Commit 36a37dd7 authored by Andres Anaya Amariels's avatar Andres Anaya Amariels 🚀
Browse files

staging_semgrep_sast

parent 86016170

capif/templates/ci_staging.gitlab-ci.yml

+28 −5
Original line number Diff line number Diff line 
stages:

#  - staging_pulling_repo

  - test

  - staging_secrets_in_repo

  - staging_linting_code

  - staging_linting_docker
@@ -22,6 +23,18 @@ variables: 
  tags:

    - shell



.staging_dnd: &staging_dnd

  allow_failure: true

  only:

    - merge_requests

  except:

    variables:

      - $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != "staging"

  services:

    - docker:24.0.5-dind

  tags:

    - docker-in-docker



#staging_pulling_repo:

#  stage: staging_pulling_repo

#  script:
@@ -159,13 +172,23 @@ staging_cvs: 
    expire_in: "1 week"

  <<: *staging_common    



staging_sast:

semgrep-sast:

  stage: test

  before_script:

    - echo " ----- not run test stage -----"

  rules:

    - when: never



staging_semgrep_sast:

  needs: ["staging_linting_docker"]

  stage: staging_security

  script: 

   - |

    echo "------ Static Application Security Testing ------"

  <<: *staging_common

  extends: semgrep-sast

  variables:

#    DOCKER_DRIVER: overlay2

    DOCKER_HOST: tcp://docker:2375

#    SAST_EXCLUDED_ANALYZERS: "nodejs-scan-sast"

    SAST_DEFAULT_ANALYZERS: bandit

  <<: *staging_dnd



staging_sca:

  needs: ["staging_linting_docker"]