Security Reports examples
This repository is used to populate reports data for features like:
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Dependency Scanning
- Container Scanning
- License Compliance Scanning
- Coverage Fuzzing
- Cluster Image Scanning
Usage
- Fork this project
- Run a new pipeline on the default branch.
- Profit!
Development
The .gitlab-ci.yml file
contains one job per scanner report.
Most of the jobs consist of downloading an up-to-date scanner report of the relevant type and using it as one of the
artifacts:reports.
Dependency scanning
Dependency scanning is not using pre-generated reports because of: https://gitlab.com/gitlab-org/gitlab/-/issues/231309#note_384553418
The ./dependency-scanning-files directory contains supported package manager lock files.
Generic Details
The security report schema supports a details field that provides support for displaying various data elements on screen. An example screenshot and accompanying json file is located in samples/details-example folder for illustrative purposes.