Skip to content

Feature/sast rules

Zach Rice requested to merge feature/sast-rules into main

What does this MR do?

This MR removes the /rules directory and /semgrep_rules_check directory, and updates the Dockerfile and Dockerfile.fips to pull in the latest semgrep rules from the sast-rules repo. sast-rules is the single source of truth for semgrep rules for the semgrep analyzer.

Couple of things to note:

  1. Semgrep rules are tested in the sast-rules repo in a few different ways. This should alleviate any qualms one might have about removing the /semgrep_rules directory.
  2. Some of the finding descriptions contain multiple previously removed new lines. These could be removed in sast-rules or removed in the analyzer. I don't have a strong opinion on this either way.
  3. I added a semgrep_rules_version_check job to make sure the semgrep rules version remains consistent between Dockerfile and Dockerfile.fips

What are the relevant issue numbers?

gitlab-org/gitlab#321184 (closed)

Does this MR meet the acceptance criteria?

Edited by Zach Rice

Merge request reports