Use security findings for mr widget report comparision
What does this MR do and why?
Uses security_finding objects to get the MR security widget results. Previously we were parsing report artifacts each time the widget was called. With this change we get the results from security_finding objects stored in the DB.
More details -
- Added a new comparer class
Gitlab::Ci::Reports::Security::SecurityFindingsReportsComparerwhich comparesSecurityFindingobjects based on their uuids. This comparer is based onGitlab::Ci::Reports::Security::VulnerabilityReportsComparerbut has a much simpler comparision logic. This comparer is under themigrate_mr_security_widget_to_security_findings_tableFF. - Once this change goes in completely, we can remove the usage of
VulnerabilityReportsComparerand also thePipelineVulnerabilitiesFinderif not needed anymore. - A follow up will be needed to update development docs here
This is a follow up for - !151358 (merged)
References
Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
On Ultimate plan
- Make changes in a repo fixing old/adding new vulnerabilities.
- Raise an MR
- Once the pipeline is run successfully, Security MR widget should display the fixed and added vulnerabilties. More info: https://docs.gitlab.com/ee/user/application_security/detect/security_scan_results.html
Relates to #390185 (closed)
Edited by Rushik Subba