Skip to content

Add 'compliance pipeline configuration location' to compliance frameworks form

What does this MR do?

This MR adds a new field to the compliance frameworks forms. The new field accepts a project YAML file as an input and will be used to compile custom compliance pipelines.

On input it validates first to make sure that the input is in a valid format and then checks to see if the file exists using the getRawFile REST API endpoint.

If both pass then it enables the submit button and can be sent to the backend via the GraphQL API.

Screenshots (strongly suggested)

Video whereby I:

  1. Try entering random text - Invalid format error
  2. Try entering a bad format - Invalid format error
  3. Try entering a non-existant file - Unknown file error
  4. Enter a valid file - No error
  5. Clear the input - No error

Screen_Recording_2021-02-10_at_16.53.41

Video whereby I:

  1. Show the input in the form
  2. Show the form is submittable when the input is empty
  3. Show the disabling of the submit button while the input is invalid or is being checked for validity
  4. Show the form submitting when the form is valid

Screen_Recording_2021-02-10_at_17.01.53

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

This form is not on any pages just yet. However, you can add it to a page by:

  1. Enable the :ff_custom_compliance_frameworks feature flag
  2. Copy this patch to add it to the compliance frameworks listing
  3. Visit [GDK_HOST]/groups/gitlab-org/-/edit#js-compliance-frameworks-settings - this will show the create form
  4. If you create a compliance framework you can then add framework_id: 1 to the returned data hash in the compliance_frameworks_form_data helper created by the above patch: ee/app/helpers/compliance_management/compliance_framework/group_settings_helper.rb:19
  5. Refreshing the page will then show you the edit form for the framework you just created

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Related to #292696 (closed)

Edited by Robert Hunt

Merge request reports