Show SBOM ingestion errors on the project level dependency list page

Why are we doing this work

With #364709 (closed), we added the ability for GitLab to ingest CycloneDX SBoMs. Currently, SBoMs are validated and the warnings + errors from schema validation are collected, but there is no way to show those errors to the end user.

The dependency list data is sourced exclusively from the SBOM report, so it is critical to report any ingestion error here.

NB: this proposal only applies to the project level dependency list page, not the group level one.

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

  • BE (might already be done with #471319 (closed), depending on order of implementation): Store the ingestion errors for each pipeline in redis ( 1 redis key:value per pipeline): Store the ingestion errors for each pipeline in redis ( 1 redis key:value per pipeline) with a TTL of 30 days (to be adjusted if necessary). NB: we could go with storing errors only for the most recent pipeline for the purpose of this issue, but other needs will require to have it per pipeline so we're going with that. This logic can be added to the IngestReportsService like the set_latest_ingested_sbom_pipeline_id method call.
  • BE: expose the ingestion errors to FE for the dependency list page via the haml
  • FE: load the errors in the vueJS state for the dependency list page and trigger the display of the error messages if anny
  • FE: add a dedicated component to display SBOM ingestion errors (probably can reuse underlying alert component though)

NB: FE work might be extracted in a separate issue, TBD.

Verification steps

Edited by Olivier Gonzalez