diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md index faf885b6552fab624acc5a212cfbafa8232c71fc..e71c55f80388ce28c0d9f9b5662bfb7f81f7120c 100644 --- a/doc/user/application_security/dependency_scanning/index.md +++ b/doc/user/application_security/dependency_scanning/index.md @@ -204,7 +204,11 @@ to start relevant analyzers depending on the detected repository language(s) ins are some differences in the way repository languages are detected between DIND and non-DIND. You can observe these differences by checking both Linguist and the common library. For instance, Linguist looks for `*.java` files to spin up the [gemnasium-maven](https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium-maven) -image, while orchestrator only looks for the existence of `pom.xml` or `build.gradle`. +image, while orchestrator only looks for the existence of `pom.xml` or `build.gradle`. GitLab uses +Linguist to detect new file types in the default branch. This means that when introducing files or +dependencies for a new language or package manager, the corresponding scans won't be triggered in +the MR and will only run on the default branch once the MR is merged. This will be addressed by +[#211702](https://gitlab.com/gitlab-org/gitlab/-/issues/211702). ## Interacting with the vulnerabilities diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index c864abfe1aeab0f2074cf579d76a4db6c9e8f60d..a2b365c672aca68c24ab6ffbb9e53646fb3fe500 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -193,7 +193,10 @@ are some differences in the way repository languages are detected between DIND a observe these differences by checking both Linguist and the common library. For instance, Linguist looks for `*.java` files to spin up the [spotbugs](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs) image, while orchestrator only looks for the existence of `pom.xml`, `build.xml`, `gradlew`, -`grailsw`, or `mvnw`. +`grailsw`, or `mvnw`. GitLab uses Linguist to detect new file types in the default branch. This +means that when introducing files or dependencies for a new language or package manager, the +corresponding scans won't be triggered in the MR and will only run on the default branch once the +MR is merged. This will be addressed by [#211702](https://gitlab.com/gitlab-org/gitlab/-/issues/211702). #### Enabling kubesec analyzer