Securing your code

For this sample use case, you’re going to add four scanners to your pipeline: Static Application Security Testing (SAST), Secret Detection, Dependency Scanning, and License Compliance. You’ll also review how to add a third-party scanner.

Adding SAST to the pipeline

In general, adding a GitLab-provided security scanner to a pipeline is a trivial process. To enable SAST and make sure our Hats for Cats source code doesn’t contain security vulnerabilities, we simply need to include a new template in .gitlab-ci.yml on the add-login-feature branch. Add this line anywhere within the existing include: section, making sure that it’s indented correctly:

    - template: Security/SAST.gitlab-ci.yml

This enables SAST, but we also want to configure it so that it doesn’t scan our automated test file or our fuzz target file. The GitLab documentation tells us which variable to set to accomplish this. Add a new section...