Update Scan Execution Policies EXCLUDED_VARIABLES matching to use exact variable names

Olivier Gonzalezrequested to merge
refactor_sep_excluded_variables into master

What does this MR do and why?

Updates the remove_rule_to_disable_job! method in the CI Action Template service to use exact variable name matching instead of a broad pattern match.

The previous implementation matches variables that weren't intended to be excluded if they contained similar substrings. For instance, with the dependency resolution feature, Dependency Scanning v2 template contains rules to disable the resolution jobs:

rules:
    - if: '"$[[ inputs.disabled_resolution_jobs ]]" =~ /\bmaven\b/ || $DS_DISABLED_RESOLUTION_JOBS =~ /\bmaven\b/'
      when: never

These jobs are not doing the security analysis and should be allowed to be configured on a per project basis, even when using security policies.

By changing the logic and matching against the explicit EXCLUDED_VARIABLES list, we ensure only the specific variables we want to exclude are filtered out.

References

How to set up and validate locally

  1. Add a project with a pom.xml and configure Dependency Scanning using Scan execution policies and the v2 template
  2. Modify the the file lib/gitlab/ci/templates/Jobs/Dependency-Scanning.v2.gitlab-ci.yml in your GDK with the content from !226990 (merged)
  3. Run a pipeline and confirm the maven resolution job is added to the pipeline
  4. Set the DS_DISABLED_RESOLUTION_JOBS variable to maven either in the .gitlab-ci.yml or in the project CI variables via the UI
  5. Run a pipeline and confirm the maven resolution job is no longer added to the pipeline

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports