Skip to content

Add test for retirejs airgap mode

Adam Cohen requested to merge add-test-for-retirejs-airgap-mode into master

What does this MR do?

This MR tests the behaviour of the new RETIREJS_JS_ADVISORY_DB and RETIREJS_NODE_ADVISORY_DB variables added by gitlab-org/security-products/analyzers/retire.js!28 (merged).

It changes the .gitlab-ci.yml file so that it overrides the RETIREJS_JS_ADVISORY_DB and RETIREJS_NODE_ADVISORY_DB to point to the following locally saved files:

It also inserts a new vulnerability into the locally saved npmrepository.json file for the is-obj package which previously had no vulnerabilities, and tests this result in the qa/expect/gl-dependency-scanning.json file.

Related issue

gitlab-org/gitlab#33719 (closed)

TODO:

  • Remove DS_ANALYZER_IMAGE_PREFIX: "registry.gitlab.com/adamcohen/custom-security-scanners" once gitlab-org/security-products/analyzers/retire.js!28 (merged) has been merged
  • Replace https://gitlab.com/gitlab-org/gitlab/-/raw/add-retiresjs-vars-to-dependency-scanning/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml with template: Dependency-Scanning.gitlab-ci.yml once gitlab-org/gitlab!26463 (merged) has been merged and deployed to production
Edited by 🤖 GitLab Bot 🤖

Merge request reports