Loading
Add Dependency Scanning to scan profile advanced configuration
What does this MR do and why?
Add Dependency Scanning scan profile variables
Add DEPENDENCY_SCANNING_VARIABLE_DEFINITIONS to variable_definitions.js
and register it in VARIABLE_DEFINITIONS_BY_SCAN_TYPE. Each entry mirrors
a field of SecurityScanProfileDependencyScanningConfigurationInput and
takes its envVar from the dependency_scanning block of CiVariables.
Edit the Int fields as text and disabledResolutionJobs as a string
list, so the existing value editors cover every field.
Give every text field an example placeholder, as the SAST fields have.
Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/634032References
- backend MR that pushes the feature flag: Push Dependency Scanning scan profile flag (!262538 - merged)
Screenshots or screen recordings
| Before (or feature flag disabled) | After (feature flag enabled) |
|---|---|
no Manage profiles for Dependency Scanning ![]() |
Manage profiles opens advanced configuration for Dependency Scanning profiles |
How to set up and validate locally
-
git checkout 634032-manage-dependency-scanning-in-scan-profile-advanced-configuration - have a GitLab Ultimate licence
- enable the
custom_scan_profiles_dependency_scanning_uifeature flag (in caproni or gdk) - go to a group =>
Secure=>Security configuration - check that Dependency Scanning has a
Manage profilesbutton - create a Dependency Scanning profile, and add a few variables of each kind:
- a text field, such as
Max depth - a list, such as
Disabled resolution jobs - a yes/no field and a dropdown, such as the log level
- a text field, such as
- save, reopen the profile, and check that every value comes back as entered
- clear
Max depthwith the keyboard and save:- the save should succeed
Max depthshould be gone when you reopen the profile
- disable the feature flag and check that the Dependency Scanning
Manage profilesbutton is gone
to run tests
yarn jest ee/spec/frontend/security_configuration/components/scan_profiles/ ee/spec/frontend/security_configuration/graphql/scan_profiles/MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #634032
Edited by Miranda Fluharty
