MobSF Analyzer failing to work on Gitlab-ci

Question

I'm trying to set up MobSF SAST within Gitlab-ci and having a few issues.

I've followed the instructions within the Gitlab Docs and within the MobSF Gitlab repo

However, when I add:

To my .gitlab-ci.yml . I get a yml error stating that it could not get access

My .gitlab-ci.yml file looks like:

sast:
  stage: Security
  tags:
    - docker
include:
      - project: 'gitlab-org/security-products/analyzers/mobsf'
        ref: master
        file: '/template/mobsf.gitlab-ci.yml'

I have a docker image on my machine with gitlab-runners as an image. Does anyone have any thoughts about how to implement this so that i can run automated MobSF SAST on both Android and iOS?

Answer 1

So after working through this, It seems that you must have the following included in yoru gitlab-ci.yml file:

variables:
  #required for Mobile SAST
  SAST_EXPERIMENTAL_FEATURES: "true"
include:
  - template: Security/SAST.gitlab-ci.yml

sast:
  image: docker:19.03.8
  stage: Security
  variables:
    SEARCH_MAX_DEPTH: 4
  artifacts:
    reports:
      sast: gl-sast-report.json
  tags:
    - docker