GitLab CI/CD流水线创建失败求助：SAST扫描任务依赖问题排查

问题根源 #

错误提示的核心原因是zpracovani-json-nodejs的needs声明强制依赖nodejs-scan-sast，但nodejs-scan-sast是条件触发Job——仅当项目根目录存在package.json时才会被纳入流水线。当项目不满足该条件时，nodejs-scan-sast不会被创建，导致依赖它的zpracovani-json-nodejs找不到目标Job，流水线初始化直接失败。

另外还有一个隐藏问题：两个SAST Job都输出gl-sast-report.json，会互相覆盖，导致后续处理Job只能拿到最后生成的那份报告，无法正确处理两种语言的扫描结果。

修复后的完整配置 #

variables:
  SECURE_ANALYZERS_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  SAST_IMAGE_SUFFIX: ''
  SAST_EXCLUDED_ANALYZERS: ''
  SAST_EXCLUDED_PATHS: spec, test, tests, tmp
  SCAN_KUBERNETES_MANIFESTS: 'false'

stages:
  - test
  - process-js
  - process-php

phpcs-security-audit-sast:
  image: registry.gitlab.com/security-products/sast/phpcs-security-audit:2
  stage: test
  artifacts:
    paths:
      - gl-sast-report-php.json
  rules:
  - if: "$SAST_DISABLED == 'true' || $SAST_DISABLED == '1'"
    when: never
  - if: "$SAST_EXCLUDED_ANALYZERS =~ /phpcs-security-audit/"
    when: never
  - if: "$CI_COMMIT_BRANCH"
    exists:
    - "**/*.php"
  variables:
    SEARCH_MAX_DEPTH: 4
    SAST_ANALYZER_IMAGE_TAG: 4
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/phpcs-security-audit:$SAST_ANALYZER_IMAGE_TAG"
    SAST_REPORT_FILE: gl-sast-report-php.json
  script:
    - /analyzer run

nodejs-scan-sast:
  stage: test
  artifacts:
    reports:
      sast:
      - gl-sast-report-node.json
    paths:
      - gl-sast-report-node.json
  rules:
  - if: "$SAST_DISABLED == 'true' || $SAST_DISABLED == '1'"
    when: never
  - if: "$SAST_EXCLUDED_ANALYZERS =~ /nodejs-scan/"
    when: never
  - if: "$CI_COMMIT_BRANCH"
    exists:
    - "**/package.json"
  variables:
    SEARCH_MAX_DEPTH: 4
    SAST_ANALYZER_IMAGE_TAG: 4
    SAST_ANALYZER_IMAGE: "$SECURE_ANALYZERS_PREFIX/nodejs-scan:$SAST_ANALYZER_IMAGE_TAG"
    SAST_REPORT_FILE: gl-sast-report-node.json
  script:
  - "/analyzer run"

zpracovani-json-phpcs:
  image: cylab/php74
  stage: process-php
  needs:
    - job: phpcs-security-audit-sast
  rules:
  - if: "$SAST_DISABLED == 'true' || $SAST_DISABLED == '1'"
    when: never
  - if: "$SAST_EXCLUDED_ANALYZERS =~ /phpcs-security-audit/"
    when: never
  - if: "$CI_COMMIT_BRANCH"
    exists:
    - "**/*.php"
  script:
    - php sast-vuln-checker.php gl-sast-report-php.json $CI_PROJECT_NAME

zpracovani-json-nodejs:
  image: cylab/php74
  stage: process-js
  needs:
    - job: nodejs-scan-sast
  rules:
  - if: "$SAST_DISABLED == 'true' || $SAST_DISABLED == '1'"
    when: never
  - if: "$SAST_EXCLUDED_ANALYZERS =~ /nodejs-scan/"
    when: never
  - if: "$CI_COMMIT_BRANCH"
    exists:
    - "**/package.json"
  script:
    - php sast-vuln-checker.php gl-sast-report-node.json $CI_PROJECT_NAME

关键修改说明 #

1. 解决依赖不存在问题：给两个处理Job添加与对应SAST Job完全一致的rules，确保只有当依赖的SAST Job会被创建时，处理Job才会被纳入流水线，从根源避免找不到依赖的错误。
2. 避免报告文件覆盖：通过SAST_REPORT_FILE变量指定每个SAST工具输出不同的报告文件名，同时修改artifacts路径，确保两份报告都能被后续处理Job正确获取。
3. 语义化阶段调整：将zpracovani-json-nodejs移到process-js阶段，与阶段名称对应，逻辑更清晰。

可选简化方案（需脚本兼容） #

如果不想复制完整规则，也可以给needs添加optional: true，同时在脚本中增加文件存在性判断：

zpracovani-json-nodejs:
  image: cylab/php74
  stage: process-js
  needs:
    - job: nodejs-scan-sast
      optional: true
  script:
    - if [ -f gl-sast-report-node.json ]; then php sast-vuln-checker.php gl-sast-report-node.json $CI_PROJECT_NAME; else echo "No Node.js SAST report found, skipping"; fi

但这种方式需要脚本兼容无报告的场景，不如添加规则的方式严谨。

内容的提问来源于stack exchange，提问作者Dominik Větisk