NV-4418 Make the GitLab pipeline self-contained

Fetch the SARIF-to-GitLab converter from its single canonical location in
the convert stage, so a repo that copy-pastes only this YAML (without
bundling the Python script) still produces the report on the final stage.
Use curl -sSfL so a missing or moved converter fails loudly instead of
emitting an empty report.

The fetch pins to the mutable 'main' branch (a deliberate POC choice so it
picks up converter fixes); a comment flags that it should be pinned to a
tag/SHA before promotion. The now-unused in-repo converter is marked
superseded; its removal is tracked under NV-4412.

Kept minimal on purpose: the reports:sast mislabel, python:3.9 image,
dind socket, scan-id parse, and rules/workflow gating are deferred to the
Phase 1 CLI export work (NV-4412), which replaces this fetch with
"nightvision export gitlab".

Author: blackoutjack

.gitlab-ci.yml

@@ -66,8 +66,18 @@ dast_scan:
 
 convert_sarif_to_gitlab:
   stage: convert_sarif_to_gitlab
-  image: python:3.9 
+  image: python:3.9
   script:
+    # Fetch the converter from its single canonical location so this pipeline is
+    # self-contained: a repo that copy-pastes only this YAML (without bundling the
+    # Python script) still produces the report on this final stage. (NV-4418.)
+    # -f makes curl fail loudly on an HTTP error so a missing/moved converter does not
+    # silently produce an empty report.
+    # POC limitation: this pins to the mutable 'main' branch (no tag/SHA or checksum),
+    # so a converter change is picked up automatically. Pin to a tag/commit SHA before
+    # promoting this pattern past the POC.
+    # Phase 1 (NV-4412) replaces this fetch + script with `nightvision export gitlab`.
+    - curl -sSfL https://raw.githubusercontent.com/nvsecurity/nv-public-reference/main/sarif/convert_sarif_to_gitlab.py -o convert_sarif_to_gitlab.py
     - python3 convert_sarif_to_gitlab.py
   artifacts:
     reports:

convert_sarif_to_gitlab.py

@@ -1,3 +1,7 @@
+# SUPERSEDED: the GitLab pipeline (.gitlab-ci.yml) now fetches the single canonical
+# converter from nvsecurity/nv-public-reference at runtime, so this in-repo copy is no
+# longer used by CI. Kept only to avoid a noisy delete on this POC branch; removal is
+# tracked under NV-4412. Do not edit this copy - change the canonical converter.
 import json
 from datetime import datetime