SAST Scan .Net Core 3.0

DevSecOps
1

I am trying to use the built-in SAST to scan my code but receive the error below. My project is using .Net Core 3 but the scanner is expecting 2.2 or lower. Does there exist a docker image from gitlab that has dotnet 3?

usr/share/dotnet/sdk/2.2.207/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.TargetFrameworkInference.targets(137,5): error NETSDK1045: The current .NET SDK does not support targeting .NET Core 3.0. Either target .NET Core 2.2 or lower, or use a version of the .NET SDK that supports .NET Core 3.0.

This is the image the SAST template uses:

docker run -it registry.gitlab.com/gitlab-org/security-products/analyzers/security-code-scan:2 bash
root@009ed35c734d:/# dotnet --version
2.2.207

2

Hi all.

I have .net 6 app (multi-project) with this structure

projectA project-a.csproj projectB project-b.csproj project-nested src projectN solution-in-root.sln

I include
stages:

  • build
  • test

include:

  • template: Security/SAST.gitlab-ci.yml

but no SAST job is created… Any idea?