How to add additional steps in GitLab CI, such as a static analyzer (SonarQube, SAST)?

To add additional steps, such as the static analyzer SonarQube or SAST, to GitLab CI, you need to update the .gitlab-ci.yml file and add the corresponding jobs.

Example of adding a step with SonarQube:

stages:
  - build
  - test
  - sonar

sonarqube-check:
  stage: sonar
  image: sonarsource/sonar-scanner-cli:latest
  script:
    - sonar-scanner -Dsonar.projectKey=my_project -Dsonar.host.url=https://sonar.example.com -Dsonar.login=$SONAR_TOKEN
  only:
    - master

For SAST, GitLab provides built-in support; simply include the template:

include:
  - template: Security/SAST.gitlab-ci.yml

This will add standard security checks to the pipeline.

Thus, adding new steps boils down to adding new jobs or including ready-made templates in .gitlab-ci.yml.