Show SAST settings in scan profile details

Miranda Fluhartyrequested to merge
624191-show-sast-settings-in-scan-profile-details-modal into master

What does this MR do and why?

Show SAST settings in scan profile details

Keep SastConfiguration trigger settings as well as
SecretDetectionConfiguration ones in classifyConfigurationVariables, so
the scan profile details modal lists a SAST profile's advanced
configuration. The modal opens from the enable scanners wizard, the
bulk scanners update drawer and the scan profile configuration page.

Filter on a list of analyzer configuration types rather than dropping
the check, so other ScanProfileConfiguration union members such as
auto-remediation still stay out of the table.

Gate behind the custom_scan_profiles_ui feature flag

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/624191

The custom_scan_profiles_ui feature flag only controls the Manage profiles buttons. Those buttons are the only interface that can create or edit profile settings, and the built-in SAST (default) profile has no settings. The securityScanProfileCreate mutation is not behind the flag, so a SAST profile created with settings through the API shows them in the modal even with the flag off. The section is read-only.

References

Screenshots or screen recordings

Before After
SAST profile with excludedAnalyzers = ["bandit"] previewed from the enable scanners wizard, no Advanced configuration section
624191-sast-details-modal-before		 same profile, Advanced configuration now lists excludedAnalyzers as [ "bandit" ]
624191-sast-details-modal-after
secret detection is unchanged custom secret detection profile still lists its settings
624191-secret-detection-details-modal-after

How to set up and validate locally

  1. git checkout 624191-show-sast-settings-in-scan-profile-details-modal
  2. have a GitLab Ultimate licence
  3. create a SAST profile with a setting in a top-level group, using the mutation below in /-/graphql-explorer (no UI can add SAST settings yet)
expand for seed mutation 
mutation {
  securityScanProfileCreate(input: {
    namespaceId: "gid://gitlab/Namespace/<GROUP_ID>"
    scanType: SAST
    name: "SAST with excluded analyzers"
    description: "Skips the bandit analyzer"
    triggers: [
      { triggerType: MERGE_REQUEST_PIPELINE, configuration: { sast: { excludedAnalyzers: ["bandit"] } } }
      { triggerType: DEFAULT_BRANCH_PIPELINE, configuration: { sast: { excludedAnalyzers: ["bandit"] } } }
    ]
  }) {
    errors
    scanProfile { id name }
  }
}
  1. go to that group => Secure => Security configuration and select Enable scanners
  2. select Advanced setup, then Start advanced setup
  3. tick at least one project, then select Select scanners
  4. on the SAST card, tick its checkbox, pick SAST with excluded analyzers under Configuration profile, then select Preview profile
  5. check that the SAST profile modal shows an Advanced configuration section:
    • excludedAnalyzers should show [ "bandit" ]
  6. close the modal. On the Secret detection card, tick its checkbox, pick a custom secret detection profile that has settings, then select Preview profile. The built-in Secret Detection (default) has none
  7. check that its Advanced configuration section still lists that profile's settings

to run tests

yarn jest ee/spec/frontend/security_configuration/components/scan_profiles/utils_spec.js

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #624191 (closed)

Edited by Miranda Fluharty

Merge request reports