Move MR creation card in the vulnerability record to activity timeline

Problem to solve

If one of colleagues creates an MR from a vulnerability (for example, through Vulnerability Resolution), and then I create an MR, their original MR is no longer linked because it gets replaced with the most recent one created. The original MR is still out there, but is no longer linked from the vulnerability.

VR- Replaced MR .mp4

Every MR is saved when going to the MR page; they're just not referenced from the vulnerability record:

Ideal state

From comment in this issue:

It would be ideal if the MR could be added under Linked items , but I don't know if that's scoped to only including issues (given the Create issue and Add existing issue buttons on the right). If that's the case, it should say Linked issues instead of items , but this is probably something for the Plan team. I asked about this in Slack (thread here) and it looks like the Plan team is going to support MRs in Linked Items, but this hasn't been implemented yet. Here is the design for that.  From @nickleonard:

It's listed as "MVC9" in the implementation plan here: &7105 This is a Q2 roadmap item but we are still working on MVC1, so it may be a bit before we get to this. @gweaver can help clarify.

Me:

FYI, vulnerabilities are not officially a work item type, but maybe that's irrelevant because this update will be more linked to the use of the container?

Nick:

I'm not sure how much, if any, of the vulnerability Linked Items widget is reusing components from the work items Linked Items widget, my guess is that the work we're doing in the work items widget probably provides some reusable pieces but won't 100% solve this — engineering ( @kushalpandya) would know more.

Related: Spike: Investigate usage of WorkItems for vulne... (#454256 - closed)

So while they work on that, for my point (1) above, maybe we (Threat insights) can focus on moving that MR creation status from the card above Linked items to an activity item (below Detected date in pipeline XYZ)?

MVC Proposal

Move any (and all) MR creation events to the activity timeline:

See design section below for final design proposal.