Skip to content

Prevent analyzers from being excluded in scan execution pipelines

What does this MR do and why?

This MR fixes an oversight where it was possible to exclude certain analyzers from being run in scan execution pipelines.

Screenshots or screen recordings

Before After
CleanShot_2023-08-23_at_16.39.15_2x CleanShot_2023-08-23_at_16.39.39_2x

How to set up and validate locally

  1. Add .gitlab-ci.yml:
    build-job:
      stage: build
      script:
      - echo "Compiling the code..."
      - echo "Compile complete."
    include:
    - template: Security/SAST.gitlab-ci.yml
  2. Add run_os_script.rb file into the project:
    class Generic
      def run_on_system
        system("ls")
      end
    end
  3. Go to Secure -> Policies and create a new Scan Execution policy
    name: SAST
    description: ''
    enabled: true
    actions:
    - scan: sast
    rules:
    - type: pipeline
      branches:
      - "*"
  4. Go to Settings -> CI/CD -> Variables and add a new variable: CleanShot_2023-08-23_at_16.42.42_2x
  5. Go to Pipelines and run a new pipeline for the main branch
  6. Verify that brakeman-sast-0 job is still present in the pipeline

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #420700 (closed)

Edited by Martin Čavoj

Merge request reports