Merge branch 'skip_dast_when_review_disabled_set_27309' into 'master'

Skip DAST when REVIEW_DISABLED is set

See merge request gitlab-org/gitlab!29876

doc/topics/autodevops/stages.md

@@ -241,6 +241,8 @@ You can disable DAST:
 - On all branches by setting the `DAST_DISABLED` environment variable to `"true"`.
 - Only on the default branch by setting the `DAST_DISABLED_FOR_DEFAULT_BRANCH`
   environment variable to `"true"`.
+- Only on feature branches by setting `REVIEW_DISABLED` environment variable to
+  `"true"`. This also disables the Review App.
 
 ## Auto Browser Performance Testing **(PREMIUM)**
 

lib/gitlab/ci/templates/Security/DAST.gitlab-ci.yml

@@ -36,3 +36,4 @@ dast:
     variables:
       - $DAST_DISABLED
       - $DAST_DISABLED_FOR_DEFAULT_BRANCH && $CI_DEFAULT_BRANCH == $CI_COMMIT_REF_NAME
+      - $CI_DEFAULT_BRANCH != $CI_COMMIT_REF_NAME && $REVIEW_DISABLED && $DAST_WEBSITE == null && $DAST_API_SPECIFICATION == null