dependency_scanning.yml

# This template is for testing cutting-edge features.
# It is not considered stable and might include breaking changes that are planned for the next major release.
# For more information: https://docs.gitlab.com/user/application_security/detect/roll_out_security_scanning/#template-editions

# To contribute improvements to CI/CD templates, please follow the Development guide at:
# https://docs.gitlab.com/development/cicd/templates/
# This specific template is located at:
# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Dependency-Scanning.gitlab-ci.yml

# Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/
#
# Configure dependency scanning with CI/CD variables (https://docs.gitlab.com/ee/ci/variables/).
# List of available variables: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#available-cicd-variables

variables:
  # Setting these variables affect all Security templates
  # (SAST, Dependency Scanning, ...)
  SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  AST_ENABLE_MR_PIPELINES: "true"
  #
  DS_EXCLUDED_ANALYZERS: ""
  DS_EXCLUDED_PATHS: "spec, test, tests, tmp, node_modules"
  DS_MAJOR_VERSION: 6
  DS_SCHEMA_MODEL: 15
  # Use this variable to enforce the new Dependency Scanning analyzer for all projects
  DS_ENFORCE_NEW_ANALYZER: 'false'

dependency_scanning:
  stage: test
  script:
    - echo "$CI_JOB_NAME is used for configuration only, and its script should not be executed"
    - exit 1
  artifacts:
    access: 'developer'
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
  dependencies: []
  rules:
    - when: never

.ds-analyzer:
  extends: dependency_scanning
  allow_failure: true
  variables:
    # DS_ANALYZER_IMAGE is an undocumented variable used internally to allow QA to
    # override the analyzer image with a custom value. This may be subject to change or
    # breakage across GitLab releases.
    DS_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/$DS_ANALYZER_NAME:$DS_MAJOR_VERSION"
    # DS_ANALYZER_NAME is an undocumented variable used in job definitions
    # to inject the analyzer name in the image name.
    DS_ANALYZER_NAME: ""
  image:
    name: "$DS_ANALYZER_IMAGE$DS_IMAGE_SUFFIX"
  # `rules` must be overridden explicitly by each child job
  # see https://gitlab.com/gitlab-org/gitlab/-/issues/218444
  script:
    - /analyzer run

.cyclonedx-reports:
  artifacts:
    access: 'developer'
    paths:
      - "**/gl-sbom-*.cdx.json"
    reports:
      cyclonedx: "**/gl-sbom-*.cdx.json"

.gemnasium-shared-rule:
  exists:
    - '**/{Gemfile.lock,composer.lock,gems.locked,go.sum,npm-shrinkwrap.json,package-lock.json,yarn.lock,pnpm-lock.yaml,packages.lock.json,conan.lock}'

gemnasium-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium"
    GEMNASIUM_LIBRARY_SCAN_ENABLED: "true"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium([^-]|$)/
      when: never
    # Don't run this job if the new DS analyzer is enforced
    - if: $DS_ENFORCE_NEW_ANALYZER == 'true'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-shared-rule, exists]

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-shared-rule, exists]

.gemnasium-maven-shared-rule:
  exists:
    - '**/{build.gradle,build.gradle.kts,build.sbt,pom.xml}'

gemnasium-maven-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium-maven"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium-maven/
      when: never
    # Don't run this job if the new DS analyzer is enforced
    - if: $DS_ENFORCE_NEW_ANALYZER == 'true'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-maven-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
        DS_REMEDIATE: "false"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-maven-shared-rule, exists]

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-maven-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-maven-shared-rule, exists]

