Add model selection setting for SAST vulnerability resolution

Hitesh Raghuvanshirequested to merge
592320-sast-vr-model-selection into master

What does this MR do and why?

Adds independent model selection for the SAST Vulnerability Resolution workflow, decoupling it from the generic duo_agent_platform feature setting.

Previously, the SAST Vulnerability Resolution workflow (resolve_sast_vulnerability/v1) shared its model selection with all other agent platform workflows. Administrators had no way to configure a different model specifically for SAST vulnerability resolution.

Changes

  • Feature enums: Added sast_vulnerability_resolution: 20 to FeaturesConfigurable::FEATURES and FeatureSetting::FLAGGED_FEATURES, making it available in the model selection UI under "Other GitLab Duo features".
  • Feature metadata: Added entry in feature_metadata.yml with title, release state (BETA), and empty unit_primitives (routing is by workflow definition name, not unit primitive lookup).
  • Workflow routing: Updated WorkflowContextGenerationService#ai_feature to return :sast_vulnerability_resolution for the resolve_sast_vulnerability/v1 workflow definition, instead of falling through to :duo_agent_platform.
  • Foundational flow: Set ai_feature: "sast_vulnerability_resolution" explicitly on the SAST Vulnerability Resolution entry.
  • Tests & factories: Added traits, model definitions data, and a spec for the new routing.

This follows the same pattern as the Secret FP detection model selection (!227467 (closed)) and SAST FP detection model selection (!224214 (merged)).

Companion MR

AI Gateway: TBD — adds the corresponding feature_setting to unit_primitives.yml. Must be deployed first.

How to set up and validate locally

  1. Make sure the AI Gateway companion MR is merged or switch to that branch for gitlab-ai-gateway, also make sure langsmith tracing is enabled.
  2. Make sure the env variable FETCH_MODEL_SELECTION_DATA_FROM_LOCAL is set to true.
  3. Visit the model selection page of any of the duo enabled group, Group -> Left side bar -> Settings -> GitLab Duo -> Configure Features
  4. At the bottom, you will see the option for SAST Vulnerability Resolution.
  5. Now, visit the vulnerability page of any project which has SAST vulnerabilities.
  6. Trigger the vulnerability resolution workflow.
  7. In langsmith trace, you can see the selected model got used.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/592320

Merge request reports