From 446d4146f594e3a4373e66b82bbd55cfc76f4ca6 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Thu, 27 Mar 2025 16:51:36 +1100 Subject: [PATCH 1/6] Test GLAS multicore --- templates/sast.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/templates/sast.yml b/templates/sast.yml index 6dad115..b8c33fe 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -55,6 +55,20 @@ gitlab-advanced-sast: variables: SAST_ANALYZER_IMAGE_TAG: 1 SEARCH_MAX_DEPTH: 20 + SCAN_METRICS_FILE: scan_metrics.csv + cache: + key: "$CI_COMMIT_REF_SLUG-scan-metrics" + paths: + - "$SCAN_METRICS_FILE" + policy: pull-push + artifacts: + access: 'developer' + reports: + sast: gl-sast-report.json + paths: + - "$SCAN_METRICS_FILE" + when: always + expire_in: 7 days rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From c6ea9d4f34116c8f2b4f4efc58dd3846ea1d20f1 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Fri, 4 Apr 2025 11:29:31 +1100 Subject: [PATCH 2/6] Test GLAS multicore --- templates/sast.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index b8c33fe..cafc8f1 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -60,15 +60,6 @@ gitlab-advanced-sast: key: "$CI_COMMIT_REF_SLUG-scan-metrics" paths: - "$SCAN_METRICS_FILE" - policy: pull-push - artifacts: - access: 'developer' - reports: - sast: gl-sast-report.json - paths: - - "$SCAN_METRICS_FILE" - when: always - expire_in: 7 days rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From 4ea446f709bbe776fef6fdb8d7d8b5b4356bfe48 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Tue, 8 Apr 2025 10:57:15 +1000 Subject: [PATCH 3/6] Improve cache --- templates/sast.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/templates/sast.yml b/templates/sast.yml index cafc8f1..0d0145d 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -57,7 +57,9 @@ gitlab-advanced-sast: SEARCH_MAX_DEPTH: 20 SCAN_METRICS_FILE: scan_metrics.csv cache: - key: "$CI_COMMIT_REF_SLUG-scan-metrics" + key: "scan-metrics-$CI_COMMIT_REF_SLUG" + fallback_keys: + - "scan-metrics-$CI_DEFAULT_BRANCH" paths: - "$SCAN_METRICS_FILE" rules: From 8c5526b0f42c4f5f709c80360b7d3b65e9c9c975 Mon Sep 17 00:00:00 2001 From: Hua Yan Date: Wed, 23 Apr 2025 13:01:09 +1000 Subject: [PATCH 4/6] Set path as "scan_metrics.csv" --- templates/sast.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index 0d0145d..d16055d 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -55,13 +55,12 @@ gitlab-advanced-sast: variables: SAST_ANALYZER_IMAGE_TAG: 1 SEARCH_MAX_DEPTH: 20 - SCAN_METRICS_FILE: scan_metrics.csv cache: key: "scan-metrics-$CI_COMMIT_REF_SLUG" fallback_keys: - "scan-metrics-$CI_DEFAULT_BRANCH" paths: - - "$SCAN_METRICS_FILE" + - "scan_metrics.csv" rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From 70e258313531c24ed6edbac44f9adfc5caae9450 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Mon, 28 Apr 2025 13:30:50 +1000 Subject: [PATCH 5/6] Bump analyser versions for 18.0 --- templates/sast.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index 6dad115..028d190 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -5,7 +5,7 @@ spec: image_prefix: default: "$CI_TEMPLATE_REGISTRY_HOST/security-products" image_tag: - default: '5' + default: '6' image_suffix: default: "" excluded_analyzers: @@ -53,7 +53,7 @@ gitlab-advanced-sast: image: name: "$[[ inputs.image_prefix ]]/gitlab-advanced-sast:${SAST_ANALYZER_IMAGE_TAG}$[[ inputs.image_suffix ]]" variables: - SAST_ANALYZER_IMAGE_TAG: 1 + SAST_ANALYZER_IMAGE_TAG: 2 SEARCH_MAX_DEPTH: 20 rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' From f1b9a6d963f970d5332ce745805d24229dee66af Mon Sep 17 00:00:00 2001 From: Rob Jackson Date: Mon, 26 May 2025 12:05:24 -0400 Subject: [PATCH 6/6] renamed iac-sast file, removed disabled flag. Added more description in readme and adjusted table for SAST and IaC --- README.md | 34 ++++++++++--------- templates/{iac-kics-sast.yml => iac-sast.yml} | 2 -- 2 files changed, 18 insertions(+), 18 deletions(-) rename templates/{iac-kics-sast.yml => iac-sast.yml} (93%) diff --git a/README.md b/README.md index b1b8143..994a4ef 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,11 @@ # SAST (Static Application Security Testing) -Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/sast/ +This project provides componnets for the use of Static Application Security Testing as well as Infrastructure as Code testing. Configuration for either component may be performed through CI/CD Variables (https://docs.gitlab.com/ee/ci/variables/index.html) or via the definition of Inputs (https://docs.gitlab.com/ci/inputs/). + +More information about GitLab SAST is available within GitLab documentation (https://docs.gitlab.com/ee/user/application_security/sast/), along