Migrate vulnerability state management to GraphQL
What does this MR do?
This change is regarding migrating REST endpoints to GraphQL in Vulnerability Management.
In order to access the vulnerability page:
- You'll need EE license
- You'll need to have a project with security scanners enabled and run the pipeline at least once.
- If there are any vulnerabilities found, you can see them through Project > Security & Compliance > Vulnerability Report
- Clicking on a vulnerability title will bring you the Vulnerability Detail page, where the changes of this MR happens.
We currently have 4 states:
- Dismissed
- Confirmed
- Resolved
- Detected
By default, a vulnerability is in Detected state but you can change the state in the Vulnerability Details page. Reverting a vulnerability will bring its state back to Detected.
In GraphQL we have one mutation foreach state. Therefore, I had to create 3 mutations (as one of them already pre-existed). The following files in this MR represents these changes:
Then, the core changes of this MR happens in this file: ee/app/assets/javascripts/vulnerabilities/components/header.vue. Rest of the MR is just adopting to these changes.
Screenshots (strongly suggested)
| before | after |
|---|---|
 |
 |
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Related to #228740 (closed)