Skip to content

Deprecations in the latest SAST CI template: eslint, bandit and gosec

Vishwa Bhat requested to merge vbhat161-master-patch-89565 into master

What does this MR do and why?

  • Following changes are made only in the latest SAST CI template (SAST.latest.gitlab-ci.yml):
    • Replaces eslint, bandit and gosec analyzers in favour of semgrep analyzer.
    • Defaults .go, .py, .java, .html and .js files to semgrep analyzer.
    • Removes support for Java from spotbugs analyzer
  • Updated spec file(ee/spec/lib/gitlab/ci/templates/sast_latest_gitlab_ci_yaml_spec.rb) to pass tests supporting above changes.

Relevant issue numbers

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Vishwa Bhat

Merge request reports