Add vulnerabilityIssueLinkCreate GraphQL mutation
Why are we doing this work
Based on #267582[design_1641499459303.png] we need the ability to link multiple Vulnerabilities with an existing Issue
Implementation plan
-
Create a service object that: - accepts an Issue and a list of Vulnerabilities
- creates
Vulnerabilities::IssueLinkrecords for the selected Vulnerabilities and a given Issue withlink_typeofrelated - returns created
Vulnerabilities::IssueLinkrecords
-
Create a GraphQL mutation that: - accepts a list of Vulnerabilities and an Issue
- uses the service object to create necessary associations
- sets query complexity according to snippet from #373816 (comment 1117079824)
-
Consider firing a background worker if more than 100 (can be higher) Vulnerabilities are selected to prevent timeouts. This can be done in a follow-up issue.-> split off in #408365
Verification
You can use this test project
- Go to https://gitlab.com/gitlab-org/secure/tests/verify-373816/-/security/vulnerability_report
- Note down the ID of a vulnerability that does not have an issue link (the Activity column is empty).
- Go to https://gitlab.com/-/graphql-explorer and run this query:
mutation($input: VulnerabilityIssueLinkCreateInput!) { vulnerabilityIssueLinkCreate(input: $input) { issueLinks { id issue { title } linkType } } } - variables:
{ "input": { "clientMutationId": "xyz", "issueId": "gid://gitlab/Issue/127078651", "vulnerabilityIds": [ "gid://gitlab/Vulnerability/<insert vuln id>" ] } } - Reload the 'Vulnerability Report' page and you should see the vulnerability is now linked to issue 1 on the project.
Edited by Malcolm Locke