Analyze pipeline execution policy configs for enforced scanners
What does this MR do and why?
Analyze pipeline execution policy configs for enforced scanners
- Add and trigger worker to analyze the config when policy changes
- Update policy metadata with enforced scanners
References
Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
- Enable feature flag
pipeline_execution_policy_analyze_configs - Create a project
SPP - In the project, create
policy-ci.yml:include: - template: Jobs/Dependency-Scanning.gitlab-ci.yml policy-test-job: stage: test script: - echo 'Policy test job 1' - Create another project
- In this project, go to Secure -> Policies and link the project
SPPfrom step 2. as a policy project - Create a new pipeline execution policy:
pipeline_execution_policy: - name: Enforced scans description: '' enabled: true pipeline_config_strategy: inject_ci content: include: - project: <path-to-spp-project> file: policy-ci.yml - Save the policy
- Verify using rails console that the metadata has been updated with
enforced_scans: ['dependency_scanning']:Security::Policy.last.metadata - Update the policy to link to another file without scanners included in the template
- Verify that the metadata has been updated and
enforced_scansis[]
Related to #498624 (closed)
Edited by Martin Cavoj