Skip to content

Drop support for deprecated security report schemas

What does this MR do and why?

Related issue: #351003 (closed)

We now have directories for each supported schema version:

lib/gitlab/ci/parsers/security/validators/schemas structure
gitlab/lib/gitlab/ci/parsers/security/validators/schemas on  master ➜ tree -L 2
.
├── 14.0.0
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.1
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.2
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.3
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.4
│   ├── cluster-image-scanning-report-format.json
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.5
│   ├── cluster-image-scanning-report-format.json
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.0.6
│   ├── cluster-image-scanning-report-format.json
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.1.0
│   ├── cluster-image-scanning-report-format.json
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── 14.1.1
│   ├── cluster-image-scanning-report-format.json
│   ├── container-scanning-report-format.json
│   ├── coverage-fuzzing-report-format.json
│   ├── dast-report-format.json
│   ├── dependency-scanning-report-format.json
│   ├── sast-report-format.json
│   └── secret-detection-report-format.json
├── dependency-scanning-report-format.json -> 14.0.0/dependency-scanning-report-format.json
├── sast-report-format.json
└── secret-detection-report-format.json

so we simply remove the ones that are not in a versioned subdirectory. In lib/gitlab/ci/parsers/security/validators/schema_validator.rb we added PREVIOUS_RELEASES which listed versions of https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/tags which we consider unsupported in %15.0. We also used Sisense to determine other versions of the security report schema were used (KNOWN_VERSIONS_TO_REMOVE) and marked them for being unsupported as well (VERSIONS_TO_REMOVE_IN_15_0).

From %15.0 we will enforce schema validation and reports that use a version that's NOT in SUPPORTED_VERSIONS or DEPRECATED_VERSIONS will not be ingested. Reports using DEPRECATED_VERSIONS will emit a warning.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Michał Zając

Merge request reports

Loading