Skip to content

Add scan duration check

Igor Frenkel requested to merge 196697-add-max-scan-duration into master

What does this MR do?

This MR adds a scan duration check for the scanning time of Dependency Scanning analyzers. The check happens in the qa phase of downstream projects and fails if the last scan's scanning duration in the report is greater than MAX_SCAN_DURATION_SECONDS set in the analyzer's ci config.

Here are a few job runs showing this at work on the bundler-audit analyzer:

The plan for this MR is as follows:

  1. merge this MR (so that this code is available in all DS downstream projects)
  2. create a branch in each analyzer (gemnasium, gemnasium-python, gemnasium-maven, bundler-audit) setting the MAX_SCAN_DURATION_SECONDS environment variable setting up a preliminary run for each downstream project to establish a baseline MAX_SCAN_DURATION_SECONDS
  3. set MAX_SCAN_DURATION_SECONDS that was found
  4. update MAX_SCAN_DURATION_SECONDS for each downstream job in the analyzer's ci config

Add variable to each analyzer:

What are the relevant issue numbers?

gitlab-org/gitlab#196697 (closed)

Does this MR meet the acceptance criteria?

Edited by Igor Frenkel

Merge request reports