Update SAST jobs template to include taint signature cache db in CI artifact

What does this MR do and why?

This MR updates the gitlab-advanced-sast job in the SAST CI template to include the taint signature cache database (ts-cache.sqlite.gz) as a CI job artifact with a 3-day expiration.

Why is this needed?

This change is part of the Incremental Scanning MVC implementation for GitLab Advanced SAST (GLAS). This feature reduces analysis time by caching taint signatures between pipeline runs and reusing them for unchanged code. This is achieved through GLAS fetching the ts-cache.sqlite.gz artifact from previous pipeline runs via the GitLab API. For this to work, the taint signature cache must be persisted as a job artifact so that subsequent pipeline runs can retrieve and reuse it.

Cache expiry

The 3-day expiry was agreed in this discussion to limit storage accumulation, while still ensuring cache availability assuming at least one pipeline runs daily and covering weekends.

For context, scanning the GitLab Rails monolith, a relatively large project, produces a 33 MB compressed cache. The CI job artifact size limit is 100 MB on self-managed and 1 GB on GitLab.com.

Users with lower scan frequency can customize this via the GITLAB_ADV_SAST_INCR_SCAN_SEARCH_PERIOD env var.

Since GitLab CI does not support per-file expire_in, the 3-day expiration applies to both ts-cache.sqlite.gz and gl-sast-report.json. This is acceptable because the SAST report is ingested by the Rails monolith when the scan completes, so the expiration has no practical impact on report availability.

Artifact retention

Artifacts from the most recent successful pipeline on each ref are always kept regardless of expire_in. This is a bonus guarantee, if the latest pipeline has a cache, the next scan can use it even past 3 days.

However, this doesn't replace the 3-day expiry because the latest successful pipeline may not contain a cache (e.g., if the GLAS job fails with allow_failure: true, the pipeline succeeds but no cache artifact is produced). In that case, the cache only exists in a previous pipeline's artifacts, which expire 3 days from when they were superseded.

References

Incremental Scanning: MVC Implementation (gitlab-org#20508)

https://gitlab.com/gitlab-org/gitlab/-/work_items/584561+

Validation

1.GLAS scan produces identical findings with updated template

I ran a GLAS scan using both the current SAST job template and the updated template from this branch. The results are identical, with the same number of findings observed in both scans.

• GLAS scan with current SAST job template (left image)
• GLAS scan with updated template from this branch (right image)

2.Artifact validation confirms cache file is included

I validated the template from this branch using this GLAS integration test project. The resulting GLAS job confirms that its artifacts contain the ts-cache.sqlite.gz cache file.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.