diff --git a/templates/sast.yml b/templates/sast.yml index 2a6aa12..64e7743 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -201,7 +201,7 @@ semgrep-sast: rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /semgrep/' when: never - # When advanced SAST runs with PHP support enabled + # When gitlab-advanced-sast runs with PHP support enabled, exclude the `*.php` extension, as well as other files already scanned by gitlab-advanced-sast - if: '$CI_COMMIT_BRANCH && $GITLAB_FEATURES =~ /\bsast_advanced\b/ && "$[[ inputs.excluded_analyzers ]]" !~ /gitlab-advanced-sast/ && @@ -210,7 +210,7 @@ semgrep-sast: variables: SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS, **/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php" exists: !reference [.semgrep-with-advanced-sast-exist-rules, exists] - # When advanced SAST runs but PHP support is disabled + # When gitlab-advanced-sast runs but PHP support is disabled, exclude files already scanned by gitlab-advanced-sast - if: '$CI_COMMIT_BRANCH && $GITLAB_FEATURES =~ /\bsast_advanced\b/ && "$[[ inputs.excluded_analyzers ]]" !~ /gitlab-advanced-sast/ &&