Scan Swift and Objective-C with GitLab Advanced SAST (EXT)

What does this MR do and why?

gitlab-advanced-sast-ext currently runs behind its own flag, GITLAB_ADVANCED_SAST_EXT_ENABLED. That flag was intentionally short-lived: !246271 (merged) added it purely to exercise the analyzer during the internal test phase, separately from the existing gitlab-advanced-sast rollout.

This MR retires that temporary flag and gates gitlab-advanced-sast-ext on the shared GITLAB_ADVANCED_SAST_ENABLED flag, so it now enables together with gitlab-advanced-sast.

Changes

• lib/gitlab/ci/templates/Jobs/SAST.gitlab-ci.yml + .latest: rename the gitlab-advanced-sast-ext rule gate from GITLAB_ADVANCED_SAST_EXT_ENABLED to GITLAB_ADVANCED_SAST_ENABLED.
• ee/spec/lib/gitlab/ci/templates/sast_gitlab_ci_yaml_spec.rb + .latest: switch the *.swift/*.m/*.mm rows to the shared flag. The Python and Objective C with advanced SAST row now also expects gitlab-advanced-sast-ext, since an ObjC/Swift file under GITLAB_ADVANCED_SAST_ENABLED=true now triggers it.

The -ext job keeps its own *.swift/*.m/*.mm exists rules, so sharing the flag does not change which files each job scans.

Related

• Follow-up to !246271 (merged)
• Closes https://gitlab.com/gitlab-org/gitlab/-/issues/607418

Testing

End-to-end verification on real projects that include this MR's SAST template (ref: hua/gitlab-advanced-sast-ext-shared-flag, resolving to the current branch tip 972469a6) with GITLAB_ADVANCED_SAST_ENABLED: 'true'. Both pipelines ran against the exact SHA under review.

Case	Project	Pipeline	What it proves
Positive	iGoat-Swift (Swift / Objective-C)	#2718680329	The shared flag runs gitlab-advanced-sast-ext where its globs match.
Negative control	django-cms (pure Python)	#2718679295	The shared flag does not run gitlab-advanced-sast-ext where its globs do not match.

Positive: on a Swift/Objective-C project, the shared flag runs gitlab-advanced-sast-ext

In pipeline #2718680329, gitlab-advanced-sast-ext was created and succeeded (31s), running alongside gitlab-advanced-sast and semgrep-sast. Job #15622517177 pulled the analyzer image, scanned, and produced a valid SAST report (297 findings, scanner sat):

Using Docker executor with image registry.gitlab.com/security-products/gitlab-advanced-sast-ext:0 ...
Pulling docker image registry.gitlab.com/security-products/gitlab-advanced-sast-ext:0 ...
SARIF report written to /tmp/sat.sarif
[INFO] [SAT (Static Analysis Toolkit)] Creating report
gl-sast-report.json: found 1 matching artifact files and directories
Uploading artifacts as "sast" to coordinator... 201 Created
Job succeeded

Negative control: on a pure-Python project, the shared flag does not run gitlab-advanced-sast-ext

Pipeline #2718679295 created a gitlab-advanced-sast job (Python is covered by GitLab Advanced SAST) but no gitlab-advanced-sast-ext job, because the *.swift, *.m, and *.mm exists globs match nothing in the repo. This confirms the shared flag does not make -ext scan projects outside its language set. (semgrep-sast is suppressed by gitlab-advanced-sast, as normal.)

The dependency-scanning:python-resolution-0 job shown as failed in that pipeline is allow_failure: true and unrelated to SAST or this change.