From b64ec3dbc2ef634d3513c3fb8899bed85d4cdfaa Mon Sep 17 00:00:00 2001 From: Hazelnoot Date: Fri, 26 Sep 2025 19:35:41 -0400 Subject: [PATCH] move security scanning to the top of CI pipeline --- .gitlab-ci.yml | 54 +++++++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 302c96db5a..e4160689fa 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,3 +1,30 @@ +# https://docs.gitlab.com/user/application_security/sast/ +include: + - template: Jobs/Dependency-Scanning.latest.gitlab-ci.yml + - template: Jobs/Container-Scanning.latest.gitlab-ci.yml + - template: Jobs/SAST.latest.gitlab-ci.yml + - template: Jobs/Secret-Detection.latest.gitlab-ci.yml + # https://docs.gitlab.com/user/application_security/dependency_scanning/experiment_libbehave_dependency/ + - component: $CI_SERVER_FQDN/TransFem-org/libbehave/libbehave@v0.2.4 + +variables: + # https://docs.gitlab.com/user/application_security/sast/gitlab_advanced_sast + GITLAB_ADVANCED_SAST_ENABLED: 'true' + + # https://docs.gitlab.com/user/application_security/sast/#vulnerability-filters + # https://stackoverflow.com/a/71111784 + SAST_EXCLUDED_PATHS: 'spec,test,test-d,test-federation,test-server,tests,tmp,cypress,coverage,node_modules,build,built,built-js,*.min.js,megalodon/lib,libopenmpt' + DS_EXCLUDED_PATHS: 'spec,test,test-d,test-federation,test-server,tests,tmp,cypress,coverage,node_modules,build,built,built-js,*.min.js,megalodon/lib,libopenmpt,packages/*/src' # save time: skip source directories + + # https://docs.gitlab.com/user/application_security/dependency_scanning/migration_guide_to_sbom_based_scans/ + DS_ENFORCE_NEW_ANALYZER: 'true' + DS_MAX_DEPTH: -1 + # https://docs.gitlab.com/user/application_security/dependency_scanning/static_reachability/ + DS_STATIC_REACHABILITY_ENABLED: true + + # https://docs.gitlab.com/user/application_security/detect/security_configuration/#use-security-scanning-tools-with-merge-request-pipelines + AST_ENABLE_MR_PIPELINES: 'true' + stages: - test - deploy @@ -138,33 +165,6 @@ merge_image_manifests: - develop - tags -# https://docs.gitlab.com/user/application_security/sast/ -include: - - template: Jobs/Dependency-Scanning.latest.gitlab-ci.yml - - template: Jobs/Container-Scanning.latest.gitlab-ci.yml - - template: Jobs/SAST.latest.gitlab-ci.yml - - template: Jobs/Secret-Detection.latest.gitlab-ci.yml - # https://docs.gitlab.com/user/application_security/dependency_scanning/experiment_libbehave_dependency/ - - component: $CI_SERVER_FQDN/TransFem-org/libbehave/libbehave@v0.2.4 - -variables: - # https://docs.gitlab.com/user/application_security/sast/gitlab_advanced_sast - GITLAB_ADVANCED_SAST_ENABLED: 'true' - - # https://docs.gitlab.com/user/application_security/sast/#vulnerability-filters - # https://stackoverflow.com/a/71111784 - SAST_EXCLUDED_PATHS: 'spec,test,test-d,test-federation,test-server,tests,tmp,cypress,coverage,node_modules,build,built,built-js,*.min.js,megalodon/lib,libopenmpt' - DS_EXCLUDED_PATHS: 'spec,test,test-d,test-federation,test-server,tests,tmp,cypress,coverage,node_modules,build,built,built-js,*.min.js,megalodon/lib,libopenmpt,packages/*/src' # save time: skip source directories - - # https://docs.gitlab.com/user/application_security/dependency_scanning/migration_guide_to_sbom_based_scans/ - DS_ENFORCE_NEW_ANALYZER: 'true' - DS_MAX_DEPTH: -1 - # https://docs.gitlab.com/user/application_security/dependency_scanning/static_reachability/ - DS_STATIC_REACHABILITY_ENABLED: true - - # https://docs.gitlab.com/user/application_security/detect/security_configuration/#use-security-scanning-tools-with-merge-request-pipelines - AST_ENABLE_MR_PIPELINES: 'true' - dependency_scanning: tags: - amd64