Rename malware detection frontend feature flags

What does this MR do and why?

This renames the frontend feature flag checks for malware detection from maliciousPackageDetection to the two consolidated flags introduced in !249360 (merged):

  • vulnerabilityMalwareDetection gates the malware icon, the malware filter, and the hidden solution and scoring sections on the vulnerability report and vulnerability details pages.
  • dependencyMalwareDetection gates the malware badge, the malware filter token, and the risk popover copy on the project and group dependency lists.

Some extra notes:

  • It also removes the now unused malicious_package_detection flag definition and its push_frontend_feature_flag calls
  • There is no user-facing change. All flags involved are disabled by default, and a flag that is not pushed to the frontend reads as disabled, so the rename does not alter rendering.

References

Screenshots or screen recordings

No visual changes. The affected UI renders identically before and after this change.

How to set up and validate locally

  1. Check out the branch dpisek/rename-malware-frontend-feature-flags, since it already contains the backend changes and the whole feature is verifiable there.
  2. Make sure you have a project containing at least one vulnerability whose identifier starts with GLAM- (like https://gitlab.com/gitlab-org/govern/threat-insights-demos/verification-projects/bala-test-group/malicious-badge-demo). You can use an existing seeded environment, or update one vulnerability's identifier so it starts with GLAM-.
  3. Enable both flags at http://gdk.test:3000/rails/features/vulnerability_malware_detection and http://gdk.test:3000/rails/features/dependency_malware_detection. For the dependency list badge, also enable http://gdk.test:3000/rails/features/dependency_malware_field_project, since the backend needs it to return the malware field that the badge reads.
  4. Navigate to Secure, then Vulnerability report, and confirm that the malware vulnerability's row shows a malware icon, and that the filtered search bar offers a Malware filter.
  5. Open that vulnerability's details page and confirm that the solution section and the scoring rows in the risk panel are hidden, since they do not apply to malware findings.
  6. Navigate to Secure, then Dependency list, and confirm that the affected dependency shows a malware badge, and that the filtered search offers a Malware token. Note that the token only renders at this stage, since server-side filtering for the dependency list ships separately.
  7. As a scoping spot check, enable the flags only for a subgroup actor using the format Group:<id> for a group or subgroup, or Project:<id> for a single project, and confirm that the icon and filters appear on that subgroup's project pages and not on unrelated projects.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Lorenz van Herwaarden

Merge request reports

Loading
Loading