Commit 8bd94c46 authored by Andres Anaya Amariels's avatar Andres Anaya Amariels 🚀
Browse files

main_sast

parent 3132d129

capif/.gitlab-ci.yml

+31 −11
Original line number Diff line number Diff line 
stages:

  - test  # to Security and Compliance gitLab

  - main_security

#  - test  # to Security and Compliance gitLab

  - main_sast

  - main_container_scanning

  - sast

  - merge_request_staging_into_main
@@ -163,7 +163,7 @@ merge_request_staging_into_main: 
#  variables:

#      SAST_DEFAULT_ANALYZERS: "bandit" # to sast

#      CI_DEBUG_TRACE: "true"

#  stage: main_security

#  stage: main_sast

#  rules:

#    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

#      when: always
@@ -176,7 +176,7 @@ merge_request_staging_into_main: 




#sast:

#  stage: main_security

#  stage: main_sast

#  variables:

##    DOCKER_DRIVER: overlay2

#    DOCKER_HOST: tcp://docker:2375
@@ -213,8 +213,26 @@ merge_request_staging_into_main: 
#  tags:

#    - docker-in-docker



semgrep-sast:

  stage: main_security

#semgrep-sast:

#  stage: main_sast

#  variables:

##    DOCKER_DRIVER: overlay2

#    DOCKER_HOST: tcp://docker:2375

##    SAST_EXCLUDED_ANALYZERS: "nodejs-scan-sast"

#    SAST_DEFAULT_ANALYZERS: bandit

#  allow_failure: true

#  services:

#    - docker:24.0.5-dind

#  rules:

#    - if: '$CI_COMMIT_REF_NAME == "OCF16-first-steps-on-ci-at-gitlab-repository"'

#      when: always

#    - when: never

#  tags:

#    - docker-in-docker



main_semgrep_sast:

  stage: main_sast

  extends: semgrep-sast

  variables:

#    DOCKER_DRIVER: overlay2

    DOCKER_HOST: tcp://docker:2375
@@ -230,8 +248,9 @@ semgrep-sast: 
  tags:

    - docker-in-docker



kubesec-sast:

  stage: main_security

main_kubesec_sast:

  stage: main_sast

  extends: kubesec-sast

  before_script:

   - export TMP_PWD=$PWD

   - echo "TMP_PWD=$TMP_PWD"
@@ -252,8 +271,9 @@ kubesec-sast: 
  tags:

    - docker-in-docker



gemnasium-python-dependency_scanning:

  stage: main_security

main_gemnasium_python_dependency_scanning:

  stage: main_sast

  extends: gemnasium-python-dependency_scanning

  variables:

    DS_ANALYZER_NAME: "gemnasium-python"

  allow_failure: true
@@ -267,7 +287,7 @@ gemnasium-python-dependency_scanning: 
    - docker-in-docker



main_serect_detection:

  stage: main_security

  stage: main_sast

  extends: secret_detection

  variables:

    SECRET_DETECTION_HISTORIC_SCAN: "true"