Skip to content

Reintroduce custom AppSec scanning

Dominic Couture requested to merge dcouture-custom-appsec-sast-rules-3 into master

What does this MR do and why?

This was first introduced with !89472 (merged), then removed in !92598 (merged) but is being reintroduced due to issues discussed in https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/13632#note_1237260807

Related to https://gitlab.com/gitlab-com/gl-security/appsec/appsec-team/-/issues/232

This adds a couple of jobs to our pipelines that run custom SAST rules with semgrep and ping appsec when they are detected in the MR. Semgrep only scans the files changed in the MR. The rules are based on patterns that previously led to vulnerabilities, these are identified in the metadata attributes in the rule definitions https://gitlab.com/gitlab-com/gl-security/appsec/sast-custom-rules/-/blob/main/appsec-pings/rules.yml.

We will remove this again when the issues with Scan Result Policies are resolved.

Screenshots or screen recordings

See !109872 (comment 1253824736)

How to set up and validate locally

N/A

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dominic Couture

Merge request reports