Skip to content

Display MR note on standalone vulnerability page

What does this MR do?

When a pipeline is run, there will be a security tab for the pipeline:

ksnip_20200608-214022

Clicking on an item in the list will open a modal that shows details about the security vulnerability. If an issue and/or merge request is created for the vulnerability, notes are shown that link to the issue/MR:

ksnip_20200608-213607

On the standalone vulnerability page, we have the same thing, but the MR note is missing:

Before: MR note is missing After: MR note is shown
Screenshot_from_2020-06-08_23-25-15 Screenshot_from_2020-06-08_23-24-53

How to test locally

  1. Clone the Yarn Remediation repo.
  2. Click on CI/CD -> Pipelines and run a pipeline on the curable branch.
  3. Click on Security & Compliance -> Security Dashboard and click on either of the two vulnerabilities listed.
  4. Click on the "Resolve with merge request" button on the upper right. The page will navigate to the merge request.
  5. Click the back button in the browser. Verify that the merge request note is shown.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Edited by Daniel Tian

Merge request reports