Merge branch 'semgrep-sast-ci' into 'master'

chore: remove deprecated eslint analyzers, use semgrep-sast

See merge request postgres-ai/database-lab!605

Author: agneum

.gitlab-ci.yml

@@ -1,5 +1,4 @@
 variables:
-  SAST_EXCLUDED_ANALYZERS: "semgrep-sast,gosec-sast"
   DOCKER_DRIVER: overlay2
 
 workflow:

ui/.gitlab-ci.yml

@@ -1,5 +1,4 @@
 include:
-  - template: Security/SAST.gitlab-ci.yml
   - local: 'ui/packages/ce/.gitlab-ci.yml'
   - local: 'ui/packages/platform/.gitlab-ci.yml'
 
@@ -10,7 +9,7 @@ include:
       changes:
         - ui/**/*
 
-check_code_style:
+check-code-style:
   <<: *only_ui
   stage: test
   image: node:16.13.0
@@ -19,20 +18,22 @@ check_code_style:
     - npm --prefix ui/ run lint -w packages/ce
     - npm --prefix ui/ run lint -w packages/platform
 
-eslint-sast:
-  <<: *only_ui
-  extends: .sast-analyzer
-  image:
-    name: "$SAST_ANALYZER_IMAGE"
-  variables:
-    SAST_ANALYZER_IMAGE_TAG: 2
-    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/eslint:$SAST_ANALYZER_IMAGE_TAG"
-
-nodejs-scan-sast:
+semgrep-sast:
+  stage: test
+  image: returntocorp/semgrep
   <<: *only_ui
-  extends: .sast-analyzer
-  image:
-    name: "$SAST_ANALYZER_IMAGE"
   variables:
-    SAST_ANALYZER_IMAGE_TAG: 2
-    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/nodejs-scan:$SAST_ANALYZER_IMAGE_TAG"
+    # See more at semgrep.dev/explore.
+    SEMGREP_RULES: >-
+      p/security-audit
+      p/secrets
+      p/default
+      p/owasp-top-ten
+      p/javascript
+      p/react
+    # Upload findings to GitLab SAST Dashboard:
+    SEMGREP_GITLAB_JSON: "1"
+  script: semgrep ci --gitlab-sast > gl-sast-report.json || true
+  artifacts:
+    reports:
+      sast: gl-sast-report.json