Add policyAutoDismissed GraphQL field for vulnerabilities

What does this MR do and why?

When a vulnerability gets auto-dismissed by a vulnerability management policy, we want to display a badge in the activity column of the Vulnerability Report. For that, we need to expose this field in GraphQL.

References

Screenshots or screen recordings

End result with the frontend changes will look like this:

Before (or without FF) After
CleanShot_2025-12-01_at_17.36.41_2x CleanShot_2025-12-01_at_17.34.15_2x

How to set up and validate locally

  1. In rails console enable the feature flag
    Feature.enable(:auto_dismiss_vulnerability_policies)
  2. Create a project
  3. Create an auto-dismiss policy:
    vulnerability_management_policy:
    - name: Auto-dismiss acceptable secrets
      description: Auto-dismiss secrets
      enabled: true
      actions:
      - type: auto_dismiss
        dismissal_reason: not_applicable
      rules:
      - type: detected
        criteria:
        - type: file_path
          value: ".env"
  4. Add .gitlab-ci.yml with secret detection
    include:
    - template: Jobs/Secret-Detection.latest.gitlab-ci.yml    
  5. Add two secrets in the main branch:
    1. .env:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ
    2. .env2:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGA
  6. Wait until the pipeline on main finishes
  7. In the rails console, run the service manually, passing the latest pipeline ID and the two vulnerability IDs:
    Vulnerabilities::AutoDismissService.new(Ci::Pipeline.find(<pipeline_id>), [vuln_1_id, vuln_2_id]).execute
  8. Query the policyAutoDismissed field using GQL explorer:
    {
      project(fullPath: "<project-path>") {
        id
        vulnerabilities {
          nodes {
            id
            title
            policyAutoDismissed
          }
        }
      }
    }

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #581388

Edited by Martin Cavoj

Merge request reports

Loading