diff --git a/ee/app/services/security/security_orchestration_policies/scan_pipeline_service.rb b/ee/app/services/security/security_orchestration_policies/scan_pipeline_service.rb index abfdf0aa1e5419d109f3c55b12916ba4fd58013d..6eedd17acd8c55b4e92b9ef8997722c9f93aa201 100644 --- a/ee/app/services/security/security_orchestration_policies/scan_pipeline_service.rb +++ b/ee/app/services/security/security_orchestration_policies/scan_pipeline_service.rb @@ -21,7 +21,8 @@ class ScanPipelineService sast: { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS', - 'SAST_EXCLUDED_ANALYZERS' => '' + 'SAST_EXCLUDED_ANALYZERS' => '', + 'ADVANCED_SAST_PARTIAL_SCAN' => 'false' }, sast_iac: { 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', diff --git a/ee/spec/lib/ee/gitlab/ci/variables/builder/scan_execution_policies_spec.rb b/ee/spec/lib/ee/gitlab/ci/variables/builder/scan_execution_policies_spec.rb index 43f277168bb0cfddb03af62a15d903f6208c32c6..93d619b2b8c7ee757d79fd2ceb00a6668d64dec9 100644 --- a/ee/spec/lib/ee/gitlab/ci/variables/builder/scan_execution_policies_spec.rb +++ b/ee/spec/lib/ee/gitlab/ci/variables/builder/scan_execution_policies_spec.rb @@ -73,7 +73,8 @@ 'container-scanning-0' | { 'CS_REGISTRY_USER' => 'user' } 'brakeman-sast-1' | { 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS', - 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp' } + 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', + 'ADVANCED_SAST_PARTIAL_SCAN' => 'false' } 'secret-detection-2' | { 'SECRET_DETECTION_HISTORIC_SCAN' => 'true', 'SECRET_DETECTION_EXCLUDED_PATHS' => '' } 'kics-iac-sast-3' | { 'SAST_IMAGE_SUFFIX' => '-fips', @@ -138,7 +139,8 @@ [ item(key: 'DEFAULT_SAST_EXCLUDED_PATHS', value: 'spec, test, tests, tmp'), item(key: 'SAST_EXCLUDED_PATHS', value: '$DEFAULT_SAST_EXCLUDED_PATHS'), - item(key: 'SAST_EXCLUDED_ANALYZERS', value: 'semgrep') + item(key: 'SAST_EXCLUDED_ANALYZERS', value: 'semgrep'), + item(key: 'ADVANCED_SAST_PARTIAL_SCAN', value: 'false') ] end end diff --git a/ee/spec/services/security/security_orchestration_policies/create_pipeline_service_spec.rb b/ee/spec/services/security/security_orchestration_policies/create_pipeline_service_spec.rb index 16ce0e5f62b49c34899633b819f7eedd1e245f51..55b123bd8816dea52534632a937c7bb0f34ab5a4 100644 --- a/ee/spec/services/security/security_orchestration_policies/create_pipeline_service_spec.rb +++ b/ee/spec/services/security/security_orchestration_policies/create_pipeline_service_spec.rb @@ -437,7 +437,7 @@ expect_next_instance_of(::Security::SecurityOrchestrationPolicies::CiConfigurationService) do |ci_configuration_service| expect(ci_configuration_service).to receive(:execute).once.with( actions.first, - { 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS' }, + { 'ADVANCED_SAST_PARTIAL_SCAN' => 'false', 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS' }, kind_of(Gitlab::Ci::Config::External::Context), 0 ).and_call_original end diff --git a/ee/spec/services/security/security_orchestration_policies/scan_pipeline_service_spec.rb b/ee/spec/services/security/security_orchestration_policies/scan_pipeline_service_spec.rb index 8d431ef63560bdbc19f8317606d1de021aa64cad..bde305f9b7e39ed11d4c6d577d198f2c827af1fb 100644 --- a/ee/spec/services/security/security_orchestration_policies/scan_pipeline_service_spec.rb +++ b/ee/spec/services/security/security_orchestration_policies/scan_pipeline_service_spec.rb @@ -113,12 +113,12 @@ context 'when action contains variables overriding predefined ones' do let(:actions) { [{ scan: 'sast', variables: { SAST_EXCLUDED_ANALYZERS: 'semgrep', 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp, other_location' } }] } - it_behaves_like 'creates scan jobs', pipeline_scan_job_templates: %w[Jobs/SAST], variables: { 'sast-0': { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp, other_location' } } + it_behaves_like 'creates scan jobs', pipeline_scan_job_templates: %w[Jobs/SAST], variables: { 'sast-0': { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp, other_location', 'ADVANCED_SAST_PARTIAL_SCAN' => 'false' } } it 'allows passing variables from the action into configuration service' do expect_next_instance_of(::Security::SecurityOrchestrationPolicies::CiConfigurationService) do |ci_configuration_service| expect(ci_configuration_service).to receive(:execute).once - .with(actions.first, { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp, other_location' }, context, 0).and_call_original + .with(actions.first, { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => 'semgrep', 'SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp, other_location', 'ADVANCED_SAST_PARTIAL_SCAN' => 'false' }, context, 0).and_call_original end subject @@ -172,7 +172,7 @@ it_behaves_like 'creates scan jobs', on_demand_jobs: %i[dast-on-demand-0], pipeline_scan_job_templates: %w[Jobs/Secret-Detection Jobs/Container-Scanning Jobs/SAST], - variables: { 'container-scanning-1': {}, 'dast-on-demand-0': {}, 'sast-2': { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => '', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS' }, 'secret-detection-0': { 'SECRET_DETECTION_HISTORIC_SCAN' => 'false', 'SECRET_DETECTION_EXCLUDED_PATHS' => '' } } + variables: { 'container-scanning-1': {}, 'dast-on-demand-0': {}, 'sast-2': { 'DEFAULT_SAST_EXCLUDED_PATHS' => 'spec, test, tests, tmp', 'SAST_EXCLUDED_ANALYZERS' => '', 'SAST_EXCLUDED_PATHS' => '$DEFAULT_SAST_EXCLUDED_PATHS', 'ADVANCED_SAST_PARTIAL_SCAN' => 'false' }, 'secret-detection-0': { 'SECRET_DETECTION_HISTORIC_SCAN' => 'false', 'SECRET_DETECTION_EXCLUDED_PATHS' => '' } } end context 'when there are valid and invalid actions' do