Draft: Update query tokens for policy violation filtering
What does this MR do and why?
Update query tokens for policy violation filtering
- backend MR to add the filter capability: Filter vulnerabilities dismissed by security po... (!202622)
- initial frontend MR to add the filter: Conditionally show policy violation vuln filter (!206461 - merged)
- include dashboard type in filter function
- create policyViolation variable
Changelog: added
EE: true
References
Screenshots or screen recordings
Scenario | Screenshot |
---|---|
Without feature flag | |
Without elastic search |
![]() |
With elastic search |
How to set up and validate locally
How to set up and validate locally
Elasticsearch
Setup
- Enable the
Elasticsearch
in GDK
gdk config set elasticsearch.enabled true
gdk reconfigure
gdk start elasticsearch
Simulate SAAS mode
- add
export GITLAB_SIMULATE_SAAS=1
toenv.runit
- Restart the gdk
gdk kill && gdk start
Dismiss a security finding blocked by a security policy
- Enable the
advanced_vulnerability_management
andsecurity_policy_approval_warn_mode
feature flags in http://gdk.test:3000/rails/features - Import the security-reports project.
- Run a new pipeline on the default branch to create vulnerabilities
- Go to Secure > Policies and create a Merge Request Approval policy
- Create an MR editing the README file
- Create a record of
Security::PolicyDismissal
to simulate a bypassed/dismissed policy
Security::PolicyDismissal.create(project: Project.second_to_last, merge_request: MergeRequest.last, security_policy: Security::Policy.last, user: User.first, dismissal_reason: 0, security_findings_uuids: ["84c1832e-294d-59f0-b3ff-b4414cc86c70"])
- Checkout Filter vulnerabilities dismissed by security po... (!202622)
- Cherry pick this MR onto that
- Navigate to a project/group => Secure => Vulnerability Report => Filter by "Dismissed in MR"
- Verify only the new vulnerabilities appear
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #549786
Edited by Alexander Turinske