From 40c85eff562a00ceb9b381ef72472ce1910b97ab Mon Sep 17 00:00:00 2001
From: Bertrand Goareguer <bertrand.goareguer@gmail.com>
Date: Thu, 24 Oct 2024 14:23:51 +0000
Subject: [PATCH] fix: limit security reports access to developer role or
 higher

---
 README.md                      | 4 ++--
 templates/gitlab-ci-python.yml | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 0c608d9..a212cf5 100644
--- a/README.md
+++ b/README.md
@@ -228,7 +228,7 @@ It is bound to the `test` stage, and uses the following variables:
 | `bandit-enabled` / `BANDIT_ENABLED` | Set to `true` to enable Bandit analysis                                | _none_ (disabled) |
 | `bandit-args` / `BANDIT_ARGS`    | Additional [Bandit CLI options](https://github.com/PyCQA/bandit#usage) | `--recursive .`   |
 
-In addition to a textual report in the console, this job produces the following reports, kept for one day:
+In addition to a textual report in the console, this job produces the following reports, kept for one day and only available for download by users with the Developer role or higher:
 
 | Report         | Format                                                                       | Usage             |
 | -------------- | ---------------------------------------------------------------------------- | ----------------- |
@@ -249,7 +249,7 @@ It is bound to the `test` stage, and uses the following variables:
 | `trivy-dist-url` / `PYTHON_TRIVY_DIST_URL` | Url to the `tar.gz` package for `linux_amd64` of Trivy to use (ex: `https://github.com/aquasecurity/trivy/releases/download/v0.51.1/trivy_0.51.1_Linux-64bit.tar.gz`)<br/>_When unset, the latest version will be used_ | _none_ |
 | `trivy-args` / `PYTHON_TRIVY_ARGS`       | Additional [Trivy CLI options](https://aquasecurity.github.io/trivy/latest/docs/references/configuration/cli/trivy_filesystem/) | `--ignore-unfixed --pkg-types library --detection-priority comprehensive`   |
 
-In addition to a textual report in the console, this job produces the following reports, kept for one day:
+In addition to a textual report in the console, this job produces the following reports, kept for one day and only available for download by users with the Developer role or higher:
 
 | Report         | Format                                                                       | Usage             |
 | -------------- | ---------------------------------------------------------------------------- | ----------------- |
diff --git a/templates/gitlab-ci-python.yml b/templates/gitlab-ci-python.yml
index 13f66d3..51fd582 100644
--- a/templates/gitlab-ci-python.yml
+++ b/templates/gitlab-ci-python.yml
@@ -1234,6 +1234,7 @@ py-bandit:
     when: always
     name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"
     expire_in: 1 day
+    access: developer
     paths:
       - "$PYTHON_PROJECT_DIR/reports/py-bandit.*"
   rules:
@@ -1310,6 +1311,7 @@ py-trivy:
   artifacts:
     name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"
     expire_in: 1 day
+    access: developer
     when: always
     paths:
       - "$PYTHON_PROJECT_DIR/reports/py-trivy.*"
-- 
GitLab