Add scanning jobs to GitLab CI configuration

[ala-ebi]

Summary by CodeRabbit

• Chores
  • Integrated automated security scanning into the CI/CD pipeline: SAST, Secret Detection, Dependency Scanning, and Container Scanning now run as part of the build process.
  • Added a dedicated scan stage to the pipeline.
  • Improved pipeline configuration consistency.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[jiyue1214]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitLab CI configuration enhanced with security scanning templates for SAST, Secret Detection, Dependency Scanning, and Container Scanning. A new scan pipeline stage and container_scanning job are introduced. Existing build and build_release stages retain their functional logic with formatting and indentation adjustments.

Changes

Cohort / File(s)	Summary
CI/CD Pipeline Configuration .gitlab-ci.yml	Added security scanning templates via include directives; introduced new scan stage with container_scanning job scoped to tag builds. Reformatted script sections and conditional "only" rules in existing build and build_release jobs while preserving authentication, image pull, build, push, and tagging logic.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 ✨ A scan upon the pipeline runs,
Security templates, job well done!
New stages bloom in GitLab's night,
Build and release still shining bright! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Add scanning jobs to GitLab CI configuration' directly describes the main change: adding SAST, Secret Detection, Dependency Scanning, and Container Scanning jobs to the CI configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In @.gitlab-ci.yml:
- Around line 55-56: The CI writes DOCKER_HUB_PASSWORD to dhpw.txt and never
removes it, exposing secrets; change the step to pass the password via stdin
without a temp file by piping the variable directly (echo "$DOCKER_HUB_PASSWORD"
| docker login -u "${DOCKER_HUB_USER}" --password-stdin) or use GitLab CI's
built-in Docker login helper, and if you must use a file ensure dhpw.txt is
deleted immediately after use (rm -f dhpw.txt) so the temporary credential file
is not left on the runner.
- Around line 33-34: Remove the temporary dhpw.txt file usage and pipe the
secret directly into docker login instead of writing to disk: replace the two
commands that create and read dhpw.txt (the echo "$DOCKER_HUB_PASSWORD" >
dhpw.txt and docker login ... < dhpw.txt docker.io) with a single pipeline that
feeds DOCKER_HUB_PASSWORD to docker login via --password-stdin (e.g., use
echo/printf of DOCKER_HUB_PASSWORD piped into docker login -u
"${DOCKER_HUB_USER}" --password-stdin docker.io) so no on-disk credential file
is created.
- Around line 1-6: Your pipeline is missing the "test" stage that the included
templates (Jobs/SAST.gitlab-ci.yml, Jobs/Secret-Detection.gitlab-ci.yml,
Jobs/Dependency-Scanning.gitlab-ci.yml) expect; either add "test" to the
top-level stages list (e.g., insert "test" between "build" and "scan") so those
template jobs run in the correct stage, or change the manually defined
container_scanning job to use stage: test (and consider deleting the manual
container_scanning job entirely so the Container-Scanning template defines it
automatically).

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2a2ad05 and 9bd353c.

📒 Files selected for processing (1)

• .gitlab-ci.yml

🔇 Additional comments (2)

.gitlab-ci.yml (2)

11-11: LGTM: Scan stage properly positioned.

The new scan stage is correctly positioned between build and deploy, ensuring security scans run after images are built but before any deployment occurs.

---

23-29: The container_scanning configuration for Docker Hub is correct.

The GitLab Container Scanning template fully supports scanning images from Docker Hub by setting CS_IMAGE to the image path, which is already configured correctly here. For public Docker Hub images (like ebispot/gwas-sumstats-harmoniser), no additional authentication is required. The job properly runs only on tags, matching the build_release job that pushes the images.