Exclude deleted projects from scan execution rule
requested to merge 402134/exclude-projects-marked-for-deletion-from-scan-execution-pipelines into master
What does this MR do and why?
Projects that are marked for deletion can not run pipelines and are ready only, so they can be excluded from schedule scan execution pipelines.
I started working on this as a bug fix for #402134 (closed), but the bug seems to be fixed already (See #402134 (comment 1385812963)). I think it is still a performance improvement to not try to start a pipeline for projects scheduled for deletion in the first place.
How to set up and validate locally
- Create a group.
- Enable instance wide delayed project deletion
- Add projects to the group:
- Create a new blank project in the group
- Add a simple
.gitlab-ci.yml
file to the project. (See simple.gitlab-ci.yml
example) - Add a
package.json
file with content{}
to the project. This is needed for the SAST scanner to run - 4 times, create a new project and import from the first one.
- Create a new scan execution policy with SAST.
- On the Group level left sidebar, select
Security & Compliance
andPolicies
- Select
New Policy
- Select
Scan execution policy
- For Name choose any name
- For Actions choose SAST
- For Conditions choose:
- Alternatively to steps 1 to 6, you can switch to
.yaml
mode and copy the scan execution policy example below. - Select Configure with a merge request
- Merge the MR
- On the Group level left sidebar, select
- If you haven't already, set up a runner with docker
- To reset the timer and trigger the schedule worker, run:
Security::OrchestrationPolicyRuleSchedule.update_all(next_run_at: Time.now - 1.day)
Security::OrchestrationPolicyRuleScheduleWorker.new.perform
- This should create a new pipeline in every project.
- Delete project 3
- Again run:
Security::OrchestrationPolicyRuleSchedule.update_all(next_run_at: Time.now - 1.day)
Security::OrchestrationPolicyRuleScheduleWorker.new.perform
- The pipeline should be started in all the remaining projects.
Example files
Simple `.gitlab-ci.yml`
# .gitlab-ci.yml
image: busybox:latest
test1:
stage: test
script:
- echo "Do a test here"
- echo "For example run a test suite"
scan execution policy
type: scan_execution_policy
name: test
description: ''
enabled: true
rules:
- type: schedule
branches:
- '*'
cadence: 0 0 * * *
actions:
- scan: sast
tags: []
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Edited by Andy Schoenen