[Frontend] Add an apply button that attaches a triage and remediation preset to a single project, replacing any already attached (triage and remediation preset drawer)

References:

  • prototype, one project: https://atr-prototype-201201.gitlab.io/#/version/crawl/security-coverage/project/gen-22, select Enable with a profile, pick a preset, then Apply profile
  • prototype, inventory: https://atr-prototype-201201.gitlab.io/#/version/crawl/security-coverage, a project's row actions, Apply profile
  • the drawer is #633881. It is opened from the project page by #633903 and from an inventory row's Capabilities popover by #634414. This issue builds apply once, for both. Bulk apply reuses this drawer and its apply button for several items, from its own bulk action (#633908).
  • mutation to apply a preset (ee/app/assets/javascripts/security_configuration/graphql/scan_profiles/security_scan_profile_attach.mutation.graphql): 
    mutation {
  securityScanProfileAttach(input: {
    securityScanProfileId: "gid://gitlab/..." # id from availableSecurityScanProfiles
    projectIds: ["gid://gitlab/Project/1"]   # the project the drawer was opened with
  }) {
    errors # failures for projectIds, such as a project at its scan profile limit.
           # If the user cannot apply to the project, the request is rejected
           # and nothing is applied
  }
}

Acceptance criteria:

  • Given the triage_and_remediation_profiles_ui feature flag is enabled
  • Given the preset drawer is open for a project
  • When the user selects a preset, then the drawer shows an Apply profile button
  • When the user selects Apply profile, then the drawer calls securityScanProfileAttach with the preset and the project, closes, shows a toast, and emits an event so the page can refetch its card or row
  • When some of the preset's capabilities are off for the top-level group, then applying still succeeds, and the toast does not read as if the preset failed. Michael, 2026-10-26: #631466 (comment 4092221431)
  • When a project already has a triage and remediation preset, then the new preset replaces it
    • Note: by design only one triage and remediation profile is attached to a project at a time (#632334). !259205 (merged) made replace the default, merged 2026-10-16.
  • When the mutation returns errors, then the drawer stays open and shows them in an alert
  • When the drawer is opened without a project, as from View details on the group page (#634571), then it shows no Apply profile button
  • Confirming before applying, reporting failures and permission popovers are separate issues
  • Out of scope: bulk remove, which this issue used to include, is not in the prototype. A preset is removed from the project page card (#633902). The flag-off criteria that were here are covered by !258623 (merged).

Decisions:

Edited by Miranda Fluharty