GitLab CI/CD Configuration for Running Semgrep

This document provides a breakdown of the .gitlab-ci.yml configuration used to run Semgrep for static code analysis in a GitLab CI/CD pipeline.

Pipeline Overview

The pipeline is set up to execute Semgrep within a single stage called semgrep. The scan results are stored as a JSON artifact and retained for 1 week.

Configuration

stages:
      - semgrep
    
    run_semgrep:
      stage: semgrep
      image: python:3.8
    
      before_script:
        - pip install --no-cache-dir --upgrade pip
        - pip install --no-cache-dir virtualenv
        - virtualenv venv
        - source venv/bin/activate
        - pip install --no-cache-dir semgrep
        - source venv/bin/activate && semgrep --version
    
      script:
        - export TZ="Asia/Kolkata"
        - TIMESTAMP=$(date +%Y-%m-%d:%H.%M)
        - FILENAME="semgrep_report_${TIMESTAMP}.json"
        - source venv/bin/activate && semgrep --config auto --json --verbose > $FILENAME
    
      artifacts:
        paths:
          - semgrep_report_*.json
        expire_in: 1 week
    
      only:
        - branches

Explanation of Configuration

Stages

Defines a single stage named semgrep to run the Semgrep scan.

Job (run_semgrep)

• stage: Sets the job to run in the semgrep stage.
• image: Specifies python:3.8 as the Docker image, providing Python for installing Semgrep.

before_script

• pip install --upgrade pip: Upgrades pip to the latest version in the container.
• pip install virtualenv: Installs virtualenv to create an isolated Python environment.
• virtualenv venv: Creates a virtual environment named venv.
• source venv/bin/activate: Activates the virtual environment to ensure that all installed packages (like Semgrep) are isolated within venv.

script

• pip install semgrep: Installs Semgrep within the activated virtual environment.
• semgrep --config auto --json > semgrep_report.json: Runs Semgrep with automatic configuration. The --json flag outputs results in JSON format, saved to semgrep_report.json.
• semgrep --config path/to/your/config.yaml --json > semgrep_report.json: Optionally, runs Semgrep using a specific configuration file.

artifacts

• paths: Lists semgrep_report.json as an artifact to retain after the job completes.
• expire_in: Sets the artifact retention period to 1 week, after which the file will be deleted automatically.

only

• Restricts the job to run only on branches, triggering on each push to any branch.

Usage

1. Ensure you have a GitLab Runner installed and configured.
2. Add the above .gitlab-ci.yml file to the root of your repository.
3. Push your changes to trigger the pipeline.
4. Review the Semgrep report artifact in the pipeline's job output.

For further customization, refer to the Semgrep documentation.