Page MenuHomePhabricator
Create Task
Maniphest T342177

[EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work
Closed, ResolvedPublic
Actions

Description

Building off of the initial epic T289290, this should be considered the phase 2 work epic for the GitLab-Application-Security-Pipeline.

Estimated start date: July 2023

Estimated completion date: December 2023

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedsbassettT342177 [EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work
 DeclinedNoneT293138 Create Risk Rating Calculator for Security Reviews / Gitlab AppSec CI
 DeclinedNoneT305083 Better support branches and add support for mw core to the phan-taint-check gitlab appsec template
 ResolvedmmartoranaT307523 Investigate container scanning options within the context of the Gitlab appsec pipeline
 ResolvedmmartoranaT309997 Implement an outdated modules check for golang
ResolvedmmartoranaT338034 Address issues within certain Gitlab CI security templates
 ResolvedsbassettT342178 osv-scanner: add support for finding nested lockfiles
 ResolvedsbassettT342467 Design AppSec Pipeline metrics approach
 ResolvedmmartoranaT342469 Establish a more specific policy/best practices around security include failures
 ResolvedMstylesT343255 Add secret-scanning options to Gitlab CI includes
 ResolvedsbassettT343262 Deprecate unused / problematic Gitlab AppSec CI includes
 ResolvedmmartoranaT338238 Use Gitlab Security Pipeline for ipoid
 ResolvedmmartoranaT346163 Implement a template for Shell scripting testing
 ResolvedmmartoranaT346802 Update on-wiki documentation for the AppSec Pipeline for phase 2 work
 ResolvedmmartoranaT348548 Provide use case about specific workflow in documentation
 ResolvedsbassettT348788 Improve related gitlab test repository
 ResolvedsbassettT350828 gosec CI include default path that is set as initial option produces "No packages found" fatal
 ResolvedsbassettT352331 Add commit-message-validator for gitlab security ci includes merge requests
 ResolvedsbassettT352702 Add explicit default rules: - when: always directive to ALL AppSec pipeline includes
 ResolvedsbassettT352820 phan-taint-check gitlab ci security template should use its own image
 ResolvedsbassettT353534 Refactor golang-gosec CI include
 ResolvedsbassettT353536 Create rule-filtering functionality for semgrep-merge-tool rule repos
 Resolved• sguebo_WMFT353747 Add basic unit tests and CI support for semgrep-merge-tool
 ResolvedmmartoranaT353819 Allow Gitlab CI OSV template to fail
 ResolvedsbassettT354690 Add --diff-filter=d option to git diff-tree command for semgrep and golang-gosec security includes
 DeclinedsbassettT360721 Update the image used by the python-bandit appsec include
 ResolvedmmartoranaT367440 Attempt to condense trivy scanning output and avoid false positive exit code

