Remove bulk_vulnerabilities_duo_workflow_api feature flag and make bulk AI flows GA

AJ Bitonrequested to merge
636076-cleanup-bulk-vulnerabilities-duo-workflow-api-ff into master

What does this MR do and why?

Removes the bulk_vulnerabilities_duo_workflow_api feature flag. The flag has been enabled by default since GitLab 19.4 (!253325 (merged)), so the bulk Duo vulnerabilities workflow API, the bulk Create an MR with Vulnerability Resolution and Run SAST False Positive Detection actions, and their progress bars in the Vulnerability Report become always available, and the bulk flows move from beta to generally available in GitLab 19.6.

  • Backend: drop the flag check from Vulnerabilities::BulkDuoWorkflow::BaseService#authorized?, Vulnerabilities::WorkflowTrackable#execution_from_args, and Resolvers::Vulnerabilities::VulnerabilityWorkflowExecutionResolver, and stop pushing the flag from Projects::Security::VulnerabilityReportController.
  • Frontend: drop glFeatures.bulkVulnerabilitiesDuoWorkflowApi from selection_summary.vue and vulnerability_list.vue. Other gates (project dashboard, Duo Agent Platform availability, agenticSastVrUi, project FP-detection setting) are unchanged.
  • Specs: remove the flag-disabled contexts. In vulnerability_list_spec.js, the SAST VR badge tests now stub VulnerabilityWorkflowProgress, which used to stay hidden behind the flag.
  • Docs: add a Generally available in GitLab 19.6. Feature flag … removed. history entry to the three affected pages. Remove the section-level Status: Beta details blocks from Resolve multiple vulnerabilities and Analyze multiple vulnerabilities, whose Offering line duplicated the page-level details. Remove the [!flag] note from the Vulnerability Report page.
  • GraphQL: remove experiment: { milestone: '19.3' } from the Project.vulnerabilityWorkflowExecution field and the startVulnerabilityWorkflow / cancelVulnerabilityWorkflow mutations, which makes the API behind the bulk flows public. The GraphQL reference and introspection schemas are regenerated with rake gitlab:graphql:update_all.
  • Delete ee/config/feature_flags/beta/bulk_vulnerabilities_duo_workflow_api.yml.

References

Screenshots or screen recordings

No UI change for users on default settings (the flag is already on everywhere by default).

How to set up and validate locally

  1. As a Developer+ on an Ultimate project with Duo Agent Platform and SAST vulnerabilities, open Secure > Vulnerability report.
  2. Select SAST vulnerabilities. The bulk Create an MR with Vulnerability Resolution / Run SAST False Positive Detection actions are offered without any flag being set.

Local verification:

  • ee/spec/frontend/security_dashboard/components/shared/vulnerability_report/: 24 suites, 1298 tests pass.
  • ESLint is clean. Ruby files pass ruby -c. RSpec is left to CI.
  • Pre-commit rubocop and mermaidlint were skipped locally because of environment issues (the Gitlab/EeFeatureFlagInFoss cop misfires on untouched lines when run from a git worktree path, and the local mermaid-v12 package is missing). The changed docs contain no Mermaid. CI runs both.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code

Edited by AJ Biton

Merge request reports