Draft: Add security policy dismissals to group-level dependency list

Andy Schoenenrequested to merge
duo-edit-20260113-200826 into master

What does this MR do and why?

Include security policy dismissal information in the group-level dependency list JSON response, ensuring consistency with the project-level dependency list UI.

Background

The project-level dependency list displays security policy dismissals in both the license and vulnerabilities columns. However, the group-level dependency list (which uses the controller's .json format) was missing this policy dismissal information.

This MR adds the same policy dismissal data to the group-level dependency list, allowing users to see which dependencies have been bypassed via security policies.

Changes

Controller (ee/app/controllers/groups/dependencies_controller.rb):

  • Added before_action hooks to collect dependencies and load dismissals
  • Query dismissals across all projects in the group hierarchy using group.all_projects
  • Check read_security_resource permission at the group level

Serializer (ee/app/serializers/dependency_entity.rb):

  • Added policy_dismissals exposure using Security::PolicyDismissalEntity
  • Added can_read_security_resource? helper method

Serializer (ee/app/serializers/dependency_list_serializer.rb):

  • Pass dismissals_by_uuid through to the entity

Limitations

At the group level, when using AggregationsFinder, each record may represent aggregated data from multiple occurrences across projects. Policy dismissals are matched against the UUIDs from the aggregated results, which means some dismissals may not be shown if they apply to occurrences not represented in the aggregated results. A comment has been added to document this limitation.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist.

How to set up and validate locally

  1. Enable the feature flag:

    Feature.enable(:security_policy_warn_mode_license_scanning)

  2. Create a group with a project that has SBOM occurrences

  3. Create a security policy with a license finding rule

  4. Bypass the policy on a merge request

  5. After the MR is merged, verify the dependency list shows the policy dismissal:

    GET /groups/:group_id/-/dependencies.json

The response should include policy_dismissals for dependencies that have been bypassed.

Related Issues

Closes #581242 (closed)

Merge request reports