Merge branch 'e2300-ds-template' into 'master'

Migrate Dependency-Scanning CI template to rules syntax

See merge request gitlab-org/gitlab!30907

changelogs/unreleased/e2300-ds-template.yml

+---
+title: Migrate Dependency-Scanning CI template to rules syntax
+merge_request: 30907
+author:
+type: changed

ee/spec/lib/gitlab/ci/templates/dependency_scanning_gitlab_ci_yaml_spec.rb

@@ -8,7 +8,8 @@ describe 'Dependency-Scanning.gitlab-ci.yml' do
   describe 'the created pipeline' do
     let(:user) { create(:admin) }
     let(:default_branch) { 'master' }
-    let(:project) { create(:project, :custom_repo, files: { 'README.txt' => '' }) }
+    let(:files) { { 'README.txt' => '' } }
+    let(:project) { create(:project, :custom_repo, files: files) }
     let(:service) { Ci::CreatePipelineService.new(project, user, ref: 'master' ) }
     let(:pipeline) { service.execute!(:push) }
     let(:build_names) { pipeline.builds.pluck(:name) }
@@ -48,37 +49,51 @@ describe 'Dependency-Scanning.gitlab-ci.yml' do
         end
       end
 
-      context 'when DS_DISABLE_DIND=1' do
+      context 'when DS_DISABLE_DIND=true' do
         before do
-          create(:ci_variable, project: project, key: 'DS_DISABLE_DIND', value: '1')
+          create(:ci_variable, project: project, key: 'DS_DISABLE_DIND', value: 'true')
         end
 
         describe 'language detection' do
           using RSpec::Parameterized::TableSyntax
 
-          where(:case_name, :variables, :include_build_names) do
-            'Go'                   | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "go" }              | %w(gemnasium-dependency_scanning)
-            'Java'                 | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "java" }            | %w(gemnasium-maven-dependency_scanning)
-            'Javascript'           | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "javascript" }      | %w(gemnasium-dependency_scanning retire-js-dependency_scanning)
-            'Multiple languages'   | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "java,javascript" } | %w(gemnasium-dependency_scanning gemnasium-maven-dependency_scanning retire-js-dependency_scanning)
-            'PHP'                  | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "php" }             | %w(gemnasium-dependency_scanning)
-            'Python'               | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "python" }          | %w(gemnasium-python-dependency_scanning)
-            'Ruby'                 | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "ruby" }            | %w(bundler-audit-dependency_scanning gemnasium-dependency_scanning)
-            'Scala'                | { "CI_PROJECT_REPOSITORY_LANGUAGES" => "scala" }           | %w(gemnasium-maven-dependency_scanning)
+          where(:case_name, :files, :include_build_names) do
+            'Go'                             | { 'go.sum' => '' }                        | %w(gemnasium-dependency_scanning)
+            'Java'                           | { 'pom.xml' => '' }                       | %w(gemnasium-maven-dependency_scanning)
+            'Java Gradle'                    | { 'build.gradle' => '' }                  | %w(gemnasium-maven-dependency_scanning)
+            'Javascript'                     | { 'package.json' => '' }                  | %w(retire-js-dependency_scanning)
+            'Javascript package-lock.json'   | { 'package-lock.json' => '' }             | %w(gemnasium-dependency_scanning)
+            'Javascript yarn.lock'           | { 'yarn.lock' => '' }                     | %w(gemnasium-dependency_scanning)
+            'Javascript npm-shrinkwrap.json' | { 'npm-shrinkwrap.json' => '' }           | %w(gemnasium-dependency_scanning)
+            'Multiple languages'             | { 'pom.xml' => '', 'package.json' => '' } | %w(gemnasium-maven-dependency_scanning retire-js-dependency_scanning)
+            'PHP'                            | { 'composer.lock' => '' }                 | %w(gemnasium-dependency_scanning)
+            'Python requirements.txt'        | { 'requirements.txt' => '' }              | %w(gemnasium-python-dependency_scanning)
+            'Python requirements.pip'        | { 'requirements.pip' => '' }              | %w(gemnasium-python-dependency_scanning)
+            'Python Pipfile'                 | { 'Pipfile' => '' }                       | %w(gemnasium-python-dependency_scanning)
+            'Python Pipfile.lock'            | { 'Pipfile.lock' => '' }                  | %w(gemnasium-dependency_scanning)
+            'Python requires.txt'            | { 'requires.txt' => '' }                  | %w(gemnasium-python-dependency_scanning)
+            'Python with setup.py'           | { 'setup.py' => '' }                      | %w(gemnasium-python-dependency_scanning)
+            'Ruby Gemfile.lock'              | { 'Gemfile.lock' => '' }                  | %w(bundler-audit-dependency_scanning gemnasium-dependency_scanning)
+            'Ruby gems.locked'               | { 'gems.locked' => '' }                   | %w(gemnasium-dependency_scanning)
+            'Scala'                          | { 'build.sbt' => '' }                     | %w(gemnasium-maven-dependency_scanning)
           end
 
