GitLab Dependency Scan Requires package-lock.json in Source Code for Execution

Question

I want to run a GitLab CI pipeline that utilizes vulnerability scanning (GitLab Ultimate). The issue is that I need to create the package-lock.json file during the build stage. As far as I understand, the job will not execute if the file does not exist in the repository at the time of pipeline execution. Can someone assist me with this? :)

NodeJS repo for building NPM packages. (not for building docker images)

using Artifact block did not help me in the process...

Answer 1

You can override the rules: for the scanning job to remove the need for the lock file to exist. For example, the job gemnasium-dependency_scanning from the builtin dependency scan template normally requires a lock file (such as **/yarn.lock or package.lock.json) to exist. But this can be overwritten. Additionally, you can add dependencies on other jobs, like a job that produces your lockfile in order to ensure the generated lockfile is present for the scanning job (by default scanning jobs ignore artifacts).

include:
  - template: Jobs/Dependency-Scanning.gitlab-ci.yml

generate-lockfile:
  # ...
  stage: build
  # this is just an example...
  # update `script:` and `artifacts:` to your needs
  script:
    - yarn install --mode update-lockfile
  artifacts:
    paths:
      - yarn.lock

gemnasium-dependency_scanning:
  rules:  # override rules to not require lockfile to be committed
    - when: on_success
  dependencies: [generate-lockfile]  # download lockfile artifacts

This will ensure the scanning job is created in the pipeline even if you don't commit a lockfile and will also enable the job to download artifacts from a job where you produce your lockfile.
Just change the generate-lockfile job to whatever is necessary for generating your lockfile and expose it as an artifact.

---

Of course, you probably want to be committing a lock file to begin with, but that's beside the point in this question, I suppose.