with the available variables (https://docs.gitlab.com/ee/user/application_security/sast/index.html#available-cicd-variables). + +More information about GitLab Infrastructure as Code scanning is available within GitLab documentation (https://docs.gitlab.com/user/application_security/iac_scanning/). -Configure SAST with CI/CD variables (https://docs.gitlab.com/ee/ci/variables/index.html). -List of available variables: https://docs.gitlab.com/ee/user/application_security/sast/index.html#available-cicd-variables ## Usage @@ -13,7 +15,7 @@ keyword. ```yaml include: - component: gitlab.com/components/sast/sast@ # To include SAST Scanning - - component: gitlab.com/components/sast/iac-kics-sast@ # To include IaC Scanning + - component: gitlab.com/components/sast/iac-sast@ # To include IaC Scanning ``` where `` is the latest released tag or `main`. @@ -35,18 +37,18 @@ This assumes `SAST_DISABLED` variable is already defined in `.gitlab-ci.yml` wit ### Inputs -| Input | Default value | Description | -| ----- | ------------- | ----------- | -| `stage` | `test` | The stage where you want the job to be added | -| `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Define where all Docker image are pulled from | -| `image_tag` | `4` | Tag of the Docker image to use | -| `image_suffix` | `""` | Suffix added to image. If set to `-fips`, [`FIPS-enabled` images](https://docs.gitlab.com/ee/user/application_security/sast/#fips-enabled-images) are used for scan. Only used by `semgrep` analyzer | -| `excluded_analyzers` | `""` | Comma separated list of analyzers that should not run | -| `excluded_paths` | `"spec, test, tests, tmp"` | Comma separated list of paths to exclude | -| `search_max_depth` | `4` | Defines how many directory levels the search for programming languages should span | -| `run_kubesec_sast` | `"false"` | Set it to `"true"` to run `kubesec-sast` job | -| `run_advanced_sast` | `false` | Set it to `true` to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast.html) ] -| `include_experimental` | `"false"` | Set it to `"true"` to enable [experimental analyzers](https://docs.gitlab.com/ee/user/application_security/sast/#experimental-features) | +| Input | Default value | Description | SAST | IaC | +| ----- | ------------- | ----------- | ---- | --- | +| `stage` | `test` | The stage where you want the job to be added | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | +| `image_prefix` | `$CI_TEMPLATE_REGISTRY_HOST/security-products` | Define where all Docker image are pulled from | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | +| `image_tag` | `4` | Tag of the Docker image to use | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | +| `image_suffix` | `""` | Suffix added to image. If set to `-fips`, [`FIPS-enabled` images](https://docs.gitlab.com/ee/user/application_security/sast/#fips-enabled-images) are used for scan. Only used by `semgrep` analyzer | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes, no FIPS support for IaC | +| `excluded_analyzers` | `""` | Comma separated list of analyzers that should not run | {{< icon name="check-circle" >}} Yes | {{< icon name="dotted-circle" >}} No | +| `excluded_paths` | `"spec, test, tests, tmp"` | Comma separated list of paths to exclude | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | +| `search_max_depth` | `4` | Defines how many directory levels the search for programming languages should span | {{< icon name="check-circle" >}} Yes | {{< icon name="check-circle" >}} Yes | +| `run_kubesec_sast` | `"false"` | Set it to `"true"` to run `kubesec-sast` job | {{< icon name="check-circle" >}} Yes | {{< icon name="dotted-circle" >}} No | +| `run_advanced_sast` | `false` | Set it to `true` to enable [GitLab Advanced SAST](https://docs.gitlab.com/ee/user/application_security/sast/gitlab_advanced_sast.html) | {{< icon name="check-circle" >}} Yes | {{< icon name="dotted-circle" >}} No | +| `include_experimental` | `"false"` | Set it to `"true"` to enable [experimental analyzers](https://docs.gitlab.com/ee/user/application_security/sast/#experimental-features) | {{< icon name="check-circle" >}} Yes | {{< icon name="dotted-circle" >}} No | ## Contribute diff --git a/templates/iac-kics-sast.yml b/templates/iac-sast.yml similarity index 93% rename from templates/iac-kics-sast.yml rename to templates/iac-sast.yml index ff6e530..d657763 100644 --- a/templates/iac-kics-sast.yml +++ b/templates/iac-sast.yml @@ -33,8 +33,6 @@ kics-iac-sast: sast: gl-sast-report.json allow_failure: true rules: - - if: $SAST_DISABLED == 'true' || $SAST_DISABLED == '1' - when: never - if: $[[ inputs.excluded_analyzers ]] =~ /kics/ when: never - if: $CI_COMMIT_BRANCH