### Problem to solve Our [many analyzers](https://gitlab.com/gitlab-org/security-products/analyzers) currently do more than just analyze users' code. Due to the necessity of building projects and/or pulling in dependencies in many cases, we must run such commands as `yarn install` or `mvn compile` to ensure all dependencies and targets exist prior to running a security scan. This is largely an automatic task yet in many cases a user wants to disable the build step or specify a special build configuration, see examples: * `Python project dependency check failed` https://gitlab.com/gitlab-org/gitlab-ee/issues/6713 * `Retire.js analyzer needs node_modules directory` https://gitlab.com/gitlab-org/gitlab-ee/issues/9291 ### Intended users ~"Persona: Software developer" ~"Persona: DevOps Engineer" ### What does success look like, and how can we measure that? * Users have an explicit understanding of how our scanners both build and scan projects * Users can easily override the build stage for their framework/language using the same method across all scanners ### What is the type of buyer? ~"GitLab Ultimate"