How to add Static Application Security Testing (SAST) with SonarQube Cloud Free Tier to a GitLab CI/ CD pipeline

ESLint catches code quality issues. Typecheckers ensures variables and functions use the correct data types. Prettier automatically formats code for consistent style. But how can we start incorporating security testing into this GitLab CI/CD pipeline we have built? 

• GitLab repo: https://gitlab.com/tjmaher/bun-create-playwright

For this blog post we will be looking at one way to do Static Application Security Testing (SAST), adding SonarQube to our project.

What is Static Application Security Testing?

Static Application Security Testing (SAST) is a method of security testing that scans an application's source code, bytecode, and binaries for any security flaws. Because it analyzes the code without actually running the application -- meaning the code is "static" -- developers can use it early in the coding phase to catch and fix bugs immediately.

Although source code scanners have been around a while in the computer industry,  the term "Static Application Security Testing (SAST)" originated as a buzzword by Gartner, Inc. Gartner is known for their "Magic Quadrant" a visualization technique they use to map out industry leaders on a four part grid "Completeness of Vision" and "Ability to Execute" showing who are the market leaders, who are the challengers, who are the visionaries, and who are the niche players, as they put it.

Joseph Feiman and Neil Macdonald published in 2009 their paper Magic Quadrant for Static Application Security Testing (See PDF). 

Refactoring The-Internet: Deploying the web app to Render

We are well on our way to place a copy of my favorite test site, The-Internet, onto its new home on Render.com, a place where developers can deploy web apps using their free tier, much like Heroku in its heyday. Sure, web apps that live on the free tier of Render takes a minute or so to spin up, but, hey, you get what you pay for!

With our last blog post, we: 

• Examined using Google AI the Gemfile of the original The-Internet, a Ruby project at https://github.com/saucelabs/the-internet, hosting on the failing site, https://the-internet.herokuapp.com/
• Created a new copy of the web app onto my GitHub site, forking the original repo
• Updated the Ruby architecture of the web app per Google AI's findings. 
• Tested the web app could be deployed locally and pushed the changes to my GitHub site: https://github.com/tjmaher/the-internet
• Almost have the site at its new home at https://the-internet-8uaj.onrender.com/

With this blog post, we will create a new account on Render, a new project, and set up a new home for The-Internet.  

Refactoring The-Internet: Fork, Fix, Farewell to Heroku and hello to Render!

With this blog post, we will be taking Dave Haeffner's The-Internet, https://the-internet.herokuapp.com/, a ten-year old web app test site, fork it, investigate using Google AI how to modernize the server architecture, and port it over to a new home at Render.com. 

• Spoilers: The original version, but with updated Ruby architecture: https://the-internet-8uaj.onrender.com/ (takes a minute to spin up the environment)

It finally happened. Dave Haefner's The-Internet, a test site I have been using ever since I first started blogging, is now failing to load half the time. It's not the test site's fault. It's Heroku.