Skip to content

Simplify logic to exclude rules in Scan Execution Policies

What does this MR do and why?

This MR simplifies the logic that was used previously to remove rules that potentially could disable selected scans in jobs enforced by Security Policies. As we have modified how variables are working with Scan Execution Policies, we can now simplify that logic by removing the code responsible for it. At the same time we can remove previously added feature flag that handled that.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

  1. Create new Project
  2. Create new Scan Execution Policy (Secure -> Policies -> Create new -> Select Scan Execution Policy)
  3. Select SAST/DS/Secret Detection and SAST IaC.
  4. Prepare project that would allow you to test it all (add Gemfile, some random *.rb file, file with some secret)
  5. By manipulating these variables on Project/Group level, etc., try to disable selected jobs:
    • SECRET_DETECTION_HISTORIC_SCAN
    • SECRET_DETECTION_EXCLUDED_PATHS
    • DS_EXCLUDED_PATHS
    • DS_EXCLUDED_ANALYZERS
    • DEFAULT_SAST_EXCLUDED_PATHS
    • SAST_EXCLUDED_PATHS
    • SAST_EXCLUDED_ANALYZERS
    • SAST_EXCLUDED_PATHS
    • SAST_EXCLUDED_ANALYZERS
  6. Try to set same variables on policy level -> this should allow you to manage jobs normally.

Related to #479820

Edited by Alan (Maciej) Paruszewski

Merge request reports

Loading