First

templates/sast.yml

@@ -24,6 +24,9 @@ spec:
     ff_glas_enable_php_support:
       default: true
       type: boolean
+    enable_mr_pipelines:
+      default: true
+      type: boolean
 ---
 .sast-analyzer:
   stage: $[[ inputs.stage ]]
@@ -141,10 +144,26 @@ gitlab-advanced-sast:
       when: never
     - if: '"$[[ inputs.run_advanced_sast ]]" != "true"'
       when: never
+
+    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
+    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
+    # to cover both the *MR pipeline* and the *branch pipeline* workflows.
+
+    # 1. Run the job in an *MR* pipeline if MR pipelines are enabled and there's an open merge request.
+    - if: '"$[[ inputs.enable_mr_pipelines ]]" == "true" &&
+          $CI_PIPELINE_SOURCE == "merge_request_event" &&
+          $GITLAB_FEATURES =~ /\bsast_advanced\b/'
+      exists: !reference [.gitlab-advanced-sast-exist-rules, exists]
+    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* are enabled and there's an open merge request.
+    - if: '"$[[ inputs.enable_mr_pipelines ]]" == "true" &&
+          $CI_OPEN_MERGE_REQUESTS'
+      when: never
+    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled, or it is enabled but no open MRs exist for the branch).
     - if: $CI_COMMIT_BRANCH &&
           $GITLAB_FEATURES =~ /\bsast_advanced\b/
       exists: !reference [.gitlab-advanced-sast-exist-rules, exists]
 
+
 brakeman-sast:
   extends: .deprecated-16.8
 
@@ -158,7 +177,23 @@ kubesec-sast:
   rules:
     - if: '"$[[ inputs.excluded_analyzers ]]" =~ /kubesec/'
       when: never
-    - if: '$CI_COMMIT_BRANCH && "$[[ inputs.run_kubesec_sast ]]" == "true"'
+
+    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
+    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
+    # to cover both the *MR pipeline* and the *branch pipeline* workflows.
+
+    # 1. Run the job in an *MR* pipeline if MR pipelines for AST are enabled and there's an open merge request.
+    - if: '"$[[ inputs.enable_mr_pipelines ]]" == "true" &&
+          $CI_PIPELINE_SOURCE == "merge_request_event" &&
+          "$[[ inputs.run_kubesec_sast ]]" == "true"'
+    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
+    - if: '"$[[ inputs.enable_mr_pipelines ]]" == "true" &&
+          $CI_OPEN_MERGE_REQUESTS'
+      when: never
+    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
+    - if: '$CI_COMMIT_BRANCH &&
+          "$[[ inputs.run_kubesec_sast ]]" == "true"'
+
 
 mobsf-android-sast:
   extends: .deprecated-16.8