Prevent analyzers from being excluded in scan execution pipelines
Merged
requested to merge 420700-enforced-scan-execution-can-be-circumvented-by-sast_excluded_analyzers-variable into master
This MR fixes an oversight where it was possible to exclude certain analyzers from being run in scan execution pipelines.
Before | After |
---|---|
![]() |
![]() |
.gitlab-ci.yml
:
build-job:
stage: build
script:
- echo "Compiling the code..."
- echo "Compile complete."
include:
- template: Security/SAST.gitlab-ci.yml
run_os_script.rb
file into the project:
class Generic
def run_on_system
system("ls")
end
end
name: SAST
description: ''
enabled: true
actions:
- scan: sast
rules:
- type: pipeline
branches:
- "*"
main
branchbrakeman-sast-0
job is still present in the pipelineThis checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #420700 (closed)