Skip to content

Fix dismiss/undismiss findings for pipeline security tab

Daniel Tian requested to merge 390073-fix-dismiss-undismiss-for-pipeline-security-tab into master

What does this MR do and why?

This MR updates the dismiss/undismiss actions on the pipeline security tab to use GraphQL mutations instead of the vulnerability_feedback endpoint, which is going away as part of the deprecate vulnerabilities feedback work. The dismiss/undismiss actions can be done both on the security findings list itself, as well as in the modal:

Findings list Finding modal
ksnip_20230323-162629 ksnip_20230323-162643

Note that this MR only updates the dismiss, dismiss with comment, and undismiss actions, but it does not update adding, editing, or deleting a dismissal comment. That will be handled in the next MR.

How to set up and validate locally

  1. Do not enable the deprecate_vulnerabilities_feedback feature flag yet.
  2. Clone any project that has security findings, like this one: https://gitlab.com/gitlab-examples/security/security-reports
  3. Run a pipeline against any branch, then go to the pipeline security tab for that pipeline.
  4. Dismiss a finding from the security list by clicking on the dismiss action button to the right of it. Verify that the finding is marked as dismissed on the security list.
  5. Click on the finding to show the modal for it, and verify that it's shown as dismissed in the modal.
  6. Close the modal and undismiss the finding using the undismiss action button to the right of the finding. Verify that the finding is no longer marked as dismissed on the security list.
  7. Click on the finding to show the modal for it, and verify that it's shown as detected in the modal.
  8. Enable the deprecate_vulnerabilities_feedback feature flag and repeat steps 4 to 7 to verify that it works the same way when the feature flag is on.` button.

Verification with feature flag off

Verification with feature flag on

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #390073 (closed)

Edited by Daniel Tian

Merge request reports