diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index cd227143ccd6b5f04a875fd2a1d41e241d467ff5..8ea06b4d1fa7bf776bcd0633e9adc37589e1219a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,5 +1,4 @@ variables: - SAST_EXCLUDED_ANALYZERS: "semgrep-sast,gosec-sast" DOCKER_DRIVER: overlay2 workflow: diff --git a/ui/.gitlab-ci.yml b/ui/.gitlab-ci.yml index 86d9044aeb27ce4360286b357287c517bbebabff..bc0f4c8f0576528652df503d72b635891eeddbbb 100644 --- a/ui/.gitlab-ci.yml +++ b/ui/.gitlab-ci.yml @@ -1,5 +1,4 @@ include: - - template: Security/SAST.gitlab-ci.yml - local: 'ui/packages/ce/.gitlab-ci.yml' - local: 'ui/packages/platform/.gitlab-ci.yml' @@ -10,7 +9,7 @@ include: changes: - ui/**/* -check_code_style: +check-code-style: <<: *only_ui stage: test image: node:16.13.0 @@ -19,20 +18,22 @@ check_code_style: - npm --prefix ui/ run lint -w packages/ce - npm --prefix ui/ run lint -w packages/platform -eslint-sast: - <<: *only_ui - extends: .sast-analyzer - image: - name: "$SAST_ANALYZER_IMAGE" - variables: - SAST_ANALYZER_IMAGE_TAG: 2 - SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/eslint:$SAST_ANALYZER_IMAGE_TAG" - -nodejs-scan-sast: +semgrep-sast: + stage: test + image: returntocorp/semgrep <<: *only_ui - extends: .sast-analyzer - image: - name: "$SAST_ANALYZER_IMAGE" variables: - SAST_ANALYZER_IMAGE_TAG: 2 - SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/nodejs-scan:$SAST_ANALYZER_IMAGE_TAG" + # See more at semgrep.dev/explore. + SEMGREP_RULES: >- + p/security-audit + p/secrets + p/default + p/owasp-top-ten + p/javascript + p/react + # Upload findings to GitLab SAST Dashboard: + SEMGREP_GITLAB_JSON: "1" + script: semgrep ci --gitlab-sast > gl-sast-report.json || true + artifacts: + reports: + sast: gl-sast-report.json