Skip to content

Remove Security MR pipeline config example because it breaks product functionality

What does this MR do and why?

Removes an example from our documentation about using Security scanners with MR pipelines that is known to break functionality.

Why?

Support receives tickets from Ultimate customers who've implemented what we have in our docs saying that it doesn't work as expected and it breaks the ability to view/inteact with vulnerabilities in the UI.

Examples

Feature Default Result (w/ CI_COMMIT_BRANCH) Result (w/ CI_PIPELINE_SOURCE == MR)
Vulnerability Report Vulnerabilities detected on project default branch show up in Vulnerability Report No vulnerabilities detected, Vulnerability Report is empty
Security Dashboard Vulnerabilities detected on default used to populate Security Dashboard Security Dashboard is empty
Merge Request Widget Only vulnerabilities not present on project's default branch are show in MR widget Every vulnerability detected in project's default branch shows up in MR widget
Security Pipeline Tab Only vulnerabilities not present on project's default branch are show in pipeline security tab Every vulnerability detected in project's default branch shows up in Pipeline security tab
Security scanners only run if supported languages or frameworks files are detected in repo Security scanners only run when supported programming languages and frameworks are detected in codebase Broken - All Security Scans run on all Merge Requests even if there are zero files of that type to scan
SAST_DISABLED / DEPENDENCY_SCANNING_DISABLED job variables Respected Ignored - all 18 SAST/DS scanner jobs ran even though SAST and DS were explicitly disabled
SAST/DS EXCLUDED_ANALYZERS job variables Respected Ignored - all 18 SAST/DS scanner jobs ran even though SAST and DS were explicitly excluded

Additional context and examples in this issue thread: #351937 (comment 991360826)

How to set up and validate locally

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Marcel Amirault

Merge request reports

Loading