[R24.5] SAST / DAST PCWM conformity : TRG 8.01 & TRG 2-6

[mkanal]

As product
I want migrate from deprecated S/DAST to new proposed S/DAST toolings
so that compliant to the TRGs for R24.5

Hints / Details

Please migrate to the new tools, which means using Static Application Security Testing CodeQl (https://eclipse-tractusx.github.io/docs/release/trg-0/trg-8-01/ ) for software security testing and Software Composition Analysis (https://eclipse-tractusx.github.io/docs/release/trg-2/trg-2-6/ ) for analyzing software components. It is also important to change/delete the related GitHub actions.

Acceptance Criteria

• TRG 8 .1 Veracode is descoped from documentation, cd/cd pipeline, code, KIT docu etc
• TRG 8 .1 CodeQl is used for SAST including extension documentation, cd/cd pipeline, code, KIT docu etc
• TRG 2.1 Dependabot is used for SCA including extension documentation, cd/cd pipeline, code, KIT docu etc
• TRG 2.1 Veracode is descoped from documentation, cd/cd pipeline, code, KIT docu etc

Out of Scope

• ...

[ds-jhartmann]

See #421

[ds-ext-kmassalski]

• DONE - TRG 8 .1 Veracode is descoped from documentation, cd/cd pipeline, code, KIT docu etc
• DONE - TRG 8 .1 CodeQl is used for SAST including extension documentation, cd/cd pipeline, code, KIT docu etc
• DONE - TRG 2.1 Dependabot is used for SCA including extension documentation, cd/cd pipeline, code, KIT docu etc
• DONE - TRG 2.1 Veracode is descoped from documentation, cd/cd pipeline, code, KIT docu etc

[mkanal]

Outcome:

• https://github.com/eclipse-tractusx/item-relationship-service/actions/workflows/codeql.yml
• @ds-ext-kmassalski as there are no alerts I wonder if this is configures correctly https://github.com/eclipse-tractusx/item-relationship-service/security/dependabot
• Removed veracode from Conflunce

There is only one rule available

[ds-ext-kmassalski]

@ds-ext-kmassalski as there are no alerts I wonder if this is configures correctly https://github.com/eclipse-tractusx/item-relationship-service/security/dependabot

I compared it with other teams config files from 'eclipse-tractusx', and it seems fine to me.

[ds-jhartmann]

We did not change any Dependabot rules, so the Organization default is used. From what I can see, everything works as expected.
Alerts are enabled: