[go: up one dir, main page]

Skip to content

Set ADVANCED_SAST_PARTIAL_SCAN to false for SEP

What does this MR do and why?

This MR enhances the Security Execution Policies (SEP) functionality by:

  1. Adding support for inputs in SEP templates - Introduces a new input interpolation system that allows security scan templates to accept configurable inputs(More details in this comment)
  2. Setting ADVANCED_SAST_PARTIAL_SCAN to false by default - Ensures full ADVANCED SAST scans are performed by default in security policies

Key Changes:

  • Template Input Support: Added DEFAULT_INPUTS configuration and modified template_ci_configuration method to support input interpolation using Gitlab::Ci::Config::Interpolation::Template
  • SAST Configuration: Added ADVANCED_SAST_PARTIAL_SCAN: 'false' to default variables for SAST scans to ensure comprehensive security scanning

This enhancement provides more flexibility for security policy configuration while maintaining secure defaults.

References

Related to #545689 (closed)

How to set up and validate locally

  1. Create or modify a Security Execution Policy that uses SAST scanning
  2. Verify that ADVANCED_SAST_PARTIAL_SCAN is set to false in the generated CI configuration
  3. Test input interpolation by configuring a policy with custom inputs
  4. Confirm that the security scan jobs execute with the expected configuration

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Shao Ming Tan

Merge request reports

Loading