Skip to content

ci(security): GitLab Ultimate security testing suite (SAST, dep scan, secret detection, IaC)

Jérôme Revillard requested to merge ci/security-testing-suite into main

What

Adds GitLab Ultimate's official security testing suite on top of the container scanning from !170 (merged). Four include: templates, no job code — pure additions.

Templates added (all advisory, test stage, → security dashboard + MR widget)

Template Scans Why for GENIE.AI
Secret-Detection source + git history leaked tokens/passwords (env templates, ansible vault refs, configs)
SAST source code JS/Vue, Python, Dart vulns
Dependency-Scanning deps (npm, pip, pub) known vulns in dependencies
SAST-IaC (KICS) docker-compose, ansible, k8s infrastructure misconfigs

Blocking model

Same as container scanning: templates are advisory (allow_failure), findings populate the security dashboard + MR widget. Blocking on HIGH/CRITICAL is enforced by MR approval rules (project setting, configured separately) — not by the jobs themselves.

Verification

  • glab ci lint valid
  • 4 suites run in test stage, advisory
  • findings populate security dashboard

Follow-up (separate)

  • Tune exclusions (vendored code, node_modules, etc.) based on initial findings
  • Configure MR approval rules for HIGH/CRITICAL blocking
  • Triage initial findings (vulnerability-allowlist / fix)

Merge request reports