Skip to content

Add vulnerabilityIssueLinkCreate GraphQL mutation

What does this MR do and why?

This MR adds VulnerabilityIssueLinkCreate GraphQL mutation to link Vulnerability objects to an existing Issue

Related to #373816 (closed)

How to set up and validate locally

  1. Set up a project in GDK with some Vulnerabilities, you can use https://gitlab.com/gitlab-examples/security/security-reports as a base
  2. Create an Issue
  3. Go to Vulnerability Report and note down to Vulnerability IDs
  4. Go to GraphiQL and execute the query given below
  5. Go back to Vulnerability Report, select Activity -> Has issue filter
  6. Verify all Vulnerabilities provided to the mutation have a linked issue
GraphQL query
mutation($input: VulnerabilityIssueLinkCreateInput!) {
  vulnerabilityIssueLinkCreate(input: $input) {
    issueLinks {
      id
      issue {
        title
      }
      linkType
    }
  }
}
{
  "input": {
    "clientMutationId": "sth",
    "issueId": "gid://gitlab/Issue/<insert id>",
    "vulnerabilityIds": [
      "gid://gitlab/Vulnerability/<insert id>",
      "gid://gitlab/Vulnerability/<insert id>"
    ]
  }
}

Database review details

current_user = User.first
vulnerability_ids = Vulnerability.last(3).map { |v| v.to_global_id.to_s }
issue_id = Issue.last.to_global_id.to_s

query = <<~QUERY
mutation($input: VulnerabilityIssueLinkCreateInput!) {
  vulnerabilityIssueLinkCreate(input: $input) {
    __typename
    errors
  }
}
QUERY

variables = {
  "input" => {
    "clientMutationId" => "sth",
    "issueId" => issue_id,
    "vulnerabilityIds" => vulnerability_ids
  }
}

GitlabSchema.execute(query, variables: variables, context: { current_user: current_user })
  Issue Load (0.6ms)  SELECT "issues".* FROM "issues" WHERE "issues"."id" = 644 /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/lib/gitlab/graphql/loaders/batch_model_loader.rb:25:in `block in find'*/
  Project Load (1.1ms)  SELECT "projects".* FROM "projects" WHERE "projects"."id" = 34 LIMIT 1 /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/app/policies/issuable_policy.rb:62:in `subject_container'*/
  ProjectFeature Load (0.5ms)  SELECT "project_features".* FROM "project_features" WHERE "project_features"."project_id" = 34 LIMIT 1 /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/app/policies/project_policy.rb:949:in `access_allowed_to?'*/
  Vulnerability Load (0.5ms)  SELECT "vulnerabilities".* FROM "vulnerabilities" WHERE "vulnerabilities"."id" IN (2381, 2382, 2383) /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/ee/app/graphql/mutations/vulnerabilities/create_issue_link.rb:52:in `all?'*/
  Project Load (0.4ms)  SELECT "projects".* FROM "projects" WHERE "projects"."id" = 41 /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/ee/app/graphql/mutations/vulnerabilities/create_issue_link.rb:52:in `all?'*/
  Vulnerabilities::IssueLink Bulk Upsert (0.5ms)  INSERT INTO "vulnerability_issue_links" ("vulnerability_id","issue_id","link_type","created_at","updated_at") VALUES (2381, 644, 1, '2023-04-17 23:57:55.188740', '2023-04-17 23:57:55.188747'), (2382, 644, 1, '2023-04-17 23:57:55.188750', '2023-04-17 23:57:55.188751'), (2383, 644, 1, '2023-04-17 23:57:55.188753', '2023-04-17 23:57:55.188753') ON CONFLICT ("vulnerability_id","issue_id") DO UPDATE SET "link_type"=excluded."link_type","created_at"=excluded."created_at","updated_at"=excluded."updated_at" RETURNING "id" /*application:console,correlation_id:692562756d8134b0cd276051b9d65fe3,endpoint_id:graphql:unknown,db_config_name:main,console_hostname:malc-Latitude-5530,console_username:malc,line:/ee/app/services/vulnerability_issue_links/bulk_create_service.rb:38:in `bulk_insert_issue_links'*/

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Malcolm Locke

Merge request reports