Skip to content

[FE] Bulk status change for findings in the pipeline security dashboard for "dismiss" and "needs triage"

Why are we doing this work

Recently, with !61536 (merged) we started using the vulnerability_list.vue component in the Pipeline Security Dashboard. This list is backed by GraphQL and was already used in the Project, Group and Instance. The bulk update works only for the vulnerabilities, we need to write a different query for the findings.

In this issue, we'll only allow the "Dismiss" and "Needs triage" bulk state actions because those two have graphql mutations for findings. The other two will be added after [BE] Bulk status change for findings in the pip... (#431818) • Unassigned • Backlog is closed.

Steps to reproduce:

  1. Fork a repository (such as https://gitlab.com/gitlab-examples/security/security-reports/)
  2. Run the pipeline
  3. Enable the feature flag: :pipeline_security_dashboard_graphql
  4. Go to Project > CI/CD > Pipelines > Your Pipeline > Security Tab

Relevant links

Implementation plan

  • frontend ee/app/assets/javascripts/security_dashboard/components/selection_summary.vue contains the logic to handle the bulk status change for vulnerabilities. We need to extend it so that it uses different mutations when injected dashboardType === 'pipeline'
  • frontend add entries findingMutation in VULNERABILITY_STATE_OBJECTS in ee/app/assets/javascripts/vulnerabilities/constants.js pointing to the finding mutations.
  • frontend Implement tests.

Verification steps

  1. Go to the verification project latest pipeline on the security tab: https://gitlab.com/gitlab-org/govern/threat-insights-demos/verification-projects/security-reports-pipeline-security-listing-migration-and-enhancements/-/pipelines/1100011493/security
  2. Select a couple of findings and validate you can change state to "dismiss" (with dismissal reason) or "needs triage".
Edited by Lorenz van Herwaarden