Skip to content

AI fix in progress badge

Scott Hamptonrequested to merge
556999-vulnerability-report-ai-fix-in-progress into master

What does this MR do and why?

Removed the client side resolver for checking if an AI fix was in progress.

Added new workflow field to query.

Check the connected workflows to see if there is an active session.

This change is behind a feature flag agentic_sast_vr_ui.

References

Related to #556999

Screenshots or screen recordings

Youtube demo: https://www.youtube.com/watch?v=mWEXlPUA7IM

Screenshot_2025-11-04_at_11.19.31_AM

How to set up and validate locally

  1. In rails console enable the feature flag

    Feature.enable(:agentic_sast_vr_ui)

  2. Have a runner set up

  3. Have a group with Duo set up

  4. Visit a project with vulnerabilities in the Duo group

  5. Manually kick off a workflow with curl command

curl -X POST 'http://host.docker.internal:3000/api/v4/ai/duo_workflows/workflows' \
  --header 'Content-Type: application/json' \
  --data '{
    "project_id": "<project_id>",
    "agent_privileges": [1, 2, 3, 4, 5],
    "goal": "Fix vulnerability ID: <vulnerability_id>",
    "start_workflow": true,
    "workflow_definition": "resolve_sast_vulnerability/v1",
    "environment": "web",
    "source_branch": "security/sast/resolve-vulnerability-670"
}' \
  --header 'Authorization: Bearer <PAT_token>'
  1. Verify that an agent session is created and get the ID
  2. Use rails console to connect the vulnerability with the agent session
vulnerability = Vulnerability.find(<vulnerability_id>)
workflow = Ai::DuoWorkflows::Workflow.find(<agent_session_id>)dWorkflow.create!(
vulnerability_occurrence = vulnerability.findings.first
triggered_workflow = Vulnerabilities::TriggeredWorkflow.create!(
  vulnerability_occurrence: vulnerability_occurrence,
  workflow: workflow,
  workflow_name: :resolve_sast_vulnerability
)
  1. Refresh vulnerability report to verify that fix in progress badge renders

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports