Adding security scanner compliance requirement controls

What does this MR do and why?

Related to GitLab security scanners controls (#523354 - closed), this MR adds the checks for all supported security scanners to the compliance requirement controls.

References

Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

  1. Ensure requirement controls are returned from the GraphQL list.

In /-/graphql-explorer

query complianceRequirementControls {
  complianceRequirementControls {
    controlExpressions {
      id
      name
      expression {
        ... on BooleanExpression {
          field
          operator
          value
        }
        ... on IntegerExpression {
          field
          operator
          value
        }
        ... on StringExpression {
          field
          operator
          value
        }
      }
    }
  }
}

Should return:

{
  "data": {
    "complianceRequirementControls": {
      "controlExpressions": [
        {
          "id": "scanner_sast_running",
          "name": "SAST Running",
          "expression": {
            "field": "scanner_sast_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "minimum_approvals_required_2",
          "name": "At least two approvals",
          "expression": {
            "field": "minimum_approvals_required",
            "operator": "=",
            "value": 2
          }
        },
        {
          "id": "merge_request_prevent_author_approval",
          "name": "Author approved merge request",
          "expression": {
            "field": "merge_request_prevent_author_approval",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "merge_request_prevent_committers_approval",
          "name": "Committers approved merge request",
          "expression": {
            "field": "merge_request_prevent_committers_approval",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "project_visibility_not_internal",
          "name": "Internal visibility is forbidden",
          "expression": {
            "field": "project_visibility",
            "operator": "=",
            "value": "internal"
          }
        },
        {
          "id": "default_branch_protected",
          "name": "Default branch protected",
          "expression": {
            "field": "default_branch_protected",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_secret_detection_running",
          "name": "Secrets Detection Running",
          "expression": {
            "field": "scanner_secret_detection_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_dep_scanning_running",
          "name": "Dependency Scanner Running",
          "expression": {
            "field": "scanner_dep_scanning_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_container_scanning_running",
          "name": "Container Scanner Running",
          "expression": {
            "field": "scanner_container_scanning_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_license_compliance_running",
          "name": "License Compliance Running",
          "expression": {
            "field": "scanner_license_compliance_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_dast_running",
          "name": "DAST Running",
          "expression": {
            "field": "scanner_dast_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_api_security_running",
          "name": "API Fuzz Testing Running",
          "expression": {
            "field": "scanner_api_security_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_fuzz_testing_running",
          "name": "Fuzz Testing Running",
          "expression": {
            "field": "scanner_fuzz_testing_running",
            "operator": "=",
            "value": true
          }
        },
        {
          "id": "scanner_code_quality_running",
          "name": "Code Quality Running",
          "expression": {
            "field": "scanner_code_quality_running",
            "operator": "=",
            "value": true
          }
        }
      ]
    }
  },
  "correlationId": "01JP39B3NAQ2WSV772FZN7J08B"
}
Edited by Darby Frey

Merge request reports

Loading