I’m running a self hosted version of Gitlab 13.3.4-ee (ad7bd7db412).
I have just tried to include the security pipelines by adding:
include:
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/SAST.gitlab-ci.yml
All the jobs run including gosec-sast, however it does not produce the report and also succeeds:
$ /analyzer run
[INFO] [Gosec] [2022-06-23T05:33:38Z] ▶ GitLab Gosec analyzer v3.0.0
[INFO] [Gosec] [2022-06-23T05:33:38Z] ▶ Detecting project
[INFO] [Gosec] [2022-06-23T05:33:38Z] ▶ Found project in /builds/jdoe/security-testing
[INFO] [Gosec] [2022-06-23T05:33:38Z] ▶ Running analyzer
[INFO] [Gosec] [2022-06-23T05:33:38Z] ▶ Copying modules into path...
[INFO] [Gosec] [2022-06-23T05:33:39Z] ▶ Fetching dependencies...
exit status 1
Uploading artifacts for successful job
00:03
Uploading artifacts...
WARNING: gl-sast-report.json: no matching files
ERROR: No files to upload
Cleaning up file based variables
00:01
Job succeeded
The other jobs produce the reports as expected.