Skip to content

Add support for disabling predefined rules via custom rulesets

Craig Smith requested to merge craigmsmith-enable-ruleset into master

What does this MR do?

This merge request updates the convert function to ensure that rules disabled in the ruleset are not included in the SAST report. This change addresses an inconsistency in our documentation and implementation.

Background

In our documentation (https://docs.gitlab.com/ee/user/application_security/sast/customize_rulesets.html#disable-predefined-rules), we stated that all SAST analyzers support the "Disable Predefined Rules" feature. However, it was discovered that this particular analyzer did not adhere to this statement.

Changes

  1. Move helm fixture to helm/default
  2. Introduce a new fixture helm/with-rules-disabled which introduces a .gitlab/sast-rules.toml
  3. Add integration spec to test that rules are disabled
  4. Updated the convert function to exclude rules that are disabled in the ruleset from the final SAST report.

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Edited by Craig Smith

Merge request reports

Loading