Skip to content

Show Needs triage instead of DETECTED in finding modals

Lorenz van Herwaarden requested to merge show-needs-triage-instead-of-detected-modals into master

What does this MR do and why?

Related #434128 (closed)

"Needs triage" has been shown as label for the detected state on vulnerabilities for a while and it makes sense to extend this for findings too in the finding modal. This MR changed the old and new finding modal such that it uses the StatusBadge component which renders the correct translation of the status and correct badge color when the status is provided.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After
new-modal-dismissed-before new-modal-dismissed-after
new-modal-detected-before new-modal-detected-after
old-modal-dismissed-before old-modal-dismissed-after
old-modal-detected-before old-modal-detected-after

How to set up and validate locally

Prerequisites

  1. You need an EE license
  2. You need to have runners enabled (See $2408961 for setting up a runner)
  3. Import https://gitlab.com/gitlab-examples/security/security-reports
  4. Run a pipeline on master

Validate

New modal

  1. Go to a pipeline > security tab > click on a finding
  2. This shows the new finding modal. Validate that it shows "Needs triage" when in the detected status.
  3. Dismiss the finding and open the modal again. Validate that is shows a grey background for the dismissed status.

Old modal

  1. Import https://gitlab.com/gitlab-org/govern/demos/sandbox/minac/test-remediations
  2. Do not run a pipeline yet on master!
  3. In the imported test-remediations project
    1. go to reports/sast.json and remove both entries in vulnerabilities, leaving effectively an empty array
    2. commit and push this to master
    3. now, in reports/sast.json, add the removed vulnerabilities back again, but commit and push to a new branch, and create a merge request.
  4. In the MR, expand the security scanning widget and click on any finding
  5. This shows the old modal.
  6. Validate that it shows "Needs triage" when in the detected status.
  7. Dismiss the finding and open the modal again. Validate that is shows a grey background for the dismissed status.
Edited by Lorenz van Herwaarden

Merge request reports