Remove security_policies_malware_attribute feature flag

Bala Kumarrequested to merge
remove-ff-security-policies-malware-attribute into master

What

Remove the security_policies_malware_attribute feature flag from the codebase. This flag previously gated the scanner-level is_malicious attribute on merge request approval policy scan-result rules, enabling malware blocking in security policies.

Why

The flag has been running enabled-by-default in production since its Beta release, and Malicious Packages is now moving from Beta to GA. With the flag in its active state across all deployments, the feature flag definition and disabled code paths are no longer needed. The is_malicious attribute becomes a permanently available feature.

Backend changes

  • Delete the security_policies_malware_attribute flag definition from the feature flags YAML
  • Remove push_frontend_feature_flag(:security_policies_malware_attribute, ...) calls from both Projects::Security::PoliciesController and Groups::Security::PoliciesController
  • Update Security::ScanResultPolicies::GroupedFindingsEvaluator#malicious_path? to unconditionally honor the malicious attribute, removing the Feature.enabled? check
  • Remove flag-disabled test contexts from the evaluator spec

Frontend changes

Remove flag checks from seven components under ee/app/assets/javascripts/security_orchestration/. All references to glFeatures.securityPoliciesMalwareAttribute and window.gon.features.securityPoliciesMalwareAttribute are deleted so the feature is always enabled:

  • Malware settings control on dependency and container scanning rule editors
  • "New: Malware blocking" badge on the policy type selector
  • Malware rollout banner in the policies app
  • Malware blocking alert in the scan-result policy drawer
  • Malware gap indicator in the policy list

Update buildDefaultScannerObject in the scan-result rules library to always set is_malicious: true for malware-eligible scanner types.

Update eight corresponding Jest specs to remove flag-off test cases.

A note for reviewers

This change is authored from the Composition Analysis/Malicious Packages area but touches group::security policies frontend components. Please coordinate frontend review with that team.

Two UI affordances are now bound to constants preserving today's behaviour: the policy type selector badge (badge: true) and the policies-app rollout banner (:show-malware-rollout-banner="true"). If the "New" badge and Beta rollout banner should be retired rather than shown permanently at GA, that is a separate follow-up UX change.

Testing

The backend evaluator spec passes locally. Frontend Jest specs and ESLint could not run in the local environment due to an out-of-sync Node/Yarn installation. The frontend changes should be verified by CI.

Related

Merge request reports