As we reevaluate how to best support and maintain Staging Ref in the future, we encourage development teams using this environment to highlight their use cases in the following issue: https://gitlab.com/gitlab-com/gl-infra/software-delivery/framework/software-delivery-framework-issue-tracker/-/issues/36.

Skip to content
Snippets Groups Projects
Commit 5252ad54 authored by Philippe Lafoucrière's avatar Philippe Lafoucrière Committed by Nick Thomas
Browse files

Fix SAST and Dependency Scanning

parent 27c2ef12
No related branches found
No related tags found
No related merge requests found
include:
- template: Code-Quality.gitlab-ci.yml
- template: Security/SAST.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
variables:
DOCKER_VERSION: "19.03.0"
Loading
Loading
@@ -67,32 +69,6 @@ code_quality:
extends: .use-docker-in-docker
rules: *workflow_rules
sast:
extends: .use-docker-in-docker
allow_failure: true
script:
- export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
- docker run
--env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
--volume "$PWD:/code"
--volume /var/run/docker.sock:/var/run/docker.sock
"registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code
artifacts:
paths: [gl-sast-report.json]
dependency_scanning:
extends: .use-docker-in-docker
allow_failure: true
script:
- export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
- docker run
--env DEP_SCAN_DISABLE_REMOTE_CHECKS="${DEP_SCAN_DISABLE_REMOTE_CHECKS:-false}"
--volume "$PWD:/code"
--volume /var/run/docker.sock:/var/run/docker.sock
"registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$SP_VERSION" /code
artifacts:
paths: [gl-dependency-scanning-report.json]
code_navigation:
image: sourcegraph/lsif-go:v1
allow_failure: true
Loading
Loading
@@ -101,3 +77,14 @@ code_navigation:
artifacts:
reports:
lsif: dump.lsif
# SAST
gosec-sast:
rules: *workflow_rules
# Dependency Scanning
gemnasium-dependency_scanning:
rules: *workflow_rules
bundler-audit-dependency_scanning:
rules: *workflow_rules
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment