GSoC 2026 Week 7: Dependency Upgrades & Completion of Layer 3 CI/CD Pipeline

The week was kind of hectic as mid term evaluation was close and I wanted my pipeline to be perfect and fully functional. Apart from that, I also came across some of the vulnerabilites related to the composer, some packages were way too old and therefore I decided to upgrade them. And some work related to reducing the job time.

So basically, this week I did two major things and raised the PR for the same:

1. Dependency upgrades
2. Completion of Layer 3 in our CI/CD pipeline

Here is a detailed breakdown of what I did this week.

---

1. Security Dependency Upgrades

Dependency Upgrades

From the report’s generated by the composer scanning we upgraded the below dependencies to remove vulnerabilities from our codebase:

• phpoffice/phpspreadsheet
• guzzlehttp/guzzle & guzzlehttp/psr7
• laravel/framework
• symfony/http-foundation
• symfony/routing
• symfony/polyfill-intl-idn

---

2. Custom Security Scoring & Assessment Engine

I built an extensible, object-oriented framework under app/Security/ to normalize, score, and evaluate MR:

[Layer 1: SAST/DAST Tooling]
   ├── composer-audit-report.json
   ├── phpstan-report.json
   └── zap_report.json
            │
            ▼
[Layer 2: Normalization & CWE Resolution]
   ├── FindingNormalizer
   └── CweMapper
            │
            ▼
[Layer 3: Risk Scoring Engine]
   ├── PhiClassifier (Classify: Critical PHI / Moderate PHI / Non-PHI)
   └── CvssScorer (CVSS Base Score + Duality Risk Adjustment)

• Finding Normalizer (FindingNormalizer.php): As we discussed in the last post it works same no changes here.
• CWE Resolver (CweMapper.php): Maps incoming scan findings and tool-specific messages to standard Common Weakness Enumeration (CWE).
• CVSS v3.1 Scorer (CvssScorer.php & FindingMetricsMapper.php): Calculates CVSS base scores for vulnerabilities using metric vectors.
• PHI Tier Classifier (PhiClassifier.php): As we discussed in the last post it works same no changes here.
• Risk Adjustment: Base CVSS scores we adjusted the score to upward if they affect PHI-critical contexts ($\text{Adjusted Score} = \min(10.0, \text{Base Score} + \text{PHI Adjustment})$ with +2.0 for Critical, +1.0 for Moderate).

It was already there built we atuotmated it with the commands now as soon as the command runs, the findings.json and scored_findings.json is generated with the security-report.html as an artifact which makes the things very easy for the contributor for to look up as an aggregate in real interactive view.

---

3. Security Gate Evaluation: Last Layer

We implemented a security gate Gate/SecurityGate.php to rule the pipeline execution based on risk calculation.

Failure Conditions

A build fails if:

1. Any vulnerability achieves an adjusted CVSS score $\ge 8.5$.
2. Any vulnerability affecting a Critical or Moderate PHI tier achieves an adjusted CVSS score $\ge 7.0$.

If either condition is satisfied, the pipeline will stop and the MR will be blocked.

Now all the finds is normalized from the artifacts and then findings.json is generated with the scored_findings.json for the complete report based with CWE ID and findings.html represent the clearer view of the vulnerabilities.

---

4. GitLab CI/CD Runner Optimization

After building the 3 layers what did I came across was our pipeline stages where working fine but all stages were working same firstly they pull the php image install dependencies and then run the script and since it was adding to our job total time I created the docker file with multiple stage as discussy with Robby O’Connor and then I registered it on the gitlab registery and then since our image will be cached it would reduce our effective CI/CD run time by 3-4 minutes.

Add the commands to run the pipeline only on the MR.

---

Next Week Plan

In the upcoming weeks, I will focus on:

1. I will talk to my mentor for actually understanding the outcome for the security metrices and security trend.
2. I will work on the MU tests.

---

Acknowledgement

Thank You Mua Rachmann and Robby O’Connor for your guidance, support.

Thanks for following my GSoC journey.