sast

  only:

    - staging

#sast:

#  variables:

#      SAST_DEFAULT_ANALYZERS: "bandit" # to sast

#      CI_DEBUG_TRACE: "true"

#  stage: main_security

#  rules:

#    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

#      when: always

#    - when: never

#  script:

#    - |

#      echo "This is the SAST stage for your Python project."

#  tags:

#    - docker

test:

  stage: main_security

  script:

    - |

      pip install -U pytest

      pytest capif/services/register

  tags:

    - shell

sast:

  variables:

      SAST_DEFAULT_ANALYZERS: "bandit" # to sast

      CI_DEBUG_TRACE: "true"

  stage: main_security

  rules:

    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

      when: always

    - when: never

  variables:

#    DOCKER_DRIVER: overlay2

    DOCKER_HOST: tcp://docker:2375

  allow_failure: true

  services:

    - docker:24.0.5-dind

  script:

    - export SAST_VERSION=${SP_VERSION:-$(echo \"$CI_SERVER_VERSION\" | sed 's/^\\([0-9]*\\)\\.\\([0-9]*\\).*/\\1-\\2-stable/')}

    - |

      echo "This is the SAST stage for your Python project."

      docker run \

        --env SAST_ANALYZER_IMAGES \

        --env SAST_ANALYZER_IMAGE_PREFIX \

        --env SAST_ANALYZER_IMAGE_TAG \

        --env SAST_DEFAULT_ANALYZERS=bandit \

        --env SAST_BRAKEMAN_LEVEL \

        --env SAST_GOSEC_LEVEL \

        --env SAST_FLAWFINDER_LEVEL \

        --env SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \

        --env SAST_PULL_ANALYZER_IMAGE_TIMEOUT \

        --env SAST_RUN_ANALYZER_TIMEOUT \

        --volume \"$PWD:/code\" \

        --volume /var/run/docker.sock:/var/run/docker.sock \

        \"registry.gitlab.com/gitlab-org/security-products/sast:$SAST_VERSION\" /app/bin/run services/register

  dependencies: []

  artifacts:

    reports:

      sast: gl-sast-report.json

  tags:

    - docker

    - docker-in-docker

#ci_in_staging:

#  stage: ci_in_staging