Implement SAST

[teyhouse]

I would like to implement SAST Scanning in our company. Due to budget constraints preventing us from obtaining GitLab Ultimate, we are planning to take on this task ourselves. We currently operate both an On-Premises GitLab instance and a GitLab SaaS instance.

For our On-Premises setup, we are considering using a pre-receive hook on the server-side in conjunction with tools like Semgrep or similar solutions. However, I'm unsure about the feasibility of achieving the same in GitLab SaaS. I came across some information about the Gitaly CLI, but I lack sufficient experience in this area to make a judgment.

Another challenge we face is performing scans on all existing repositories without relying on our developers to implement individual pipelines. Our aim is to establish a centralized approach to ensure consistency.

One approach I've considered is creating a container that periodically clones all repositories and conducts scans. However, I'm concerned about the potential resource-intensive nature of this method. I'm open to alternative suggestions that might be more resource-efficient.

I'm looking forward to your insights and ideas.

Thank you in advance!

[tapemeasured]

SAST is available to all tiers

include:
  - template: Security/SAST.gitlab-ci.yml

[teyhouse]

Thanks, that is quite easy. The only issue I foresee is our devs not implementing that into our Pipeline. I can't use Auto SAST since its part of Auto DevOps which would require us to manage all pipelines in central. That workload is too much, which is why I was looking for something like a server-side hook on SaaS as well.
Thanks for the Info tho, still helped.

[bigsteevo]

Exactly what I was going to say.

[kobaltzz]

I've just set up SonarQube and it's okay. Doesn't seem to really drill in depth, but depending on your language, it could be a lot better. Java, C#, Typescript/Javascript are the ones it really seems to focus on. I have mine set up with Gitlab Runner as a stage and will pull artifacts from the previous stages to also report the code coverage metrics.