Set ADVANCED_SAST_PARTIAL_SCAN to false for SEP
What does this MR do and why?
This MR enhances the Security Execution Policies (SEP) functionality by:
-
Adding support for inputs in SEP templates- Introduces a new input interpolation system that allows security scan templates to accept configurable inputs(More details in this comment) - Setting ADVANCED_SAST_PARTIAL_SCAN to false by default - Ensures full ADVANCED SAST scans are performed by default in security policies
Key Changes:
-
Template Input Support: AddedDEFAULT_INPUTSconfiguration and modifiedtemplate_ci_configurationmethod to support input interpolation usingGitlab::Ci::Config::Interpolation::Template -
SAST Configuration: Added
ADVANCED_SAST_PARTIAL_SCAN: 'false'to default variables for SAST scans to ensure comprehensive security scanning
This enhancement provides more flexibility for security policy configuration while maintaining secure defaults.
References
Related to #545689 (closed)
How to set up and validate locally
- Create or modify a Security Execution Policy that uses SAST scanning
- Verify that
ADVANCED_SAST_PARTIAL_SCANis set tofalsein the generated CI configuration Test input interpolation by configuring a policy with custom inputs- Confirm that the security scan jobs execute with the expected configuration
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Shao Ming Tan