
      image: "registry.gitlab.com/gitlab-org/security-products/analyzers/gemnasium/python:4.0.0-rc3"
  2. Remove the Pipfile of the project from the repository.

  3. Run the pipeline and verify that the gemnasium-python-dependency_scanning job completes and generates both a gl-dependency-scanning-report.json and a CycloneDX SBOM.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Oscar Tovar

Merge request reports