Fix dismissal_reason not being updated in AutoDismissService
What does this MR do and why?
Fix dismissal_reason not being updated in AutoDismissService.
Vulnerabilities::Reads::UpsertService does not perform updates when FF turn_off_vulnerability_read_create_db_trigger_function is disabled: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/vulnerabilities/reads/upsert_service.rb#L35. This is causing an issue where dismissal_reason is not being updated.
The tests assume the FF is enabled by default, so they didn't uncover it.
The fix follows the same pattern as in BulkDismissService.
References
How to set up and validate locally
- Enable the feature flag
auto_dismiss_vulnerability_policies - Create a project
- Create an auto-dismiss policy:
vulnerability_management_policy: - name: Auto-dismiss acceptable secrets description: Auto-dismiss secrets enabled: true actions: - type: auto_dismiss dismissal_reason: not_applicable rules: - type: detected criteria: - type: file_path value: ".env" - Add
.gitlab-ci.ymlwith secret detectioninclude: - template: Jobs/Secret-Detection.latest.gitlab-ci.yml - Add two secrets in the
mainbranch:-
.env:AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ
-
- Wait until the pipeline on
mainfinishes - Use GraphQL explorer to query the
dismissalReasonflag for the vulnerabilities and verify thatdismissalReasonisNOT_APPLICABLE:{ project( fullPath: "<project-path>" ) { vulnerabilities { nodes { title dismissalReason policyAutoDismissed } } } }
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #581377
Edited by Martin Cavoj