wcz-layout/skills/start/steps/10-gitlab-ci.md

# GitLab CI

## SAST And Build Image

The pipeline includes additional stages beyond this section. Complete the following setup before relying on the first GitLab CI run.

### SAST

The SAST stage requires both the Sonatype SCA and SonarQube projects to be configured.

#### Sonatype SCA

1. Sign in to [Sonatype](https://sca.wistron.com/) with the general development account. Retrieve its credentials from KeePass.
2. Navigate to **Orgs and policies** > **Applications**.
3. Select the add-application icon, then choose **New application**.
4. Set **Application Name** to exactly the GitLab project name, then save the application.

#### SonarQube

1. Sign in to [SonarQube](https://sonarqube.wistron.com/) with your employee ID and domain password.
2. Select **Create Project** > **Manually**.
3. Set the project display name to exactly the GitLab project name and set the main branch to `master`.
4. Generate a project token.
5. In GitLab, navigate to **Settings** > **CI/CD** > **Variables** and create `SONAR_TOKEN` with the generated token as its value. Do not expose the token in chat, files, or logs.
6. In SonarQube, navigate to **Project Settings** > **Permissions** and grant the development team the required project permissions.