gitlabcontinuous-integrationgitlab-cigitlab-ci-runnersast

MobSF Analyzer failing to work on Gitlab-ci

I'm trying to set up MobSF SAST within Gitlab-ci and having a few issues.

I've followed the instructions within the Gitlab Docs and within the MobSF Gitlab repo

However, when I add:

To my .gitlab-ci.yml . I get a yml error stating that it could not get access

include: - project: 'gitlab-org/security-products/analyzers/mobsf' ref: master file: '/template/mobsf.gitlab-ci.yml'

My .gitlab-ci.yml file looks like:

sast:
  stage: Security
  tags:
    - docker
include:
      - project: 'gitlab-org/security-products/analyzers/mobsf'
        ref: master
        file: '/template/mobsf.gitlab-ci.yml'

I have a docker image on my machine with gitlab-runners as an image. Does anyone have any thoughts about how to implement this so that i can run automated MobSF SAST on both Android and iOS?

Solution

  • So after working through this, It seems that you must have the following included in yoru gitlab-ci.yml file:

    variables:
  #required for Mobile SAST
  SAST_EXPERIMENTAL_FEATURES: "true"
include:
  - template: Security/SAST.gitlab-ci.yml

sast:
  image: docker:19.03.8
  stage: Security
  variables:
    SEARCH_MAX_DEPTH: 4
  artifacts:
    reports:
      sast: gl-sast-report.json
  tags:
    - docker