Add CI/CD pipeline with security scanning
Description
This MR adds a comprehensive CI/CD pipeline with automated security scanning to the web-dashboard project.
Changes
-
✅ Added.gitlab-ci.ymlwith build, test, and security stages -
✅ Enabled Dependency Scanning for npm packages -
✅ Enabled SAST (Static Application Security Testing) using Semgrep -
✅ Enabled Secret Detection to catch accidentally committed secrets -
✅ Configured caching for node_modules to speed up pipeline -
✅ Added artifact retention for build outputs
Pipeline Stages
- Build: Compiles the React TypeScript application
- Test: Runs unit tests with coverage reporting
- Security: Runs dependency scanning, SAST, and secret detection
Expected Security Findings
This pipeline will detect the vulnerable dependencies currently in package.json:
- lodash 4.17.15 (CVE-2020-8203)
- minimist 1.2.5 (CVE-2020-7598, CVE-2021-44906)
- axios 0.21.1 (CVE-2023-45857)
These will be addressed in a follow-up MR.
Testing
- Pipeline should trigger automatically on this MR
- Build and test stages should pass
- Security scans should detect known vulnerabilities
Closes #13
cc @sabrina @bill