From 446d4146f594e3a4373e66b82bbd55cfc76f4ca6 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Thu, 27 Mar 2025 16:51:36 +1100 Subject: [PATCH 1/7] Test GLAS multicore --- templates/sast.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/templates/sast.yml b/templates/sast.yml index 6dad115..b8c33fe 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -55,6 +55,20 @@ gitlab-advanced-sast: variables: SAST_ANALYZER_IMAGE_TAG: 1 SEARCH_MAX_DEPTH: 20 + SCAN_METRICS_FILE: scan_metrics.csv + cache: + key: "$CI_COMMIT_REF_SLUG-scan-metrics" + paths: + - "$SCAN_METRICS_FILE" + policy: pull-push + artifacts: + access: 'developer' + reports: + sast: gl-sast-report.json + paths: + - "$SCAN_METRICS_FILE" + when: always + expire_in: 7 days rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From c6ea9d4f34116c8f2b4f4efc58dd3846ea1d20f1 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Fri, 4 Apr 2025 11:29:31 +1100 Subject: [PATCH 2/7] Test GLAS multicore --- templates/sast.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index b8c33fe..cafc8f1 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -60,15 +60,6 @@ gitlab-advanced-sast: key: "$CI_COMMIT_REF_SLUG-scan-metrics" paths: - "$SCAN_METRICS_FILE" - policy: pull-push - artifacts: - access: 'developer' - reports: - sast: gl-sast-report.json - paths: - - "$SCAN_METRICS_FILE" - when: always - expire_in: 7 days rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From 4ea446f709bbe776fef6fdb8d7d8b5b4356bfe48 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Tue, 8 Apr 2025 10:57:15 +1000 Subject: [PATCH 3/7] Improve cache --- templates/sast.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/templates/sast.yml b/templates/sast.yml index cafc8f1..0d0145d 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -57,7 +57,9 @@ gitlab-advanced-sast: SEARCH_MAX_DEPTH: 20 SCAN_METRICS_FILE: scan_metrics.csv cache: - key: "$CI_COMMIT_REF_SLUG-scan-metrics" + key: "scan-metrics-$CI_COMMIT_REF_SLUG" + fallback_keys: + - "scan-metrics-$CI_DEFAULT_BRANCH" paths: - "$SCAN_METRICS_FILE" rules: From 8c5526b0f42c4f5f709c80360b7d3b65e9c9c975 Mon Sep 17 00:00:00 2001 From: Hua Yan Date: Wed, 23 Apr 2025 13:01:09 +1000 Subject: [PATCH 4/7] Set path as "scan_metrics.csv" --- templates/sast.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index 0d0145d..d16055d 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -55,13 +55,12 @@ gitlab-advanced-sast: variables: SAST_ANALYZER_IMAGE_TAG: 1 SEARCH_MAX_DEPTH: 20 - SCAN_METRICS_FILE: scan_metrics.csv cache: key: "scan-metrics-$CI_COMMIT_REF_SLUG" fallback_keys: - "scan-metrics-$CI_DEFAULT_BRANCH" paths: - - "$SCAN_METRICS_FILE" + - "scan_metrics.csv" rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' when: never From 70e258313531c24ed6edbac44f9adfc5caae9450 Mon Sep 17 00:00:00 2001 From: "hyan@gitlab.com" Date: Mon, 28 Apr 2025 13:30:50 +1000 Subject: [PATCH 5/7] Bump analyser versions for 18.0 --- templates/sast.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index 6dad115..028d190 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -5,7 +5,7 @@ spec: image_prefix: default: "$CI_TEMPLATE_REGISTRY_HOST/security-products" image_tag: - default: '5' + default: '6' image_suffix: default: "" excluded_analyzers: @@ -53,7 +53,7 @@ gitlab-advanced-sast: image: name: "$[[ inputs.image_prefix ]]/gitlab-advanced-sast:${SAST_ANALYZER_IMAGE_TAG}$[[ inputs.image_suffix ]]" variables: - SAST_ANALYZER_IMAGE_TAG: 1 + SAST_ANALYZER_IMAGE_TAG: 2 SEARCH_MAX_DEPTH: 20 rules: - if: '"$[[ inputs.excluded_analyzers ]]" =~ /gitlab-advanced-sast/' From ccd33f9a0234b756a441e5cb4a5ad666a10fd31d Mon Sep 17 00:00:00 2001 From: Philip Cunningham Date: Wed, 26 Mar 2025 10:40:19 +0000 Subject: [PATCH 6/7] Add PHP language support to gitlab-advanced-sast --- templates/sast.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/templates/sast.yml b/templates/sast.yml index ccb3eec..7f1100f 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -81,6 +81,7 @@ gitlab-advanced-sast: - '**/*.mjs' - '**/*.cs' - '**/*.rb' + - '**/*.php' brakeman-sast: extends: .deprecated-16.8 @@ -144,7 +145,7 @@ semgrep-sast: "$[[ inputs.excluded_analyzers ]]" !~ /gitlab-advanced-sast/ && "$[[ inputs.run_advanced_sast ]]" == "true"' variables: - SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS, **/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb" + SAST_EXCLUDED_PATHS: "$DEFAULT_SAST_EXCLUDED_PATHS, **/*.py, **/*.go, **/*.java, **/*.js, **/*.jsx, **/*.ts, **/*.tsx, **/*.cjs, **/*.mjs, **/*.cs, **/*.rb, **/*.php" exists: - '**/*.c' - '**/*.cc' @@ -203,7 +204,7 @@ semgrep-sast: - '**/bootstrap*.yml' - '**/application*.yaml' - '**/bootstrap*.yaml' - + sobelow-sast: extends: .sast-analyzer image: From e0d30c4a71f9b546f138f1cf5c3fd9dc57a00d37 Mon Sep 17 00:00:00 2001 From: Philip Cunningham Date: Thu, 22 May 2025 11:41:23 +0100 Subject: [PATCH 7/7] Enable GLAS PHP Support FF by default --- templates/sast.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/templates/sast.yml b/templates/sast.yml index 7f1100f..a169ccb 100644 --- a/templates/sast.yml +++ b/templates/sast.yml @@ -53,6 +53,7 @@ gitlab-advanced-sast: image: name: "$[[ inputs.image_prefix ]]/gitlab-advanced-sast:${SAST_ANALYZER_IMAGE_TAG}$[[ inputs.image_suffix ]]" variables: + FF_GLAS_ENABLE_PHP_SUPPORT: 'true' SAST_ANALYZER_IMAGE_TAG: 2 SEARCH_MAX_DEPTH: 20 cache: