Added model selection setting for SAST FP detection

Hitesh Raghuvanshirequested to merge
589687-sast-fp-model-selection into master

What does this MR do and why?

Adds independent model selection for the SAST False Positive Detection workflow, decoupling it from the generic duo_agent_platform feature setting.

Previously, the SAST FP detection workflow shared its model with all other agent platform workflows. Administrators had no way to configure a different model specifically for SAST false positive analysis.

Changes

  • Feature enums: Added sast_fp_detection: 18 to FeaturesConfigurable::FEATURES and FeatureSetting::FLAGGED_FEATURES, making it available in the model selection UI under "Other GitLab Duo features".
  • Feature metadata: Added entry in feature_metadata.yml with title, release state (BETA), and empty unit_primitives (routing is by workflow definition name, not unit primitive lookup).
  • Workflow routing: Updated WorkflowContextGenerationService#ai_feature to return :sast_fp_detection for the sast_fp_detection/v1 workflow definition, instead of falling through to :duo_agent_platform.
  • Foundational flow: Set ai_feature: "sast_fp_detection" explicitly on the SAST FP Detection entry.
  • Tests & factories: Added traits, model definitions data, and a spec for the new routing.

Companion MR

AI Gateway: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!4648 (merged) — adds the corresponding feature_setting to unit_primitives.yml. Must be deployed first.

Screenshots or screen recordings

image

How to set up and validate locally

  1. Make sure gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!4648 (merged) is merged or switch to that branch for gitlab-ai-gateway, also make sure langsmith tracing is enabled.
  2. Make sure the env variable FETCH_MODEL_SELECTION_DATA_FROM_LOCAL is set to true.
  3. Visit the model selection page of any of the duo enabled group, Group -> Left side bar -> Settings -> GitLab Duo -> Configure Features
  4. At the bottom, you will see the option for SAST vulnerability FP detection: image
  5. Now, visit the vulnerability page of any project which has SAST vulnerabilities, you can use https://gitlab.com/compliance-group-testing-and-demos/team-testing-subgroup/hraghuvanshi/sast-fp-demo project as well.
  6. Go to a vulnerability and click on "Check for false positive" button image
  7. In langsmith trace, you can the selected model got used.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #589687

Edited by Hitesh Raghuvanshi

Merge request reports