FAQ | This is a LIVE service | Changelog

Skip to content
Commit 29054dfc authored by Dr Rich Wareham's avatar Dr Rich Wareham
Browse files

feat: mark SAST jobs as needing no build artefacts 

In #150 it was noted that the SAST jobs in the mandatory jobs template
runs in the "test" stage which means that all artefacts generated in the
"build" stage are copied over before the scanning commences.

This can lead to large numbers of false positives. For example a project
which performs a `yarn install` in the build stage will have a large
number of files in `node_modules` of which it is almost certain one will
trigger a SAST report. Similarly a `mkdocs:publish` job from the common
template builds a documentation site in `public/` which uses JS assets
from third part projects which trigger SAST findings.

Any vulnerabilities in downstream projects are better reported as
SBOM-based vulnerability reports rather than as a result of active SAST
scanning.

Add `dependencies: []` to all SAST-related CI jobs added to the
mandatory jobs templates. This has the effect of a) causing the SAST
jobs to start immediately but also b) to dtop downloading build
artefacts.

Arguably one might also want to extend this to the secret detection jobs
but it is more likely that a build artefact genuinely *will* leak a
secret and also it is less likely that a downstream dependency will
trigger a false positive secret detection report.

Closes #150
parent d4a4be18
Show whitespace changes
Inline Side-by-side
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment