Skip to content

Integrate standalone finding modal with MR widget

Lorenz van Herwaarden requested to merge mr-widget-standalone-finding-modal into master

What does this MR do and why?

Relates to #413516 (closed)

This MR introduces a feature flag standalone_finding_modal_merge_request_widget which, if enabled, shows the new standalone finding modal when clicking on a finding on the merge request security reports widget. This standalone finding modal can already be found when clicking a finding in the pipeline security tab.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After
before after

How to set up and validate locally

Prerequisites

  1. You need an EE license
  2. You need to have runners enabled (See $2408961 for setting up a runner)
  3. Import https://gitlab.com/gitlab-examples/security/security-reports
  4. Enable feature flag: echo "Feature.disable(:standalone_finding_modal_merge_request_widget)" | rails c
  5. Edit the .gitlab-ci.yml file and comment one or more of the scanners:
# container-scanning:
#   script:
#     - echo NOOP
#   artifacts:
#     reports:
#       container_scanning: samples/container-scanning.json
  1. Save file, do this directly on main
  2. Edit file again, uncomment the commented scanner and create a merge request (this should make sure findings pop up in the merge request)

Validate

  1. Go to the merge request you just created
  2. Expand the security scanning widget
  3. Click on a finding, validate that this opens the new standalone finding modal. You can validate this by checking that clicking "Dismiss vulnerability" button opens an edit section to provide a dismissal reason and comment.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Lorenz van Herwaarden

Merge request reports