Draft: Extend FindingEntity with matches_auto_dismiss_policy

What does this MR do and why?

Extend FindingEntity with matches_auto_dismiss_policy.

To display a badge for findings in the MR security widget that will be automatically dismissed by a auto-dismiss policy, we need to include a new attribute in the FindingEntity.

  • Add PolicyAutoDismissalChecker
  • Add preload_auto_dismissal_checks which checks batches of findings
  • Call preload_auto_dismissal_checks from get_report to prevent N+1
  • Add a file method on the Security::Finding to match the signature of Vulnerabilities::Finding

References

  • Frontend changes added in a follow-up: !216179

Screenshots or screen recordings

With FE changes from a follow-up MR:

Before After
CleanShot_2025-12-11_at_09.46.04_2x CleanShot_2025-12-11_at_10.03.10_2x

How to set up and validate locally

  1. Enable the feature flag auto_dismiss_vulnerability_policies
  2. Create a project
  3. Create an auto-dismiss policy:
    vulnerability_management_policy:
    - name: Auto-dismiss acceptable secrets
      description: Auto-dismiss secrets
      enabled: true
      actions:
      - type: auto_dismiss
        dismissal_reason: not_applicable
      rules:
      - type: detected
        criteria:
        - type: file_path
          value: ".env"
  4. Add .gitlab-ci.yml with secret detection
    include:
    - template: Jobs/Secret-Detection.latest.gitlab-ci.yml    
  5. Add two secrets in a new MR:
    1. .env:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ
    2. .env2:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGA
  6. Wait for the pipeline to finish
  7. Inspect the network requests and open the response for merge_requests/:id/security_reports. Verify that the added findings have the attribute matches_auto_dismiss_policy correctly set.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #581394

Edited by Martin Cavoj

Merge request reports

Loading