GitLab SAST configuration
If you are using GitLab CI/CD, you can use Static Application Security Testing (SAST) to check your source code for known vulnerabilities. You can run SAST analyzers in any GitLab tier. The analyzers produce JSON-formatted reports as job artifacts. Use the following procedure to configure GitLab SAST:
Configuring DevOps Intelligence for GitLab SAST, recent customers
The procedures in this section are valid only for customers onboarded 6 June 2024 or after.
Use the following procedure to configure the DevOps Intelligence for Azure Pipelines:
Tools must be configured for a specific application in a specific DevOps phase. In step 2 of the following procedure, you are choosing the application and DevOps phase to associate with GitLab SAST as part of the configuration procedure.
- Click Settings & Utilities → Application Configuration. You will see a list of existing applications.
- Select the existing application for which you want to configure GitLab SAST or create a new application.
- Click the overflow menu (vertical ellipsis) on the Develop row for the selected application.
- Select Add New Tool Configuration from the overflow menu. The service displays the Add Tool Configuration form.
- Select GitLab SAST for Tool Engine.
- Click Submit.
Onboarding GitLab SAST
After configuring GitLab SAST, you must onboard it as a technical service. Use the following procedure:
- Click the overflow menu for the selected application.
- Select Onboard Technical Service. The service displays the Onboard Technical Service form.
- Select Secure for DevOps Phase. The service displays the Tool Engine field.
- Select GitLab SAST for Tool Engine. The service displays the Select Connection field.
- Select the appropriate connection. The service displays the Select Organization field.
- Select the appropriate organization. The service displays the Select Projects field.
- Select the appropriate project. The service displays the Repository Name field.
- Select the appropriate repository.
- Click Onboard. The service navigates to the Application Configuration page.
- You now have the option of clicking the overflow menu for Develop and selecting Edit/Delete Tools Configuration to confirm that GitLab SAST has been fully configured.
Deleting GitLab SAST as a technical service
The administrator may, at will, delete the GitLab technical service. Use the following procedure:
- Navigate to DevOps Intelligence → Settings & Utilities → Application Configuration.
- Expand the application to view all associated phases.
- Click the Overflow menu for Develop.
- Click Delete Technical Service.
- Click GitLab for Select Tools Configured. The service displays the Select Organization field.
- Select the appropriate organization. The service displays the Select Projects field.
- Select the appropriate project.
- Click Delete.