Compare the DAST mirror versions with their templates

Andrew Dunnrequested to merge
fix/secure-binaries-compare-dast-version into master

What does this MR do and why?

A DAST version bump can leave the offline mirror behind with every spec still passing.

Security/Secure-Binaries.gitlab-ci.yml mirrors analyzer images for offline scans. Its spec compares most mirrored versions with the templates that pull the images, a table added in !260570 (merged). The dast and dast-runner-validation mirrors have no row in that table. The dast mirror is pinned only by the hardcoded version in the dast created pipeline example, and dast-runner-validation only by the one in its own example. Raising DAST_VERSION or DAST_RUNNER_VALIDATION_VERSION fails nothing.

This adds three rows. Two templates pull the dast image, Security/DAST and Security/DAST-On-Demand-Scan, and each gets a dast row reading DAST_VERSION. The first is the row @theoretick suggested in a review note on that MR. Security/DAST-Runner-Validation gets a dast-runner-validation row reading DAST_RUNNER_VALIDATION_VERSION.

A comment above the table says where a .latest Jobs template requests a newer tag, the mirror follows the stable one, so the table reads only the stable templates.

The created pipeline examples stay. They also check that the pipeline creates each job with that version. The rows are re-padded to the widest template name, so most of the diff is whitespace.

References

Screenshots or screen recordings

No UI change.

How to set up and validate locally

  1. Run bundle exec rspec ee/spec/lib/gitlab/ci/templates/secure_binaries_ci_yaml_spec.rb.
  2. Change the version in Security/DAST, Security/DAST-On-Demand-Scan or Security/DAST-Runner-Validation (lib/gitlab/ci/templates/Security/) and run it again. The row for that template fails.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

An AI coding assistant wrote this change. The assistant also ran RuboCop on the changed spec (no offenses) and the spec file once (71 examples, no failures), on this branch in a GitLab source checkout on a test VM. For each of the three rows, raising the template's version made the table's examples fail (17 examples, 1 failure each), and with that row removed they passed (16 examples). It ran no other spec and no CI pipeline.

Merge request reports