Add vulnerabilityIssueLinkCreate GraphQL mutation

Why are we doing this work

Based on #267582[design_1641499459303.png] we need the ability to link multiple Vulnerabilities with an existing Issue

Implementation plan

  • Create a service object that:
    • accepts an Issue and a list of Vulnerabilities
    • creates Vulnerabilities::IssueLink records for the selected Vulnerabilities and a given Issue with link_type of related
    • returns created Vulnerabilities::IssueLink records
  • Create a GraphQL mutation that:
    • accepts a list of Vulnerabilities and an Issue
    • uses the service object to create necessary associations
    • sets query complexity according to snippet from #373816 (comment 1117079824)
  • Consider firing a background worker if more than 100 (can be higher) Vulnerabilities are selected to prevent timeouts. This can be done in a follow-up issue. -> split off in #408365

Verification

You can use this test project

  • Go to https://gitlab.com/gitlab-org/secure/tests/verify-373816/-/security/vulnerability_report
  • Note down the ID of a vulnerability that does not have an issue link (the Activity column is empty).
  • Go to https://gitlab.com/-/graphql-explorer and run this query:
    mutation($input: VulnerabilityIssueLinkCreateInput!) {
      vulnerabilityIssueLinkCreate(input: $input) {
        issueLinks {
          id
          issue {
            title
          }
          linkType
        }
      }
    }
  • variables:
    {
      "input": {
        "clientMutationId": "xyz",
        "issueId": "gid://gitlab/Issue/127078651",
        "vulnerabilityIds": [
          "gid://gitlab/Vulnerability/<insert vuln id>"
        ]
      }
    }
  • Reload the 'Vulnerability Report' page and you should see the vulnerability is now linked to issue 1 on the project.
Edited by Malcolm Locke