Inject profile configuration env vars to profile scan jobs

Gal Katzrequested to merge
gkatz_inject_configuration_based_env_vars into master

What does this MR do and why?

Introduces Security::ScanProfiles::Configuration::CiVariables, a declarative translator that maps a scan profile trigger's stored configuration into environment variables injected into the scanner jobs a pipeline generates.

This MR reuses the existing SEP variable machinery: ScanProfileTrigger#ci_variables resolves the effective configuration and CiVariables.build maps each present key to its environment variable, which Processor#all_profiles sets as the action's variables.

The mapping is a declarative registry so adding a value type, a variable, or a scan type is a one line change. The secret_detection JSON schema that permits these config keys is being handled in Add SD configuration values and mapping (#606237 - closed) • Gal Katz

Changelog: added
EE: true

Related issue

[Backend] Map configuration to env variables in... (#606346 - closed) • Gal Katz

How to set up and validate locally

The current SD configuration (for scan profiles) allows only empty objects for now. To validate this change, build a profile, configuration, and trigger in memory and read the CI variables:

profile = Security::ScanProfile.new(scan_type: :secret_detection)
config  = Security::ScanProfiles::Configuration.new(
  scan_profile: profile,
  configuration: { 
    log_options: 'HEAD~5..HEAD',
    historic_scan: true,
    excluded_paths: %w[spec tmp] 
  }
)
trigger = Security::ScanProfileTrigger.new(scan_profile: profile, configuration: config)

trigger.ci_variables

# => {
#      "SECRET_DETECTION_LOG_OPTIONS"    => "HEAD~5..HEAD",
#      "SECRET_DETECTION_HISTORIC_SCAN"  => "true",
#      "SECRET_DETECTION_EXCLUDED_PATHS" => "spec,tmp"
#    }

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports