BE: Add filtering for `image` to vulnerability report graphQL query

This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

Why are we doing this work

In order to add dropdown filters for image in issue #337882 (closed), we need to support this filters in the relevant GraphQL query.

Relevant links

• FE issue
• Design issue

Non-functional requirements

• Documentation:
• Feature flag:
  • vulnerability_location_image_filter
  • Feature flag rollout issue: #340915 (closed)
• Performance:
• Testing:

Implementation plan

• backend Extend Vulnerabilities::Finding (https://gitlab.com/gitlab-org/gitlab/blob/master/ee/app/models/vulnerabilities/finding.rb#L4) with new scope by_location_image:

  scope :by_location_image, -> (images) { where("vulnerability_occurrences.location -> 'image' ?| array[:images]", images: images) }

• backend Extend EE::Vulnerability (https://gitlab.com/gitlab-org/gitlab/blob/master/ee/app/models/ee/vulnerability.rb#L4) with new scope that uses new scope added in Vulnerabilities::Finding, ie:

  scope :with_container_image, -> (images) { joins(:findings).merge(Vulnerabilities::Finding.by_location_image(images)) }

• backend Extend Security::VulnerabilitiesFinder (https://gitlab.com/gitlab-org/gitlab/blob/master/ee/app/finders/security/vulnerabilities_finder.rb#L20) execute method (https://gitlab.com/gitlab-org/gitlab/blob/master/ee/app/finders/security/vulnerabilities_finder.rb#L20) with new method filter_by_image that uses scope defined in Vulnerability,

• backend Extend Resolvers::VulnerabilitiesResolver (https://gitlab.com/gitlab-org/gitlab/blob/master/ee/app/graphql/resolvers/vulnerabilities_resolver.rb#L4) with new argument (:image, [GraphQL::Types::String], required: false) and mention in the documentation: when the image filter is present, the search implicitly excludes report types that don't support this location attribute