Show advanced configuration section in scan profile modal

What does this MR do and why?

Show advanced configuration section in scan profile modal

Add advanced configuration sections to the scan profile details modal:
- Settings that apply across the profile appear in the bottom table

Configuration is stored per trigger, so classifyConfigurationVariables
infers the profile-level view. A setting belongs to the profile when
every enabled configurable trigger holds the same value.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/624190

References

• issue: #624190 (closed)
• granularity discussion: #627554 (closed)
• epic: &20198
• write-direction counterpart: !253807 (merged)
• option one: !252986 (closed)
• option two: !253278 (closed)
• option three: !253279 (closed)

Screenshots or screen recordings

expand for older screen recordings

How to set up and validate locally

0. git checkout 624190-show-profile-and-per-trigger-scan-variables
   echo "Feature.enable(:configurable_security_scan_profiles)" | gdk rails c

1. have a GitLab Ultimate licence

2. go to a group => Secure => Security configuration => Scanners

3. select Enable scanners, then for Secret detection select Preview profile to open the details modal

4. check that the Advanced configuration section appears at the bottom of the modal:

   • the section contains a table
   • the table has one expandable row per variable that has been set for any trigger
   • if the value is the same for every enabled trigger, the value is displayed in the value column
   • if the value differs by trigger, Differs by trigger is displayed in the value column
   • the row is expandable to show the value for each trigger, regardless of whether the value differs by trigger

5. there is no user interface yet for setting different values per trigger, so set up a profile with variable values that differ by trigger by calling the securityScanProfileCreate mutation directly:

expand for mutations

mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/24"
      scanType: SECRET_DETECTION
      name: "All settings at profile level"
      description: "Every setting shared across both configurable triggers"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              historicScan: true
              logOptions: "--all"
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              rulesetGitReference: "refs/tags/v1.2.0"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              historicScan: true
              logOptions: "--all"
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              rulesetGitReference: "refs/tags/v1.2.0"
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
      triggerSettings {
        triggerType
        configuration {
          ... on SecretDetectionConfiguration {
            secureAnalyzersPrefix
            imageSuffix
            historicScan
            logOptions
            excludedPaths
            rulesetGitReference
          }
        }
      }
    }
    errors
  }
}

mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/24"
      scanType: SECRET_DETECTION
      name: "Mixed profile and trigger settings"
      description: "Three settings shared across triggers, two that differ"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              historicScan: false
              logOptions: "--all"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              secureAnalyzersPrefix: "registry.example.com/security-products"
              imageSuffix: FIPS
              excludedPaths: ["spec/fixtures/**", "tmp/**"]
              historicScan: true
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
      gitlabRecommended
      triggerSettings {
        triggerType
        configuration {
          ... on SecretDetectionConfiguration {
            secureAnalyzersPrefix
            imageSuffix
            excludedPaths
            historicScan
            logOptions
            rulesetGitReference
          }
        }
      }
    }
    errors
  }
}

mutation {
  securityScanProfileCreate(
    input: {
      namespaceId: "gid://gitlab/Group/<root_group_id>"
      scanType: SECRET_DETECTION
      name: "XSS test <img src=x onerror=alert('profile-name')>"
      description: "\"><script>alert('description')</script> and a [markdown link](javascript:alert('md'))\nsecond line"
      stripDefaults: false
      triggers: [
        {
          triggerType: MERGE_REQUEST_PIPELINE
          configuration: {
            secretDetection: {
              historicScan: true
              imageSuffix: FIPS
              secureAnalyzersPrefix: "<img src=x onerror=alert('secureAnalyzersPrefix')>"
              excludedPaths: [
                "<script>alert('excludedPaths')</script>"
                "\"><img src=x onerror=alert('attr-breakout')>"
                "{{ constructor.constructor('alert(1)')() }}"
                "\\u003cimg src=x onerror=alert('double-decode')\\u003e"
                "<a href=\"javascript:alert('href')\">spec/**</a>"
              ]
              logOptions: "--all <svg onload=alert('logOptions-merge-request')>"
              rulesetGitReference: "javascript:alert('rulesetGitReference')"
            }
          }
        }
        {
          triggerType: DEFAULT_BRANCH_PIPELINE
          configuration: {
            secretDetection: {
              historicScan: true
              imageSuffix: FIPS
              secureAnalyzersPrefix: "<img src=x onerror=alert('secureAnalyzersPrefix')>"
              excludedPaths: [
                "<script>alert('excludedPaths')</script>"
                "\"><img src=x onerror=alert('attr-breakout')>"
                "{{ constructor.constructor('alert(1)')() }}"
                "\\u003cimg src=x onerror=alert('double-decode')\\u003e"
                "<a href=\"javascript:alert('href')\">spec/**</a>"
              ]
              logOptions: "--since=2020-01-01 <iframe srcdoc=\"<script>alert(1)</script>\"></iframe>"
              rulesetGitReference: "<style>body{display:none}</style>refs/tags/v1"
            }
          }
        }
        { triggerType: GIT_PUSH_EVENT }
      ]
    }
  ) {
    scanProfile {
      id
      name
    }
    errors
  }
}

6. expand the trigger card => next MR
7. open a profile with no variable values set for any trigger and check that:
   • no Advanced configuration section appears at the bottom of the modal

to run tests

yarn jest ee/spec/frontend/security_configuration/components/scan_profiles