gitlabci.yml

stages:
  - dev
analisis_SAST:
  stage: dev
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
  allow_failure: false
  services:
    - docker:stable-dind
  script:
    - export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
    - docker run
        --env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
	--volume "$PWD:/code"
        --volume /var/run/docker.sock:/var/run/docker.sock
        "registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code
  artifacts:
    reports:
      sast: gl-sast-report.json
analisis_DAST:
  stage: dev
  image: registry.gitlab.com/gitlab-org/security-products/zaproxy
  variables:
    website: "https://reporteprecios-test.msp.gob.ec"
  allow_failure: false
  script:
    - docker run
      --volume $PWD:/zap/wrk
      registry.gitlab.com/gitlab-org/security-products/zaproxy zap-baseline.py -t $website  -J gl-dast-report.json || true
  artifacts:
    reports:
      dast: gl-dast-report.json

para proyectos con java, agregar el parámetro a la ejecución de docker
- docker run
--env SAST_CONFIDENCE_LEVEL="${SAST_CONFIDENCE_LEVEL:-3}"
--volume "$PWD:/code"
--volume /root/.m2:/root/.m2
--volume /var/run/docker.sock:/var/run/docker.sock
"registry.gitlab.com/gitlab-org/security-products/sast:$SP_VERSION" /app/bin/run /code