           with_them do
-            before do
-              variables.each do |(key, value)|
-                create(:ci_variable, project: project, key: key, value: value)
-              end
-            end
-
             it 'creates a pipeline with the expected jobs' do
               expect(build_names).to include(*include_build_names)
             end
           end
         end
+
+        context 'when PIP_REQUIREMENTS_FILE is defined' do
+          before do
+            create(:ci_variable, project: project, key: 'PIP_REQUIREMENTS_FILE', value: '/some/path/requirements.txt')
+          end
+
+          it 'creates a pipeline with the expected jobs' do
+            expect(build_names).to include('gemnasium-python-dependency_scanning')
+          end
+        end
       end
     end
   end

lib/gitlab/ci/templates/Security/Dependency-Scanning.gitlab-ci.yml

@@ -77,23 +77,20 @@ dependency_scanning:
     reports:
       dependency_scanning: gl-dependency-scanning-report.json
   dependencies: []
-  only:
-    refs:
-      - branches
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/
-  except:
-    variables:
-      - $DEPENDENCY_SCANNING_DISABLED
-      - $DS_DISABLE_DIND == 'true'
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'true'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
 
 .ds-analyzer:
   extends: dependency_scanning
   services: []
-  except:
-    variables:
-      - $DEPENDENCY_SCANNING_DISABLED
-      - $DS_DISABLE_DIND == 'false'
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
   script:
     - /analyzer run
 
@@ -101,48 +98,82 @@ gemnasium-dependency_scanning:
   extends: .ds-analyzer
   image:
     name: "$DS_ANALYZER_IMAGE_PREFIX/gemnasium:$DS_MAJOR_VERSION"
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
-        $DS_DEFAULT_ANALYZERS =~ /gemnasium([^-]|$)/ &&
-        $CI_PROJECT_REPOSITORY_LANGUAGES =~ /ruby|javascript|php|\bgo\b/
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /gemnasium([^-]|$)/
+      exists:
+        - 'Gemfile.lock'
+        - 'Pipfile.lock'
+        - 'composer.lock'
+        - 'gems.locked'
+        - 'go.sum'
+        - 'npm-shrinkwrap.json'
+        - 'package-lock.json'
+        - 'yarn.lock'
 
 gemnasium-maven-dependency_scanning:
   extends: .ds-analyzer
   image:
     name: "$DS_ANALYZER_IMAGE_PREFIX/gemnasium-maven:$DS_MAJOR_VERSION"
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
-        $DS_DEFAULT_ANALYZERS =~ /gemnasium-maven/ &&
-        $CI_PROJECT_REPOSITORY_LANGUAGES =~ /\b(java|scala)\b/
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /gemnasium-maven/
+      exists:
+        - 'build.gradle'
+        - 'build.sbt'
+        - 'pom.xml'
 
 gemnasium-python-dependency_scanning:
   extends: .ds-analyzer
   image:
     name: "$DS_ANALYZER_IMAGE_PREFIX/gemnasium-python:$DS_MAJOR_VERSION"
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
-        $DS_DEFAULT_ANALYZERS =~ /gemnasium-python/ &&
-        $CI_PROJECT_REPOSITORY_LANGUAGES =~ /python/
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /gemnasium-python/
+      exists:
+        - 'requirements.txt'
+        - 'requirements.pip'
+        - 'Pipfile'
+        - 'requires.txt'
+        - 'setup.py'
+      # Support passing of $PIP_REQUIREMENTS_FILE
+      # See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /gemnasium-python/ &&
+          $PIP_REQUIREMENTS_FILE
 
 bundler-audit-dependency_scanning:
   extends: .ds-analyzer
   image:
     name: "$DS_ANALYZER_IMAGE_PREFIX/bundler-audit:$DS_MAJOR_VERSION"
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
-        $DS_DEFAULT_ANALYZERS =~ /bundler-audit/ &&
-        $CI_PROJECT_REPOSITORY_LANGUAGES =~ /ruby/
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /bundler-audit/
+      exists:
+        - 'Gemfile.lock'
 
 retire-js-dependency_scanning:
   extends: .ds-analyzer
   image:
     name: "$DS_ANALYZER_IMAGE_PREFIX/retire.js:$DS_MAJOR_VERSION"
-  only:
-    variables:
-      - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
-        $DS_DEFAULT_ANALYZERS =~ /retire.js/ &&
-        $CI_PROJECT_REPOSITORY_LANGUAGES =~ /javascript/
+  rules:
+    - if: $DEPENDENCY_SCANNING_DISABLED || $DS_DISABLE_DIND == 'false'
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
+          $DS_DEFAULT_ANALYZERS =~ /retire.js/
+      exists:
+        - 'package.json'