Stop the SAST vulnerability resolution flow opening empty merge requests

Bryan Valdiviezorequested to merge
duo/fix/629525-pin-sast-flow-1-0-3 into master

What does this MR do and why?

Point the resolve_sast_vulnerability foundational flow at flow version 1.0.3.

The flow runs in a sandbox that mounts its own dotfiles (.bashrc, .gitconfig, .claude/ and others) into the checkout. They are untracked, cannot be removed, and cannot be staged, so git add . exited 128 and the commit exited 1 with the fix left unstaged. Both were recorded as successes, because a non-zero shell exit comes back as ordinary text rather than raising, so the flow carried on and opened a merge request asserting a fix it had not committed.

1.0.3 adds a step that hides those files from git before the fix runs, and gates it so a failure stops the flow rather than reaching git add.

References

Flow config: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7164 (merged)

Screenshots or screen recordings

How to set up and validate locally

  1. Check out ai-assist main so flow version 1.0.3 is present, and restart duo-workflow-service.
  2. In a project under a group with Duo Agent Platform enabled, add a file with a SAST finding and a gl-sast-report.json published as a SAST artifact, then run the pipeline.
  3. Open the vulnerability and select "Resolve with Duo".
  4. The resulting merge request should contain the fix. On 1.0.2 it contains nothing.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #629525

Merge request reports