Added model selection setting for Secret FP detection

Hitesh Raghuvanshirequested to merge
592321-secret-fp-model-selection into master

What does this MR do and why?

Adds independent model selection for the Secret Detection False Positive Detection workflow, decoupling it from the generic duo_agent_platform feature setting.

Previously, the Secret Detection FP workflow (secrets_fp_detection/v1) shared its model selection with all other agent platform workflows. Administrators had no way to configure a different model specifically for Secret Detection false positive analysis.

Changes

  • Feature enums: Added secret_vulnerability_fp_detection: 19 to FeaturesConfigurable::FEATURES and FeatureSetting::FLAGGED_FEATURES, making it available in the model selection UI under "Other GitLab Duo features".
  • Feature metadata: Added entry in feature_metadata.yml with title, release state (BETA), and empty unit_primitives (routing is by workflow definition name, not unit primitive lookup).
  • Workflow routing: Updated WorkflowContextGenerationService#ai_feature to return :secret_vulnerability_fp_detection for the secrets_fp_detection/v1 workflow definition, instead of falling through to :duo_agent_platform.
  • Foundational flow: Set ai_feature: "secret_vulnerability_fp_detection" explicitly on the Secret Detection FP entry.
  • Tests & factories: Added traits, model definitions data, and a spec for the new routing.

This follows the same pattern as the SAST FP detection model selection (!224214 (merged)).

Companion MR

AI Gateway: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!4896 (closed) — adds the corresponding feature_setting to unit_primitives.yml. Must be deployed first.

How to set up and validate locally

  1. Make sure gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!4896 (closed) is merged or switch to that branch for gitlab-ai-gateway, also make sure langsmith tracing is enabled.
  2. Make sure the env variable FETCH_MODEL_SELECTION_DATA_FROM_LOCAL is set to true.
  3. Visit the model selection page of any of the duo enabled group, Group -> Left side bar -> Settings -> GitLab Duo -> Configure Features
  4. At the bottom, you will see the option for Secret vulnerability FP detection.
  5. Now, visit the vulnerability page of any project which has Secret Detection vulnerabilities.
  6. Go to a vulnerability and click on "Check for false positive" button.
  7. In langsmith trace, you can see the selected model got used.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/592321

Merge request reports