Fix dismissal_reason not being updated in AutoDismissService

What does this MR do and why?

Fix dismissal_reason not being updated in AutoDismissService.

Vulnerabilities::Reads::UpsertService does not perform updates when FF turn_off_vulnerability_read_create_db_trigger_function is disabled: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/vulnerabilities/reads/upsert_service.rb#L35. This is causing an issue where dismissal_reason is not being updated.

The tests assume the FF is enabled by default, so they didn't uncover it.

The fix follows the same pattern as in BulkDismissService.

References

How to set up and validate locally

  1. Enable the feature flag auto_dismiss_vulnerability_policies
  2. Create a project
  3. Create an auto-dismiss policy:
    vulnerability_management_policy:
    - name: Auto-dismiss acceptable secrets
      description: Auto-dismiss secrets
      enabled: true
      actions:
      - type: auto_dismiss
        dismissal_reason: not_applicable
      rules:
      - type: detected
        criteria:
        - type: file_path
          value: ".env"
  4. Add .gitlab-ci.yml with secret detection
    include:
    - template: Jobs/Secret-Detection.latest.gitlab-ci.yml    
  5. Add two secrets in the main branch:
    1. .env:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ
  6. Wait until the pipeline on main finishes
  7. Use GraphQL explorer to query the dismissalReason flag for the vulnerabilities and verify that dismissalReason is NOT_APPLICABLE:
    {
      project(
        fullPath: "<project-path>"
      ) {
        vulnerabilities {
          nodes {
            title
            dismissalReason
            policyAutoDismissed
          }
        }
      }
    }

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #581377

Edited by Martin Cavoj

Merge request reports

Loading