Improve Secure fixtures for local development

Fixtures for development that we have right now don't provide useful data for local development: only SAST vulnerabilities are created and only 20 of them. That leads to the fact that engineers have to set up runner and run CI jobs locally to get the data that they need for their work process. This is not efficient for the next reasons:

  1. Running jobs takes time
  2. GDK + Runner can be unstable so people end up fixing their local environment instead of developing new features.

The fact that there are fixtures only for SAST leads to the fact that features such as Dependency list and License Compliance can't be tested. Since only items of Vulnerabilities::Occurrence are created, without reports, it also breaks testing of Project Security Dashboard.

Proposal

  1. Add fixtures for Dependency Scanning and License Compliance report
  2. Add fixtures for different security vulnerabilities (with auto-fix solutions, with dependency list) + license compliance findings.
  3. Add license compliance policies to projects.

Implementation Details

Data for Vulnerability Report page:

  1. Create a new ee/db/fixtures/development/number_items.rb file to create needed development fixtures.
  2. In this file create pipeline with dependency_scanning trait `create(:ee_ci_pipeline, :dependency_scanning)
  3. Pipeline contains artifacts that needed to be parsed in the same way as it's done in production using StoreReportService.
  4. Check Vulnerability Report and individual vulnerability pages to ensure that data is set up correctly.

Data for Dependency List and License Compliance page

  1. Create JobArtifact that has dependency_scanning report create(:ee_ci_job_artifact, :dependency_list). Assign it to the dependency_scanning job in the latest pipeline.
  2. Add to the same pipeline license_scanning job and add JobArtifact of license_scanning type create(:ee_ci_job_artifact, :license_scanning).
Edited by Tetiana Chupryna