Trigger gemnasium-python scanning when Pipfile.lock exists
What does this MR do and why?
Describe in detail what your merge request does and why.
- The Dependency Scanning template will now trigger when a
Pipfile.lock
file exists. The existence of aPipfile
file is no longer a requirement.
Relates to Enable development dependency scanning in pipen... (#375505 - closed)
Screenshots or screen recordings
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
How to set up and validate locally
Numbered steps to set up and validate the change are strongly suggested.
In GDK instance
-
Set up a Pipenv project that uses the analyzer image with the feature enhancement.
include: - template: Dependency-Scanning.gitlab-ci.yml gemnasium-python-dependency_scanning: image: "registry.gitlab.com/gitlab-org/security-products/analyzers/gemnasium/python:4.0.0-rc3"
-
Remove the
Pipfile
of the project from the repository. -
Run the pipeline and verify that the
gemnasium-python-dependency_scanning
job completes and generates both agl-dependency-scanning-report.json
and a CycloneDX SBOM.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.