Skip to content

Extend EE::Types::Ci::PipelineType with dast_profile

What does this MR do and why?

This Merge request adds the backend support to display the dast profile information of the dast on-demand scans.

This merge request implements the following tasks of the issue 338645

extend theEE::Types::Ci::PipelineType with dast_profile

  • add lookahead (dast_profile: [:dast_site_profile) to EE::Resolvers::ProjectPipelinesResolver
  • add test that there are no n + 1 queries

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Start up a rails console using the command
rails c 
  1. Enable the Feature Flag
Feature.enable(:dast_view_scans)
  1. Check if your GDK instance has a license.
This feature requires an [EE license key](https://about.gitlab.com/handbook/developer-onboarding/#working-on-gitlab-ee) activated on your instance.
  1. Add the test data
project = Project.last
dast_site = DastSite.create(project: project, url: 'https://gitlab.com')
dast_site_profile = DastSiteProfile.create(name: 'Dast Site Profile', project: project, dast_site: dast_site)
dast_scanner_profile = DastScannerProfile.create(project: project, name: 'dast scanner profile')
dast_profile = Dast::Profile.create(description:'dast profile description', name: 'Test profile', project: project, dast_site_profile: dast_site_profile, dast_scanner_profile: dast_scanner_profile)

pipeline = Ci::Pipeline.create(project: project, dast_profile: dast_profile, sha: 'sha-test', ref: 'ref', source: 'web', iid: 1999)
  1. Go to /-/graphql-explorer and run some queries. Make sure you are logged with a user that has access to the project you are using.
{
  project(fullPath: "gitlab-instance-0c0627c9/Monitoring") {
    pipeline(sha: "sha-test") {
      iid
      dastProfile {
        dastSiteProfile {
          profileName
        }
        dastScannerProfile {
          scanType
        }
        dastProfileSchedule {
          nextRunAt
        }
      }
    }
  }
}

The query should return something like this:

Screen_Shot_2021-09-17_at_11.45.14_AM

MR acceptance checklist

These checklists encourage us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Quality

  • Confirmed
  1. I have self-reviewed this MR per code review guidelines.
  2. For the code that that this change impacts, I believe that the automated tests (Testing Guide) validate functionality that is highly important to users (including consideration of all test levels). If the existing automated tests do not cover this functionality, I have added the necessary additional tests or I have added an issue to describe the automation testing gap and linked it to this MR.
  3. I have considered the technical aspects of the impact of this change on both gitlab.com hosted customers and self-hosted customers.
  4. I have considered the impact of this change on the front-end, back-end, and database portions of the system where appropriate and applied frontend, backend and database labels accordingly.
  5. I have tested this MR in all supported browsers, or determiend that this testing is not needed.
  6. I have confirmed that this change is backwards compatible across updates, or I have decided that this does not apply.
  7. I have properly separated EE content from FOSS, or this MR is FOSS only. (Where should EE code go?)
  8. If I am introducing a new expectation for existing data, I have confirmed that existing data meets this expectation or I have made this expectation optional rather than required.

Performance, reliability and availability

  • Confirmed
  1. I am confident that this MR does not harm performance, or I have asked a reviewer to help assess the performance impact. (Merge request performance guidelines)
  2. I have added information for database reviewers in the MR description, or I have decided that it is unnecessary. (Does this MR have database-related changes?)
  3. I have considered the availability and reliability risks of this change. I have also considered the scalability risk based on future predicted growth
  4. I have considered the performance, reliability and availability impacts of this change on large customers who may have significantly more data than the average customer.

Documentation

  • Confirmed
  1. I have included changelog trailers, or I have decided that they are not needed. (Does this MR need a changelog?)
  2. I have added/updated documentation, or I have decided that documentation changes are not needed for this MR. (Is documentation required?)

Security

  • Confirmed
  1. I have confirmed that if this MR contains changes to processing or storing of credentials or tokens, authorization, and authentication methods, or other items described in the security review guidelines, I have added the label security and I have @-mentioned @gitlab-com/gl-security/appsec.

Deployment

  • Confirmed
  1. I have considered using a feature flag for this change because the change may be high risk. If I decided to use a feature flag, I plan to test the change in staging before I test it in production, and I have considered rolling it out to a subset of production customers before doing rolling it out to all customers. When to use a feature flag
  2. I have informed the Infrastructure department of a default setting or new setting change per definition of done, or decided that this is not needed.
Edited by Marcos Rocha

Merge request reports