Commit b574829c authored by Thomas Boni's avatar Thomas Boni
Browse files

Merge branch '401-add-options-to-sls_scan-job' into 'latest' 

Resolve "Add options to `sls_scan` job"

Closes #401

See merge request r2devops/hub!235
parents ff575f12 ed22806b

jobs/sls_scan/README.md

+3 −1
Original line number Diff line number Diff line
@@ -21,7 +21,7 @@ This job uses the [ShiftLeftSecurity sast scan](https://github.com/ShiftLeftSecu 


* Job name: `sls_scan`

* Docker image:

[`shiftleft/sast-scan`](https://hub.docker.com/r/_/shiftleft/sast-scan){:target="_blank"}

[`shiftleft/sast-scan`](https://hub.docker.com/r/shiftleft/sast-scan){:target="_blank"}

* Default stage: `static_tests`

* When: `always`
@@ -29,6 +29,8 @@ This job uses the [ShiftLeftSecurity sast scan](https://github.com/ShiftLeftSecu 


| Name | Description | Default |

| ---- | ----------- | ------- |

| `SCAN_OPTIONS` | If you want to add [additional arguments](https://slscan.io/en/latest/getting-started/#command-line-arguments) for `scan` | ` ` |

| `ENABLE_BUILD` | The option to use `--build` with the `scan` command | `true` |

| `SLS_TYPE` | If you want to specify a specific scanner to use | ` ` |

| `STOP_ON_VULN` | If you want the job to stop on the first vulnerability detected | `false` |

| `OUTPUT_PATH` | Path to scan output folder | `sls_scan_report/` |

jobs/sls_scan/job.yml

+1 −1
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ icon: 🔓 
maintainer: FulcrandG

license: MIT

images:

  "shiftleft/sast-scan": "v1.9.29"

  "shiftleft/sast-scan": "v1.15.1"

tools:

labels:

  - GitLab

jobs/sls_scan/sls_scan.yml

+8 −4
Original line number Diff line number Diff line
@@ -2,19 +2,23 @@ stages: 
  - static_tests



sls_scan:

  image: shiftleft/sast-scan:v1.9.29

  image: shiftleft/sast-scan:v1.15.1

  stage: static_tests

  variables:

    SCAN_OPTIONS: ""

    ENABLE_BUILD: "true"

    SLS_TYPE: ""

    STOP_ON_VULN: "false"

    OUTPUT_PATH: "sls_scan_report/"

  script:

    - mkdir "$OUTPUT_PATH"

    - if [ ${ENABLE_BUILD} == "true" ]; then

    -   SCAN_OPTIONS="--build ${SCAN_OPTIONS}"

    - fi

    - if [ ! -z ${SLS_TYPE} ]; then

    -   scan --build -o "$OUTPUT_PATH" -t ${SLS_TYPE} | tee output

    - else

    -   scan --build -o "$OUTPUT_PATH" | tee output

    -   SCAN_OPTIONS="${SCAN_OPTIONS} -t ${SLS_TYPE}"

    - fi

    - scan ${SCAN_OPTIONS} -o "$OUTPUT_PATH" | tee output

    - if [ ${STOP_ON_VULN} == "true" ]; then

    -   cat output | grep ❌

    -   if [ $? -eq 0 ]; then

jobs/sls_scan/versions/0.2.0.md

0 → 100644
+3 −0
Original line number Diff line number Diff line 
* Change the image version used for the job to the latest

* Add the option to use `--build`

* Add new variable `SCAN_OPTIONS` for optional arguments
 
 No newline at end of file