.gemnasium-python-shared-rule:
  exists:
    - '**/{requirements.txt,requirements.pip,Pipfile,Pipfile.lock,requires.txt,setup.py,poetry.lock,uv.lock}'

gemnasium-python-dependency_scanning:
  extends:
    - .ds-analyzer
    - .cyclonedx-reports
  variables:
    DS_ANALYZER_NAME: "gemnasium-python"
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /gemnasium-python/
      when: never
    # Don't run this job if the new DS analyzer is enforced
    - if: $DS_ENFORCE_NEW_ANALYZER == 'true'
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-python-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-python-shared-rule, exists]
    ## When $PIP_REQUIREMENTS_FILE is configured
    ## See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE &&
          $CI_GITLAB_FIPS_MODE == "true"
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## When FIPS mode is enabled, use the FIPS compatible image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $CI_GITLAB_FIPS_MODE == "true"
      exists: !reference [.gemnasium-python-shared-rule, exists]
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    ## When FIPS mode is not enabled, use the regular image
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists: !reference [.gemnasium-python-shared-rule, exists]
    ## When $PIP_REQUIREMENTS_FILE is configured
    ## See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#configuring-specific-analyzers-used-by-dependency-scanning
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE &&
          $CI_GITLAB_FIPS_MODE == "true"
      variables:
        DS_IMAGE_SUFFIX: "-fips"
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/ &&
          $PIP_REQUIREMENTS_FILE

.ds-rules:
  exists:
    - '**/{$ANALYZER_SUPPORTED_FILES,$ADDITIONAL_SUPPORTED_FILES}'

dependency-scanning:
  variables:
    ANALYZER_SUPPORTED_FILES: "packages.lock.json,conan.lock,conda-lock.yml,pubspec.lock,go.mod,go.graph,ivy-report.xml,maven.graph.json,dependencies.lock,package-lock.json,npm-shrinkwrap.json,pnpm-lock.yaml,yarn.lock,Podfile.lock,composer.lock,pipdeptree.json,requirements.txt,Pipfile.lock,pipenv.graph.json,poetry.lock,uv.lock,Gemfile.lock,gems.locked,Cargo.lock,dependencies-compile.dot,Package.resolved"
    ADDITIONAL_SUPPORTED_FILES: "pom.xml,build.gradle,build.gradle.kts,build.sbt,requirements.pip,Pipfile,requires.txt,setup.py,*.csproj,*.vbproj"
    SCA_TO_SARIF_MATCHER_VERSION: "v2.0.2"
    # Variable used to track the template introducing DS analyzer. Please do not override.
    # This is an internal variable
    INTERNAL_DS_ANALYZER_CI_INTEGRATION: "template::latest"
  stage: !reference [.ds-analyzer, stage]
  image:
    name: "$SECURE_ANALYZERS_PREFIX/dependency-scanning:v0"
  script:
    - |
      echo "Using Dependency-Scanning.latest.gitlab-ci.yml"
      /analyzer run
  allow_failure: true
  artifacts:
    access: "developer"
    paths:
      - "**/gl-sbom-*.cdx.json"
    reports:
      cyclonedx: "**/gl-sbom-*.cdx.json"
      dependency_scanning: gl-dependency-scanning-report.json
  rules:
    - if: $DEPENDENCY_SCANNING_DISABLED == 'true' || $DEPENDENCY_SCANNING_DISABLED == '1'
      when: never
    - if: $DS_EXCLUDED_ANALYZERS =~ /dependency-scanning/
      when: never

    # The following 3 blocks of rules define whether the job runs in a an *MR pipeline* or a *branch pipeline*
    # when an MR exists. If the job has additional rules to observe they should be added in the blocks 1 and 3
    # to cover both the *MR pipeline* and the *branch pipeline* workflows.

    # 1. Run the job in an *MR pipeline* if MR pipelines for AST are enabled and there's an open merge request.
    ## If the new DS analyzer is enforced, run this job for all possibly supported projects including those
    ## that might need additional file(s) to be provided dynamically by the user. To do that, we use the list in
    ## ADDITIONAL_SUPPORTED_FILES to trigger the job based on non-scannable files present in the repository, and expect
    ## the scannable file(s) to be provided at runtime.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $DS_ENFORCE_NEW_ANALYZER == 'true' &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists:
        - '**/{$ANALYZER_SUPPORTED_FILES,$ADDITIONAL_SUPPORTED_FILES}'
    ## When DS_PIPCOMPILE_REQUIREMENTS_FILE_NAME_PATTERN is configured
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $DS_PIPCOMPILE_REQUIREMENTS_FILE_NAME_PATTERN &&
          $DS_ENFORCE_NEW_ANALYZER == 'true' &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/

