Container Scanning with Auto DevOps shows confusing results
Summary
When running the Container Scanning job as a part of Auto DevOps, it returns a lot of results not related to the project itself. This can be confusing to users and it can result in slower adoption both Auto DevOps and Container scanning features.
Steps to reproduce
- Create an any project
- Enable Auto DevOps
- Run pipeline and make sure that it's successfully finished
- Go to Security Dashboard
- Observe
contaner_scanningvulnerabilities
Example Project
What is the current bug behavior?
The dashboard shows an enormous quantity of vulnerabilities, although all of them are coming from default container, used for Auto DevOps.
What is the expected correct behavior?
Dashboard says that there is no container_scanning vulnerabilities
Relevant logs and/or screenshots
https://gitlab.com/gitlab-org/creator-pairing/rails-app/-/jobs/341034648
Output of checks
This bug happens on GitLab.com
Possible fixes
We can update the Auto DevOps default container(?) to a more safer version. Probably, this will require collaboration with ~"group::orchestration"