Feature flag rollout: dependency_malware_detection

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Summary

Roll out malware detection on the dependency list, currently behind the dependency_malware_detection feature flag introduced in !249360 (merged).

  • DRI: @dpisek
  • Team Slack channel: #<slack-channel-of-dri-team>

This flag gates the dependency list frontend:

Surface What it gates
Project and group dependency list Malware badge in the Risk column
Project and group dependency list Malware filter token
Project and group dependency list Risk column popover copy that mentions malware packages

It replaces half of malicious_package_detection, which !249360 (merged) splits into vulnerability_malware_detection (rollout: #597347) and this flag, so that the vulnerability report can be rolled out without also turning on dependency list UI.

Feature flag

Flag Type Actor Default
dependency_malware_detection beta root namespace disabled

What could go wrong?

The dependency list backend is not finished, so enabling this flag on its own does not produce a working feature:

  • The malware field on dependencies was previously gated separately by dependency_malware_field_project (#600274 (closed)); !251948 (merged) merged that flag into this one, so the field is now gated directly by dependency_malware_detection. The badge renders once this flag is on, so that half of the problem is resolved.
  • The malware filter argument is still gated separately, by malicious_packages_dependency_list_filtering (rollout: #600025), and Sbom::DependenciesFinder does not apply it yet. Resolvers::Sbom::DependencyInterfaceResolver#mapped_params validates the argument and then discards it (#587758), so a user who filters by malware silently gets unfiltered results.
  • Because the frontend filter token is gated on this flag while the GraphQL argument is gated on malicious_packages_dependency_list_filtering, enabling only dependency_malware_detection shows the malware filter token, and using it raises The malware filter is not available.

The badge is safe to roll out on this flag alone now that the field gating has been folded in. The filter token is the part to be careful about: enable it only alongside malicious_packages_dependency_list_filtering, and treat the finder work in #587758 as a prerequisite for the filter to actually work. Blast radius is otherwise limited to rendering on the dependency list, with no data or write path involved.

Rollout

Prerequisites

Both original prerequisites are now met: !249418 (merged) merged, so the frontend reads the dependency_malware_detection flag name directly, and !251948 (merged) merged, so the malware field on the REST and GraphQL dependency APIs is gated by this flag with no separate field flag needed.

One prerequisite remains, but it applies only to the malware filter token, not the badge: enable malicious_packages_dependency_list_filtering (#600025) for the same actors, and land the finder integration tracked in #587758. Until then, the filter token is visible but non-functional.

Run all production /chatops in #production and cross-post the results to the team channel. Background: incremental rollout process, feature actors.

Non-production:

/chatops gitlab run feature set dependency_malware_detection 50 --actors --dev --pre --staging --staging-ref
/chatops gitlab run feature set dependency_malware_detection true --dev --pre --staging --staging-ref

Production, percentage rollout (wait at least 15 minutes between steps, watch dashboards):

/chatops gitlab run feature set dependency_malware_detection <percentage> --actors

Or target specific actors instead:

/chatops gitlab run feature set --group=gitlab-org,gitlab-com dependency_malware_detection true
/chatops gitlab run feature set --user=dpisek dependency_malware_detection true

Verification

  • Malware badge renders in the Risk column on the project dependency list
  • Malware badge renders on the group dependency list
  • Malware filter token appears in the project and group filtered search
  • Risk column popover copy mentions malware packages
  • Filtering by malware returns the expected results rather than silently unfiltered ones

Before global rollout

Confirm the relevant gotchas before going to 100%, see enabling a feature for GitLab.com:

  • malicious_packages_dependency_list_filtering is enabled for the same actors
  • The finder integration in #587758 has landed, so the malware filter returns real results
  • Docs and version history updated
  • External API consumers handled with a fail-open mechanism, if applicable

Cleanup

Remove the flag once deemed stable, see cleaning up. Remove the flag and its YAML definition from the codebase, then:

/chatops gitlab run release check <merge-request-url> <milestone>
/chatops gitlab run feature delete dependency_malware_detection --dev --pre --staging --staging-ref --production

Rollback

/chatops gitlab run feature set dependency_malware_detection false                                         # production
/chatops gitlab run feature set dependency_malware_detection false --dev --pre --staging --staging-ref     # non-production

Related

Edited by Bala Kumar