Add Dependency Scanning scan profile configuration schema [1/4]

rossfuhrmanrequested to merge
rfuhrman/629403-ds-config-1-schema into master

What does this MR do and why?

Stacked MR 1 of 4 implementing work item #629403 (Add Dependency Scanning configuration values and mapping). Targets master.

Adds a JSON schema (ee/app/validators/json_schemas/security_profile_dependency_scanning_configuration.json) defining the 25 allowed Dependency Scanning scan profile configuration values, and registers it under the dependency_scanning scan type in Security::ScanProfiles::Configuration::SCHEMAS. Stored configurations are validated against it.

The stack

  1. (this MR) Add the configuration schema → master
  2. Map configuration values to CI variables → branch 1
  3. Inject CI variables from the scan profile configuration → branch 2
  4. Expose the configuration in GraphQL → branch 3

Implementation notes

  • The 25 variables come from the source-spreadsheet list captured in the work item.
  • Types follow the work item discussion: excluded_paths and pip_extra_index_url are string arrays, disabled_resolution_jobs is an enum array [maven, gradle, python], secure_log_level is an enum [fatal, error, warn, info, debug]; the rest are strings, booleans, or integers.
  • api_timeout and api_scan_download_delay are bounded to the ranges documented for their CI variables (DS_API_TIMEOUT: minimum 5, maximum 300; DS_API_SCAN_DOWNLOAD_DELAY: minimum 1, maximum 120) — see doc/user/application_security/dependency_scanning/dependency_scanning_sbom/_index.md.
  • String values use a 1024-character limit per the work-item table, with one exception: additional_ca_cert_bundle (ADDITIONAL_CA_CERT_BUNDLE) uses 16384. A 1024 cap would reject realistic PEM certificate bundles — a single 2048-bit certificate is already ~1.2–1.9 KB, and a bundle concatenates several. 16384 comfortably fits an internal CA chain while staying well under the whole-configuration size_limit (64 KB), and matches the intent of the existing MAX_CA_CERT_LENGTH (65535) used for cluster CA certificates.

Related to

Related to #629403

MR acceptance checklist

  • I have evaluated the MR acceptance checklist for this MR.

🤖 Generated with Claude Code

Edited by rossfuhrman

Merge request reports