Merge branch 'document-internal-secure-vars' into 'master'

Add comments to document internal secure variables See merge request gitlab-org/gitlab!55713

Merge branch 'document-internal-secure-vars' into 'master'
Add comments to document internal secure variables See merge request gitlab-org/gitlab!55713
9197f9c5 · Sean McGivern · 8e906556 · b36fc45e · 9197f9c5 · 9197f9c5
Commit 9197f9c5 authored Mar 08, 2021 by Sean McGivern
3 changed files
--- a/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml
@@ -18,6 +18,9 @@ container_scanning:
    # file. See https://docs.gitlab.com/ee/user/application_security/container_scanning/index.html#overriding-the-container-scanning-template
    # for details
    GIT_STRATEGY: none
+    # CS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    CS_ANALYZER_IMAGE: $SECURE_ANALYZERS_PREFIX/klar:$CS_MAJOR_VERSION
  allow_failure: true
  services:

--- a/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml
@@ -38,6 +38,9 @@ gemnasium-dependency_scanning:
  image:
    name: "$DS_ANALYZER_IMAGE"
  variables:
+    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gemnasium:$DS_MAJOR_VERSION"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED
@@ -61,6 +64,9 @@ gemnasium-maven-dependency_scanning:
  image:
    name: "$DS_ANALYZER_IMAGE"
  variables:
+    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gemnasium-maven:$DS_MAJOR_VERSION"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED
@@ -79,6 +85,9 @@ gemnasium-python-dependency_scanning:
  image:
    name: "$DS_ANALYZER_IMAGE"
  variables:
+    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gemnasium-python:$DS_MAJOR_VERSION"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED
@@ -104,6 +113,9 @@ bundler-audit-dependency_scanning:
  image:
    name: "$DS_ANALYZER_IMAGE"
  variables:
+    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/bundler-audit:$DS_MAJOR_VERSION"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED
@@ -119,6 +131,9 @@ retire-js-dependency_scanning:
  image:
    name: "$DS_ANALYZER_IMAGE"
  variables:
+    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/retire.js:$DS_MAJOR_VERSION"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED

--- a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
@@ -41,6 +41,9 @@ bandit-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/bandit:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -57,6 +60,9 @@ brakeman-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/brakeman:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -74,6 +80,9 @@ eslint-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/eslint:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -94,6 +103,9 @@ flawfinder-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/flawfinder:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -111,6 +123,9 @@ kubesec-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/kubesec:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -126,6 +141,9 @@ gosec-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/gosec:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -147,6 +165,9 @@ mobsf-android-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/mobsf:$SAST_ANALYZER_IMAGE_TAG"
    MOBSF_API_KEY: key
  rules:
@@ -170,6 +191,9 @@ mobsf-ios-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/mobsf:$SAST_ANALYZER_IMAGE_TAG"
    MOBSF_API_KEY: key
  rules:
@@ -188,6 +212,9 @@ nodejs-scan-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/nodejs-scan:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -204,6 +231,9 @@ phpcs-security-audit-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/phpcs-security-audit:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -220,6 +250,9 @@ pmd-apex-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/pmd-apex:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -236,6 +269,9 @@ security-code-scan-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/security-code-scan:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -253,6 +289,9 @@ semgrep-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/semgrep:latest"
  rules:
    - if: $SAST_DISABLED
@@ -270,6 +309,9 @@ sobelow-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/sobelow:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_DISABLED
@@ -286,6 +328,9 @@ spotbugs-sast:
  image:
    name: "$SAST_ANALYZER_IMAGE"
  variables:
+    # SAST_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
+    # override the analyzer image with a custom value. This may be subject to change or
+    # breakage across GitLab releases.
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/spotbugs:$SAST_ANALYZER_IMAGE_TAG"
  rules:
    - if: $SAST_EXCLUDED_ANALYZERS =~ /spotbugs/