Quality and security in CI¶
test.yml integrates four GitLab templates: Code Quality, Container Scanning, SAST and Secret Detection. It also adds jobs that read JSON reports and print results in job logs. This design exposes analysis results within the GitLab workflow.
Configured controls¶
| Control | Custom configuration | Artifact or evidence |
|---|---|---|
| Quality | ENABLE_QUALITY; per-finding summaries |
gl-code-quality-report.json |
| SAST | Official template inclusion | Inherited analyzer; semgrep-sast observed |
| Secrets | ENABLE_SECURITY; historical scanning enabled |
gl-secret-detection-report.json |
| Containers | ENABLE_SECURITY; CS_SEVERITY_THRESHOLD: HIGH |
gl-container-scanning-report.json |
The official container template defaults to $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA, matching the build convention. Verify effective values if group or project variables are added. The HIGH threshold limits the severities included by that analysis; it does not by itself create a deployment gate.
Summary behavior¶
The hidden .results-scanner template counts vulnerabilities, prints their fields and exits with code 1 when it finds High or Critical severity. It also declares allow_failure: true. Consequently, a failed job may be allowed without preventing delivery.
results-code-quality replaces the inherited script to print issues and their count; it does not introduce a blocking quality threshold. There is no custom results-sast job; SAST is integrated through GitLab and retains its report.
Public metadata for the latest observed application pipelines confirms allow_failure: true for both analyzers and summary jobs. Those jobs all succeeded in the observed runs, but their complete reports were not inspected. This does not establish that the application has no vulnerabilities.
Automated tests¶
The stage named test contains SAST in the observed runs. Both POMs declare test dependencies, but there are no src/test sources and the build skips execution through -DskipTests. No implemented unit, integration, contract or end-to-end test suites were found in this snapshot.
A useful extension would add small API contract tests and a post-rollout smoke test. This documentation does not report test results that were never executed.
Compatibility and maintenance¶
GitLab's official documentation marks the CodeClimate-based Code Quality template as deprecated and announces its removal. Check that include against the specific GitLab version that will run the project. Migrating to a maintained tool exporting the Code Quality format is proposed; this documentation does not claim every current GitLab instance has already removed the file.
GitLab templates and ref: main are moving dependencies. When reproducing an execution, inspect the expanded configuration in CI Lint and actual jobs, as well as repository YAML.
Turning analysis into a delivery policy¶
For a blocking gate, first define which findings must prevent delivery, who can accept an exception and for how long. Then adjust allow_failure, dependencies and branch rules; add test reports; and use a known failing case to verify delivery jobs are skipped.
This is a proposed evolution. The current versioned policy is the one described above. Record the historical reason for permitting failures in decisions once the author confirms it.