vor/sast
1
0
Fork 0
mirror of https://gitlab.com/components/sast.git synced 2025-06-30 15:38:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'iac-kics-sast' into 'main'

Browse source 
Added KICS IaC Scanner

See merge request components/sast!23
This commit is contained in:
Rob Jackson 2025-05-27 08:00:29 -04:00
commit 0e912847b6
2 changed files with 57 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

35
README.md
View file

@ -1,9 +1,11 @@
# SAST (Static Application Security Testing) # SAST (Static Application Security Testing)
Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/sast/ This project provides componnets for the use of Static Application Security Testing as well as Infrastructure as Code testing. Configuration for either component may be performed through CI/CD Variables (https://docs.gitlab.com/ee/ci/variables/index.html) or via the definition of Inputs (https://docs.gitlab.com/ci/inputs/).
More information about GitLab SAST is available within GitLab documentation (https://docs.gitlab.com/ee/user/application_security/sast/), along with the available variables (https://docs.gitlab.com/ee/user/application_security/sast/index.html#available-cicd-variables).
More information about GitLab Infrastructure as Code scanning is available within GitLab documentation (https://docs.gitlab.com/user/application_security/iac_scanning/).
Configure SAST with CI/CD variables (https://docs.gitlab.com/ee/ci/variables/index.html).
List of available variables: https://docs.gitlab.com/ee/user/application_security/sast/index.html#available-cicd-variables
## Usage ## Usage
@ -12,7 +14,8 @@ keyword.
```yaml ```yaml
include: include:
- component: gitlab.com/components/sast/sast@<VERSION> - component: gitlab.com/components/sast/sast@<VERSION> # To include SAST Scanning
- component: gitlab.com/components/sast/iac-sast@<VERSION> # To include IaC Scanning
``` ```
where `<VERSION>` is the latest released tag or `main`. where `<VERSION>` is the latest released tag or `main`.
@ -34,18 +37,18 @@ This assumes `SAST_DISABLED` variable is already defined in `.gitlab-ci.yml` wit
### Inputs ### Inputs
| Input | Default value | Description | | Input | Default value | Description | SAST | IaC |
| ----- | ------------- | ----------- | | ----- | ------------- | ----------- | ---- | --- |
| `stage` | `test` | The stage where you want the job to be added | | `stage` | `test` | The stage where you want the job to be added | :white_check_mark: Yes | :white_check_mark: Yes |
| `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Define where all Docker image are pulled from | | `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Define where all Docker image are pulled from | :white_check_mark: Yes | :white_check_mark: Yes |
| `image_tag` | `4` | Tag of the Docker image to use | | `image_tag` | `4` | Tag of the Docker image to use | :white_check_mark: Yes | :white_check_mark: Yes |
| `image_suffix` | `""` | Suffix added to image. If set to `-fips`, [`FIPS-enabled` images](https://docs.gitlab.com/ee/user/application_security/sast/#fips-enabled-images) are used for scan. Only used by `semgrep` analyzer | | `image_suffix` | `""` | Suffix added to image. If set to `-fips`, [`FIPS-enabled` images](https://docs.gitlab.com/ee/user/application_security/sast/#fips-enabled-images) are used for scan. Only used by `semgrep` analyzer | :white_check_mark: Yes | :white_check_mark: Yes, no FIPS support for IaC |
| `excluded_analyzers` | `""` | Comma separated list of analyzers that should not run | | `excluded_analyzers` | `""` | Comma separated list of analyzers that should not run | :white_check_mark: Yes | :x: No |
| `excluded_paths` | `"spec, test, tests, tmp"` | Comma separated list of paths to exclude | | `excluded_paths` | `"spec, test, tests, tmp"` | Comma separated list of paths to exclude | :white_check_mark: Yes | :white_check_mark: Yes |
| `search_max_depth` | `4` | Defines how many directory levels the search for programming languages should span | | `search_max_depth` | `4` | Defines how many directory levels the search for programming languages should span | :white_check_mark: Yes | :white_check_mark: Yes |
| `run_kubesec_sast` | `"false"` | Set it to `"true"` to run `kubesec-sast` job | | `run_kubesec_sast` | `"false"` | Set it to `"true"` to run `kubesec-sast` job | :white_check_mark: Yes | :x: No |
| `run_advanced_sast` | `false` | Set it to `true` to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast.html) ] | `run_advanced_sast` | `false` | Set it to `true` to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast.html) | :white_check_mark: Yes | :x: No |
| `include_experimental` | `"false"` | Set it to `"true"` to enable [experimental analyzers](https://docs.gitlab.com/ee/user/application_security/sast/#experimental-features) | | `include_experimental` | `"false"` | Set it to `"true"` to enable [experimental analyzers](https://docs.gitlab.com/ee/user/application_security/sast/#experimental-features) | :white_check_mark: Yes | :x: No |
## Contribute ## Contribute

38
templates/iac-sast.yml Normal file
View file

@ -0,0 +1,38 @@
# Component created based on GitLab's IAC SAST Scanning template
# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/iac_scanning/
spec:
inputs:
stage:
default: test
excluded_paths:
default: "spec, test, tests, tmp"
excluded_analyzers:
default: ""
image_prefix:
default: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
image_suffix:
dafault: ""
search_max_depth:
default: 4
image_tag:
default: 6
---
kics-iac-sast:
stage: $[[ inputs.stage ]]
image:
name: "$[[ inputs.image_prefix ]]/kics:$[[ inputs.image_tag ]]$[[ inputs.image_suffix ]]"
variables:
SEARCH_MAX_DEPTH: $[[ inputs.search_max_depth ]]
script:
- /analyzer run
artifacts:
access: 'developer'
reports:
sast: gl-sast-report.json
allow_failure: true
rules:
- if: $[[ inputs.excluded_analyzers ]] =~ /kics/
when: never
- if: $CI_COMMIT_BRANCH