Log failures if schedule pipeline fails to create
What does this MR do and why?
The purpose of this MR is to log a message if creating a scheduled scan execution pipeline fails. To do this, some services needed to be changed to be able to return an error or success status.
I'm trying to verify a feature (introduced in !119136 (merged)) that uses bot users to run a scheduled scan execution pipeline. But the pipelines don't appear to be created. To learn more about the failure, I'd like to introduce some logging.
How to set up and validate locally
- Create a project
- Create a new blank project
- Add a simple
.gitlab-ci.yml
file to the project. (See simple.gitlab-ci.yml
example) - Add a
package.json
file with content{}
to the project. This is needed for the SAST scanner to run
- Create a new scan execution policy with SAST for the project.
- On the left sidebar, select
Security & Compliance
andPolicies
- Select
New Policy
- Select
Scan execution policy
- For Name choose any name
- For Actions choose SAST
- For Conditions choose:
- Alternatively to steps 1 to 6, you can switch to
.yaml
mode and copy the scan execution policy example below. - Select Configure with a merge request
- Merge the MR
- On the left sidebar, select
- Change the owner of the rule schedule to some user that doesn't have access to the project:
project = Project.find(YOUR_PROJECT_ID) rule_schedule = Security::OrchestrationPolicyRuleSchedule.find_by(security_orchestration_policy_configuration: Security::OrchestrationPolicyConfiguration.find_by(project: project)) rule_schedule.update(owner_id 4) # Make sure the user ID used here doesn't have access to the project
- Follow the logs by running
tail -f log/sidekiq_client.log
- Kick of the rule schedule worker
Security::OrchestrationPolicyRuleSchedule.update_all(next_run_at: Time.now - 1.day) Security::OrchestrationPolicyRuleScheduleWorker.new.perform
- The logs should show a message like this:
{"severity":"WARN","time":"2023-05-26T19:16:29.531Z","worker":"Security::OrchestrationPolicyRuleScheduleWorker","security_orchestration_policy_configuration_id":36,"user_id":68,"message":"You do not have sufficient permission to run a pipeline on 'main'. Please select a different branch or contact your administrator for assistance. ","retry":0}
Example files
Simple `.gitlab-ci.yml`
# .gitlab-ci.yml
image: busybox:latest
test1:
stage: test
script:
- echo "Do a test here"
- echo "For example run a test suite"
scan execution policy
type: scan_execution_policy
name: test
description: ''
enabled: true
rules:
- type: schedule
branches:
- '*'
cadence: 0 0 * * *
actions:
- scan: sast
tags: []
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Edited by Andy Schoenen