Add sidekiq worker to populate token status
Problem to solve
Once a Secret Detection Vulnerability has been record in the database, the status of the detected token must be checked and stored.
Proposal
Add a sidekiq worker that iterates through tokens in the SD report and checks the status of the GitLab tokens.
Implementation Plan
-
Create feature flag which defaults to false- Added in Add Backend Support for finding_token_status (!186220 - merged) • Radu Birsan • 17.11 -
returns if the feature flag is not set to true -
returns if the project has not opted inthis is part of [Beta] Validity checks (&16927) • Serena Fang • 18.6 -
Gets the token status for GitLab PAT found in the pipelines report -
Gets the token status for all GitLab tokens found in the pipelines report- Moved to Add Secret Detection token status to all other ... (#534788 - closed) • Craig Smith • 18.2 • On track -
Saves those statuses to secret_detection_token_statuslinking them tovulnerability_occurrence -
Determine an appropriate- handled by Determine an appropriate concurrency_limit for ... (#535378) • Unassigned • 18.7concurrency_limitfor theUpdateTokenStatusWorker -
What should the status of a nil token be? - discussed in #524544 (comment 2425943129). They are set to unknown.
Edited by Craig Smith