Exclude eslint as a SAST analyzer
What does this MR do?
The eslint
analyzer that's part of SAST is quite noisy and has a pretty high false positive rate. Also, it's coverage is now duplicated by the semgrep
analyzer that also provides coverage for JavaScript. This MR removes eslint
from the GitLab build configuration.
Related issues
Check-list
Pre-merge
Consider the effect of the changes in this merge request on the following:
-
Different pipeline types - Non-canonical projects:
-
gitlab-foss
-
security
-
dev
-
personal forks
-
-
Pipeline performance
If new jobs are added:
-
Change-related rules (e.g. frontend/backend/database file changes): _____ -
Frequency they are running (MRs, main branch, nightly, bi-hourly): _____ -
Add a duration chart to https://app.periscopedata.com/app/gitlab/652085/Engineering-Productivity---Pipeline-Build-Durations if there are new jobs added to merge request pipelines
This will help keep track of expected cost increases to the GitLab project average pipeline cost per merge request RPI
Post-merge
-
Consider communicating these changes to the broader team following the communication guideline for pipeline changes