Activity Filter not working as expected with "Has Issue" selection in vulnerability report

Summary

Activity Filter not working as expected with "Has Issue" selection in vulnerability report

Steps to reproduce

1. Create an MR in a new project, with security findings in the pipeline (non-default branch)
2. Create issue from a finding in pipeline security tab.
3. Merge the MR, check for the default pipeline run.
4. In vulnerability report, filter by Activity-> Has Issue.

Run this E2E spec to reproduce (you can add a debug point when the spec reaches vulnerability report page)

 WEBDRIVER_HEADLESS=false GITLAB_ADMIN_PASSWORD="xxxx" GITLAB_QA_ACCESS_TOKEN=xxxx GITLAB_PASSWORD="xxxx" QA_DEBUG=true QA_GITLAB_URL=http://192.168.1.105:3000 bundle exec rspec  ./qa/specs/features/ee/browser_ui/10_govern/vulnerability_management_spec.rb:136

Example Project

What is the current bug behavior?

"Has Issue" activity filter selection does NOT show vulnerability with issue.

What is the expected correct behavior?

The filter should show vulnerabilities which have issues.

Relevant logs and/or screenshots

Screenshot

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info

(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check

(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
(we will only investigate if the tests are passing)

Implementation plan

• database Update the current triggers to set the has_issues column correctly for the vulnerability_reads records(See insert_or_update_vulnerability_reads, and insert_vulnerability_reads_from_vulnerability functions)

Verification steps

1. Go to https://gitlab.com/gitlab-org/govern/threat-insights-demos/verification-projects/verify-386434

2. Add a CI job On a new branch which introduces new vulnerabilities. For example:

   sast-spotbugs:
     script:
       - wget https://gitlab.com/gitlab-examples/security/security-reports/-/raw/master/samples/sast-eslint.json
     artifacts:
       reports:
         sast: sast-eslint.json

3. Create a merge request for that branch

4. Go to the branch pipeline

5. Click on the security tab

6. Create an issue for one of the vulnerabilities

   

7. Merge the MR

8. Go to Security and Compliance -> Vulnerability Report

9. Use the activity filter to show only vulnerabilities which have issues

   

10. The vulnerability that you created an issue for should appear in the list when the filter is active (prior to this change, it would not).