Use security findings for mr widget report comparision

What does this MR do and why?

Uses security_finding objects to get the MR security widget results. Previously we were parsing report artifacts each time the widget was called. With this change we get the results from security_finding objects stored in the DB.

More details -

  1. Added a new comparer class Gitlab::Ci::Reports::Security::SecurityFindingsReportsComparer which compares SecurityFinding objects based on their uuids. This comparer is based on Gitlab::Ci::Reports::Security::VulnerabilityReportsComparer but has a much simpler comparision logic. This comparer is under the migrate_mr_security_widget_to_security_findings_table FF.
  2. Once this change goes in completely, we can remove the usage of VulnerabilityReportsComparer and also the PipelineVulnerabilitiesFinder if not needed anymore.
  3. A follow up will be needed to update development docs here

This is a follow up for - !151358 (merged)

References

Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

On Ultimate plan

  1. Make changes in a repo fixing old/adding new vulnerabilities.
  2. Raise an MR
  3. Once the pipeline is run successfully, Security MR widget should display the fixed and added vulnerabilties. More info: https://docs.gitlab.com/ee/user/application_security/detect/security_scan_results.html

Relates to #390185 (closed)

Edited by Rushik Subba

Merge request reports

Loading