Draft: Extend FindingEntity with matches_auto_dismiss_policy
What does this MR do and why?
Extend FindingEntity with matches_auto_dismiss_policy.
To display a badge for findings in the MR security widget that will be
automatically dismissed by a auto-dismiss policy, we need to include
a new attribute in the FindingEntity.
- Add
PolicyAutoDismissalChecker - Add
preload_auto_dismissal_checkswhich checks batches of findings - Call
preload_auto_dismissal_checksfromget_reportto prevent N+1 - Add a
filemethod on theSecurity::Findingto match the signature ofVulnerabilities::Finding
References
- Frontend changes added in a follow-up: !216179
Screenshots or screen recordings
With FE changes from a follow-up MR:
| Before | After |
|---|---|
|
|
How to set up and validate locally
- Enable the feature flag
auto_dismiss_vulnerability_policies - Create a project
- Create an auto-dismiss policy:
vulnerability_management_policy: - name: Auto-dismiss acceptable secrets description: Auto-dismiss secrets enabled: true actions: - type: auto_dismiss dismissal_reason: not_applicable rules: - type: detected criteria: - type: file_path value: ".env" - Add
.gitlab-ci.ymlwith secret detectioninclude: - template: Jobs/Secret-Detection.latest.gitlab-ci.yml - Add two secrets in a new MR:
-
.env:AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ -
.env2:AWS_TOKEN=AKIAZYONPI3G4JNCCWGA
-
- Wait for the pipeline to finish
- Inspect the network requests and open the response for
merge_requests/:id/security_reports. Verify that theaddedfindings have the attributematches_auto_dismiss_policycorrectly set.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #581394
Edited by Martin Cavoj

