Commit 3c2bf60c authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge branch '5040-sast-documentation-snippet-is-invalid' into 'master'

Resolve "SAST documentation snippet is invalid"

Closes #5040

See merge request gitlab-org/gitlab-ee!4721
parents cf3bf235 93492538
...@@ -12,9 +12,6 @@ First, you need GitLab Runner with [docker-in-docker executor](https://docs.gitl ...@@ -12,9 +12,6 @@ First, you need GitLab Runner with [docker-in-docker executor](https://docs.gitl
You can then add a new job to `.gitlab-ci.yml`, called `sast`: You can then add a new job to `.gitlab-ci.yml`, called `sast`:
```yaml ```yaml
before_script:
- *functions
sast: sast:
image: docker:latest image: docker:latest
variables: variables:
...@@ -23,43 +20,18 @@ sast: ...@@ -23,43 +20,18 @@ sast:
services: services:
- docker:dind - docker:dind
script: script:
- setup_docker - export SAST_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
- sast - docker run
--env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
--env SAST_DISABLE_REMOTE_CHECKS="${SAST_DISABLE_REMOTE_CHECKS:-false}"
--volume "$PWD:/code"
--volume /var/run/docker.sock:/var/run/docker.sock
"registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION" /app/bin/run /code
artifacts: artifacts:
paths: [gl-sast-report.json] paths: [gl-sast-report.json]
.functions: &functions |
# Variables and functions
function setup_docker() {
if ! docker info &>/dev/null; then
if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then
export DOCKER_HOST='tcp://localhost:2375'
fi
fi
}
function sast() {
case "$CI_SERVER_VERSION" in
*-ee)
# Extract "MAJOR.MINOR" from CI_SERVER_VERSION and generate "MAJOR-MINOR-stable"
SAST_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
docker run --env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}" \
--env SAST_DISABLE_REMOTE_CHECKS="${SAST_DISABLE_REMOTE_CHECKS:-false}" \
--volume "$PWD:/code" \
--volume /var/run/docker.sock:/var/run/docker.sock \
"registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION" /app/bin/run /code
;;
*)
echo "GitLab Enterprise Edition is required"
;;
esac
}
``` ```
The above example will create a `sast` job in your CI pipeline and will allow The above example will create a `sast` job in the `test` stage and will create the required report artifact. Check the
you to download and analyze the report artifact in JSON format. Check the
[Auto-DevOps template](https://gitlab.com/gitlab-org/gitlab-ci-yml/blob/master/Auto-DevOps.gitlab-ci.yml) [Auto-DevOps template](https://gitlab.com/gitlab-org/gitlab-ci-yml/blob/master/Auto-DevOps.gitlab-ci.yml)
for a full reference. for a full reference.
...@@ -82,7 +54,7 @@ TIP: **Tip:** ...@@ -82,7 +54,7 @@ TIP: **Tip:**
Starting with [GitLab Ultimate][ee] 10.3, this information will Starting with [GitLab Ultimate][ee] 10.3, this information will
be automatically extracted and shown right in the merge request widget. To do be automatically extracted and shown right in the merge request widget. To do
so, the CI job must be named `sast` and the artifact path must be so, the CI job must be named `sast` and the artifact path must be
`gl-sast-report.json`. `gl-sast-report.json`. Make sure your pipeline has a stage nammed `test`, or specify another existing stage inside the `sast` job.
[Learn more on application security testing results shown in merge requests](../../user/project/merge_requests/sast.md). [Learn more on application security testing results shown in merge requests](../../user/project/merge_requests/sast.md).
## Supported languages and frameworks ## Supported languages and frameworks
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment