Merge branch 'secure-templates-mr-pipelines-2' into 'master'

Allow MR pipelines in latest DAST template

See merge request gitlab-org/gitlab!61672

ee/spec/lib/gitlab/ci/templates/dast_latest_gitlab_ci_yaml_spec.rb

@@ -84,6 +84,31 @@ RSpec.describe 'DAST.latest.gitlab-ci.yml' do
           context 'when no specification provided' do
             include_examples 'includes dast job'
           end
+
+          context 'when pipeline is a merge request pipeline' do
+            before do
+              create(:ci_variable, project: project, key: 'CI_MERGE_REQUEST_IID', value: '1')
+            end
+
+            include_examples 'includes dast job'
+          end
+
+          context 'when pipeline is a branch pipeline with no merge request' do
+            before do
+              create(:ci_variable, project: project, key: 'CI_COMMIT_BRANCH', value: 'feature-branch')
+            end
+
+            include_examples 'includes dast job'
+          end
+
+          context 'when pipeline is a branch pipeline with a merge request' do
+            before do
+              create(:ci_variable, project: project, key: 'CI_COMMIT_BRANCH', value: 'feature-branch')
+              create(:ci_variable, project: project, key: 'CI_OPEN_MERGE_REQUESTS', value: 'true')
+            end
+
+            include_examples 'includes no jobs'
+          end
         end
       end
 

lib/gitlab/ci/templates/Security/DAST.latest.gitlab-ci.yml

@@ -46,10 +46,13 @@ dast:
           $REVIEW_DISABLED && $DAST_WEBSITE == null &&
           $DAST_API_SPECIFICATION == null
       when: never
-    - if: $CI_COMMIT_BRANCH &&
+    - if: $CI_MERGE_REQUEST_IID &&
           $CI_KUBERNETES_ACTIVE &&
           $GITLAB_FEATURES =~ /\bdast\b/
+    - if: $CI_MERGE_REQUEST_IID && ($DAST_WEBSITE || $DAST_API_SPECIFICATION)
+    - if: $CI_OPEN_MERGE_REQUESTS
+      when: never
     - if: $CI_COMMIT_BRANCH &&
-          $DAST_WEBSITE
-    - if: $CI_COMMIT_BRANCH &&
-          $DAST_API_SPECIFICATION
+          $CI_KUBERNETES_ACTIVE &&
+          $GITLAB_FEATURES =~ /\bdast\b/
+    - if: $CI_COMMIT_BRANCH && ($DAST_WEBSITE || $DAST_API_SPECIFICATION)