Add policy violation badge on vulnerability dependencies list
What does this MR do and why?
Add policy violation badge on dependencies list vulnerabilities
- check if dependency has a vulnerability that has violated a policy violation
- show badge if it does
- update tests
Changelog: added
EE: true
References
Screenshots or screen recordings
| Before | After |
|---|---|
|
|
How to set up and validate locally
- Upload a GitLab Ultimate license
- Enabled licenses in your GDK
- Clone https://staging.gitlab.com/govern-team-test/verification-projects/security-reports-with-dependency-paths
- Navigate to the project => Secure => Policies => New policy => New merge request approval policy
- Create a policy in warn mode and requires approval for any new or existing vulnerabilities
- Ensure you have runners set up for your GDK
- Run the pipeline for the project
- Create an MR that adds dependencies with vulnerabilities that would be picked up by the security policy OR modify this line to be
true - Navigate to the project => Secure => Dependency list
- Verify the
Policy violationbadge appears for dependencies with a tooltip
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #561600
Edited by Alexander Turinske