Event Timeline

sbassett created this task.Jul 18 2023, 9:23 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 18 2023, 9:23 PM
sbassett added a subtask: T293138: Create Risk Rating Calculator for Security Reviews / Gitlab AppSec CI.Jul 18 2023, 9:23 PM
sbassett added a subtask: T305083: Better support branches and add support for mw core to the phan-taint-check gitlab appsec template.
sbassett added a subtask: Restricted Task.
sbassett added a subtask: T307523: Investigate container scanning options within the context of the Gitlab appsec pipeline.
sbassett added a subtask: T309997: Implement an outdated modules check for golang .
sbassett added a subtask: T338034: Address issues within certain Gitlab CI security templates.Jul 18 2023, 9:25 PM
sbassett added a subtask: T342178: osv-scanner: add support for finding nested lockfiles.Jul 18 2023, 9:27 PM
sbassett added a subtask: T342467: Design AppSec Pipeline metrics approach.Jul 21 2023, 8:07 PM
sbassett added a subtask: T342468: Craft more mediawiki-specific and php semgrep rule sets.
sbassett added a subtask: T342469: Establish a more specific policy/best practices around security include failures.Jul 21 2023, 8:11 PM
sbassett moved this task from Incoming to Back Orders on the Security-Team board.Jul 24 2023, 4:19 PM
sbassett added a project: SecTeam-Processed.
sbassett removed a subtask: Restricted Task.Aug 1 2023, 5:26 PM
sbassett changed the status of subtask T342467: Design AppSec Pipeline metrics approach from Open to In Progress.Aug 1 2023, 5:32 PM
sbassett added a subtask: T343255: Add secret-scanning options to Gitlab CI includes.Aug 1 2023, 5:42 PM
sbassett added a subtask: T343262: Deprecate unused / problematic Gitlab AppSec CI includes.Aug 1 2023, 6:43 PM
sbassett moved this task from Back Orders to In Progress on the Security-Team board.Aug 7 2023, 4:15 PM
sbassett renamed this task from Application Security Pipeline Components for Gitlab - Phase 2 Work to [EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work.Aug 8 2023, 5:01 PM
sbassett added a project: user-sbassett.
sbassett moved this task from Backlog to In Progress on the user-sbassett board.
sbassett closed subtask T343262: Deprecate unused / problematic Gitlab AppSec CI includes as Resolved.Aug 10 2023, 6:20 PM
sbassett closed subtask T343255: Add secret-scanning options to Gitlab CI includes as Resolved.Aug 22 2023, 6:32 PM
sbassett closed subtask T342178: osv-scanner: add support for finding nested lockfiles as Resolved.Aug 23 2023, 3:57 PM
sbassett added a subtask: T338238: Use Gitlab Security Pipeline for ipoid.Aug 28 2023, 3:39 PM
mmartorana added a subtask: T346163: Implement a template for Shell scripting testing.Sep 12 2023, 4:01 PM
sbassett changed the status of subtask T346802: Update on-wiki documentation for the AppSec Pipeline for phase 2 work from Open to In Progress.Sep 26 2023, 4:10 PM
sbassett changed the status of subtask T309997: Implement an outdated modules check for golang from Open to In Progress.Oct 3 2023, 4:54 PM
sbassett changed the status of subtask T342468: Craft more mediawiki-specific and php semgrep rule sets from Open to In Progress.Oct 3 2023, 4:58 PM
sbassett changed the status of subtask T342469: Establish a more specific policy/best practices around security include failures from Open to In Progress.Oct 3 2023, 5:03 PM
sbassett changed the status of subtask T338238: Use Gitlab Security Pipeline for ipoid from Stalled to In Progress.
mmartorana closed subtask T342469: Establish a more specific policy/best practices around security include failures as Resolved.Oct 10 2023, 3:45 PM
mmartorana changed the status of subtask T348548: Provide use case about specific workflow in documentation from Open to Stalled.Oct 10 2023, 3:51 PM
sbassett changed the status of subtask T348548: Provide use case about specific workflow in documentation from Stalled to In Progress.Oct 10 2023, 4:43 PM
sbassett changed the status of subtask T348788: Improve related gitlab test repository from Open to In Progress.Oct 17 2023, 4:58 PM
sbassett changed the status of subtask T350828: gosec CI include default path that is set as initial option produces "No packages found" fatal from Open to In Progress.Nov 8 2023, 9:17 PM
sbassett closed subtask T350828: gosec CI include default path that is set as initial option produces "No packages found" fatal as Resolved.Nov 9 2023, 4:52 PM
mmartorana closed subtask T309997: Implement an outdated modules check for golang as Resolved.Nov 27 2023, 10:34 AM
sbassett changed the status of subtask T352331: Add commit-message-validator for gitlab security ci includes merge requests from Open to In Progress.Nov 29 2023, 7:51 PM
sbassett changed the status of subtask T352702: Add explicit default rules: - when: always directive to ALL AppSec pipeline includes from Open to In Progress.Dec 4 2023, 6:08 PM
sbassett closed subtask T352331: Add commit-message-validator for gitlab security ci includes merge requests as Resolved.Dec 5 2023, 5:57 PM
sbassett changed the status of subtask T352820: phan-taint-check gitlab ci security template should use its own image from Open to In Progress.Dec 5 2023, 10:37 PM
sbassett closed subtask T352702: Add explicit default rules: - when: always directive to ALL AppSec pipeline includes as Resolved.Dec 6 2023, 3:43 PM
sbassett closed subtask T338034: Address issues within certain Gitlab CI security templates as Resolved.Dec 14 2023, 5:24 PM
sbassett closed subtask T352820: phan-taint-check gitlab ci security template should use its own image as Resolved.Dec 15 2023, 4:59 PM
sbassett closed subtask T348788: Improve related gitlab test repository as Resolved.Dec 17 2023, 3:34 PM
sbassett closed subtask T353534: Refactor golang-gosec CI include as Resolved.Dec 18 2023, 5:08 PM
mmartorana closed subtask T346802: Update on-wiki documentation for the AppSec Pipeline for phase 2 work as Resolved.Dec 19 2023, 4:09 PM
mmartorana changed the status of subtask T353819: Allow Gitlab CI OSV template to fail from Open to In Progress.Dec 20 2023, 4:26 PM
mmartorana closed subtask T348548: Provide use case about specific workflow in documentation as Resolved.Dec 20 2023, 6:12 PM
sbassett closed subtask T353819: Allow Gitlab CI OSV template to fail as Resolved.Dec 20 2023, 7:44 PM
sbassett changed the status of subtask T354690: Add --diff-filter=d option to git diff-tree command for semgrep and golang-gosec security includes from Open to In Progress.Jan 9 2024, 6:30 PM
sbassett closed subtask T354690: Add --diff-filter=d option to git diff-tree command for semgrep and golang-gosec security includes as Resolved.Jan 9 2024, 10:12 PM
kostajh changed the status of subtask T338238: Use Gitlab Security Pipeline for ipoid from In Progress to Stalled.Jan 15 2024, 9:06 AM
sbassett closed subtask T353536: Create rule-filtering functionality for semgrep-merge-tool rule repos as Resolved.Jan 16 2024, 4:01 PM
sbassett closed subtask T338238: Use Gitlab Security Pipeline for ipoid as Resolved.Jan 23 2024, 5:36 PM
sbassett changed the status of subtask T353747: Add basic unit tests and CI support for semgrep-merge-tool from Open to In Progress.Jan 30 2024, 5:58 PM
sbassett changed the status of subtask T346163: Implement a template for Shell scripting testing from Open to In Progress.Feb 6 2024, 6:02 PM
sbassett changed the status of subtask T307523: Investigate container scanning options within the context of the Gitlab appsec pipeline from Open to In Progress.
sbassett closed subtask T305083: Better support branches and add support for mw core to the phan-taint-check gitlab appsec template as Declined.Feb 6 2024, 6:18 PM
sbassett closed subtask T293138: Create Risk Rating Calculator for Security Reviews / Gitlab AppSec CI as Declined.
sbassett closed subtask T353747: Add basic unit tests and CI support for semgrep-merge-tool as Resolved.Mar 6 2024, 9:43 PM
sbassett closed subtask T346163: Implement a template for Shell scripting testing as Resolved.Mar 13 2024, 7:24 PM
sbassett closed subtask T342467: Design AppSec Pipeline metrics approach as Resolved.Apr 4 2024, 5:52 PM
mmartorana closed subtask T307523: Investigate container scanning options within the context of the Gitlab appsec pipeline as Resolved.Jun 14 2024, 3:52 PM
sbassett added a subtask: T367440: Attempt to condense trivy scanning output and avoid false positive exit code.Jun 14 2024, 4:29 PM
sbassett closed subtask T367440: Attempt to condense trivy scanning output and avoid false positive exit code as Resolved.Jul 22 2024, 4:53 PM
Restricted Application added a project: Epic. · View Herald TranscriptJul 22 2024, 4:53 PM
sbassett closed subtask T360721: Update the image used by the python-bandit appsec include as Declined.Jan 14 2025, 4:25 PM
sbassett closed this task as Resolved.Jan 14 2025, 4:28 PM
sbassett removed a subtask: T342468: Craft more mediawiki-specific and php semgrep rule sets.
sbassett moved this task from Backlog to Done on the GitLab-Application-Security-Pipeline board.

Nearly all of the work for this was completed and has also been superseded mostly by T371814.

sbassett moved this task from In Progress to Our Part Is Done on the Security-Team board.Jan 14 2025, 4:29 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits