Gitlab CI seems to now provide quite a lot of features to support automated security scans and quality gates, see:
https://docs.gitlab.com/user/application_security/get-started-security/
https://about.gitlab.com/blog/security-configuration-profiles/
These features are not currently implemented in the module.
Enable security scans on Gitlab CI:
RUN_JOB_SECRET_DETECTION.See similar issues:
Additional change:
Maybe re-enable job phpstan (previous major) and use the before script method in the Gitlab CI config to remove the attributes prompting the errors, see for example:
https://git.drupalcode.org/project/image_link_formatter/-/blob/2.2.x/.gi...
or
https://git.drupalcode.org/project/smart_trim/-/blob/2.x/.gitlab-ci.yml#L96
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #4
dydave commentedQuick follow-up on this issue:
Added initial basic configuration for Gitlab CI security settings, mainly:
Included the standard Gitlab CI template:
Security/SAST.gitlab-ci.yml, as suggested in the documentation.Enabled two jobs to run automatically:
1 - GitLab Advanced SAST for comprehensive PHP/JS scanning of the module's source code.
2 - Gitlab SAST (semgrep-sast) for additional language support (limited scope).
Configured the
SAST_EXCLUDED_PATHSto focus the scans only on the module's files.After doing some tests with builds in the issue fork, since the jobs seemed to run as expected, I went ahead and merged the changes above at #3. 🥳
The latest build on 3.1.x seems to show the new jobs correctly and they seem to properly scan the code base: 🟢
https://git.drupalcode.org/project/block_class/-/pipelines/866753
At this point, the module should have some very basic automatic security scan coverage of the source code, which was the initial object of this ticket.
If more changes need to be made to the Gitlab CI security configuration they could be addressed in separate issues.
Moving issue to Patch (to be ported) for version 4.0.x.
Following-up shortly with another MR for the 4.0.x branch.
Thanks!
Additional change:
Re-enabled validation job
phpstan (previous major)and added a few commands to be executed before running phpstan, which remove the Attributes prompting errors ==> preventing these LegacyHook and other attributes from prompting phpstan compatibility errors.Solution based on Gitlab Templates: PHPStan - Object Oriented Hooks in PHPStan (previous major).
Comment #7
dydave commentedOK, now the same changes have also been applied to the 4.0.x branch:
After doing some tests with builds in the issue fork, since the jobs seemed to run as expected, I went ahead and merged the changes above at #6. 🥳
This is going to be super useful for the 4.0.x branch, since there is a lot more code, with duplications here and there, JS, CSS, YAML and PHP code files.... plus the 4.0.x version seems to be a bit more popular, so it is more likely to receive code contributions from the community, in merge requests.
So these additional quality gates will ensure security issues are not introduced as the module's code base evolves.
The latest build on 4.0.x seems to show the new jobs correctly and they seem to properly scan the code base: 🟢
https://git.drupalcode.org/project/block_class/-/pipelines/866907
At this point, all the main development branches of the modules should now be covered with automated security scans and testing on Gitlab CI, which was the object of this ticket.
Therefore, marking issue as Fixed, for now.
Feel free to let us know if you have any questions on any of the recent code changes or the project in general, we would surely be glad to hear your feedback. 😊
Thanks in advance!