Remove Security MR pipeline config example because it breaks product functionality
What does this MR do and why?
Removes an example from our documentation about using Security scanners with MR pipelines that is known to break functionality.
Why?
Support receives tickets from Ultimate customers who've implemented what we have in our docs saying that it doesn't work as expected and it breaks the ability to view/inteact with vulnerabilities in the UI.
Examples
-
https://gitlab.com/gitlab-gold/security-scan-mr-demo has been set up to show how adding
rules: - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
will break things and cause unexpected behavior - https://gitlab.com/gitlab-gold/security-scan-mr-demo2 has been set up to demonstrate the expected behavior of running SAST and Dependency Scanning jobs on an Ultimate license
Additional context and examples in this issue thread: #351937 (comment 991360826)
How to set up and validate locally
- Import https://gitlab.com/gitlab-gold/security-scan-mr-demo and https://gitlab.com/gitlab-gold/security-scan-mr-demo2 into different projects.
- Make a minor merge request (simple change to README.md) on both
- Observe each of the examples of the problem outlined above create problems when using
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
rules insecurity-scan-mr-demo
while none of these problems exist withsecurity-scan-mr-demo2
(which uses defaults)
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
- Related to #351937 (closed)
- Related to #369947 (closed)
Edited by Marcel Amirault