    ## Otherwise, if the new DS analyzer is NOT enforced, run the job only if the project has files supported by the new DS analyzer
    ## and not already supported by any gemnasium job and ensure to exclude the files already covered by the gemnasium jobs from the analysis.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_PIPELINE_SOURCE == "merge_request_event" &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists:
        - '**/{conda-lock.yml,pubspec.lock,Podfile.lock,Cargo.lock,Package.resolved}'
      variables:
        DS_EXCLUDED_PATHS: 'spec, test, tests, tmp, node_modules, **/build.gradle, **/build.gradle.kts, **/build.sbt, **/pom.xml, **/requirements.txt, **/requirements.pip, **/Pipfile, **/Pipfile.lock, **/requires.txt, **/setup.py, **/poetry.lock, **/uv.lock, **/packages.lock.json, **/conan.lock, **/package-lock.json, **/npm-shrinkwrap.json, **/pnpm-lock.yaml, **/yarn.lock, **/composer.lock, **/Gemfile.lock, **/gems.locked, **/go.graph, **/ivy-report.xml, **/maven.graph.json, **/dependencies.lock, **/pipdeptree.json, **/pipenv.graph.json, **/dependencies-compile.dot'

    # 2. Don't run the job in a *branch pipeline* if *MR pipelines* for AST are enabled and there's an open merge request.
    - if: $AST_ENABLE_MR_PIPELINES == "true" &&
          $CI_OPEN_MERGE_REQUESTS
      when: never

    # 3. Finally, run the job in a *branch pipeline* (When MR pipelines are disabled for AST, or it is enabled but no open MRs exist for the branch).
    ## If the new DS analyzer is enforced, run this job for all possibly supported projects including those
    ## that might need additional file(s) to be provided dynamically by the user. To do that, we use the list in
    ## ADDITIONAL_SUPPORTED_FILES to trigger the job based on non-scannable files present in the repository, and expect
    ## the scannable file(s) to be provided at runtime.
    - if: $DS_ENFORCE_NEW_ANALYZER == 'true' &&
          $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists:
        - '**/{$ANALYZER_SUPPORTED_FILES,$ADDITIONAL_SUPPORTED_FILES}'
    ## When DS_PIPCOMPILE_REQUIREMENTS_FILE_NAME_PATTERN is configured
    - if: $DS_PIPCOMPILE_REQUIREMENTS_FILE_NAME_PATTERN &&
          $DS_ENFORCE_NEW_ANALYZER == 'true' &&
          $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/

    ## Otherwise, if the new DS analyzer is NOT enforced, run the job only if the project has files supported by the new DS analyzer
    ## and not already supported by any gemnasium job and ensure to exclude the files already covered by the gemnasium jobs from the analysis.
    - if: $CI_COMMIT_BRANCH &&
          $GITLAB_FEATURES =~ /\bdependency_scanning\b/
      exists:
        - '**/{conda-lock.yml,pubspec.lock,Podfile.lock,Cargo.lock,Package.resolved}'
      variables:
        DS_EXCLUDED_PATHS: 'spec, test, tests, tmp, node_modules, **/build.gradle, **/build.gradle.kts, **/build.sbt, **/pom.xml, **/requirements.txt, **/requirements.pip, **/Pipfile, **/Pipfile.lock, **/requires.txt, **/setup.py, **/poetry.lock, **/uv.lock, **/packages.lock.json, **/conan.lock, **/package-lock.json, **/npm-shrinkwrap.json, **/pnpm-lock.yaml, **/yarn.lock, **/composer.lock, **/Gemfile.lock, **/gems.locked, **/go.graph, **/ivy-report.xml, **/maven.graph.json, **/dependencies.lock, **/pipdeptree.json, **/pipenv.graph.json, **/dependencies-compile.dot'