Problem/Motivation

Gitlab CI seems to now provide quite a lot of features to support automated security scans and quality gates, see:
https://docs.gitlab.com/user/application_security/get-started-security/
https://about.gitlab.com/blog/security-configuration-profiles/

These features are not currently implemented in the module.

Steps to reproduce

Proposed resolution

Enable security scans on Gitlab CI:

  • Composer audit is not really necessary for 3.x, since the module has no dependency other than Drupal core, for now. But, once the module supports D12 and requires the contrib toolbar module, this command could become useful.
  • NPM audit is not needed: the module does not use npm.
  • DAST scans are not needed since the module does not have any API or end points.
  • SAST scan is required to scan the files in module's code base: PHP classes, YAML files, and other files (README.md, composer.json, etc...).
  • Secret Detection could be enabled since it is provided by Drupal Gitlab Templates as a variable RUN_JOB_SECRET_DETECTION.

See similar issues:

Issue fork admin_toolbar-3609437

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

dydave created an issue. See original summary.

dydave opened merge request !214

  • dydave committed ed04d3cf on 3.x 
    Issue #3609437 by dydave: Gitlab CI: Enabled automated security scans.
dydave’s picture

dydave commented
Status: Active » Fixed

Quick follow-up on this issue:

Added initial basic configuration for Gitlab CI security settings, mainly:
Included the standard Gitlab CI template: Security/SAST.gitlab-ci.yml, as suggested in the documentation.

Enabled two jobs to run automatically:
1 - Enabled secret detection and disabled builds for D12.
2 - GitLab Advanced SAST for comprehensive PHP/JS scanning of the module's source code.
3 - Gitlab SAST (semgrep-sast) for additional language support (limited scope).

Configured the SAST_EXCLUDED_PATHS to focus the scans only on the module's files.

After doing some tests with builds in the issue fork, since the jobs seemed to run as expected, I went ahead and merged the changes above at #3. 🥳

The latest build on 3.x seems to show the new jobs correctly and they seem to properly scan the code base: 🟢
https://git.drupalcode.org/project/admin_toolbar/-/pipelines/881201

At this point, the module should have some very basic automatic security scan coverage of the source code, which was the initial object of this ticket.
If more changes need to be made to the Gitlab CI security configuration they could be addressed in separate issues.

Marking ticket as Fixed, for now.

Feel free to let us know if you have any questions on any of the recent code changes or the project in general, we would surely be glad to help.
Thanks in advance!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.