Container Scanning with Auto DevOps shows confusing results

Summary

When running the Container Scanning job as a part of Auto DevOps, it returns a lot of results not related to the project itself. This can be confusing to users and it can result in slower adoption both Auto DevOps and Container scanning features.

Steps to reproduce

  1. Create an any project
  2. Enable Auto DevOps
  3. Run pipeline and make sure that it's successfully finished
  4. Go to Security Dashboard
  5. Observe contaner_scanning vulnerabilities

Example Project

https://gitlab.com/gitlab-org/creator-pairing/rails-app/security/dashboard/?report_type=container_scanning&project_id=15161313&days=90

What is the current bug behavior?

The dashboard shows an enormous quantity of vulnerabilities, although all of them are coming from default container, used for Auto DevOps.

What is the expected correct behavior?

Dashboard says that there is no container_scanning vulnerabilities

Relevant logs and/or screenshots

https://gitlab.com/gitlab-org/creator-pairing/rails-app/-/jobs/341034648

Output of checks

This bug happens on GitLab.com

Possible fixes

We can update the Auto DevOps default container(?) to a more safer version. Probably, this will require collaboration with ~"group::orchestration"

/cc @dzaporozhets @gonzoyumo

Assignee Loading
Time tracking Loading