### Proposal As discussed [here](https://gitlab.com/groups/gitlab-org/-/epics/9532#note_1685253907), in order to err on the side of caution, we should add a feature flag to toggle Continuous Vulnerability Scans for Container Scanning. ### Possible solutions Choose one of the following solutions: 1. Update [Gitlab::VulnerabilityScanning::ContainerScanning::AffectedVersionRangeMatcher#affected?](https://gitlab.com/gitlab-org/gitlab/blob/ca0c0dafe851/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb#L17-24) to return `false` unless the feature flag is enabled: ```diff diff --git a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb index 69a239f92328..f1cb63bd6d52 100644 --- a/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb +++ b/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb @@ -15,6 +15,8 @@ def initialize(purl_type:, range:, version:, distro:, source:) end def affected? + return false unless Feature.enabled?(:container_scanning_continuous_vulnerability_scans) + return false unless distro_matches? # a wildcard range means that all versions are affected ``` However, since the `Gitlab::VulnerabilityScanning::ContainerScanning::AffectedVersionRangeMatcher` class doesn't have access to the `project`, we can't toggle this feature flag on a per-project basis, which doesn't work for us. 1. Update [Security::VulnerabilityScanning::CreateVulnerabilityService#finding_maps](https://gitlab.com/gitlab-org/gitlab/blob/ca0c0dafe851/ee/app/services/security/vulnerability_scanning/create_vulnerability_service.rb#L79-79) to skip projects where the feature flag is disabled: ```diff diff --git a/ee/app/services/security/vulnerability_scanning/create_vulnerability_service.rb b/ee/app/services/security/vulnerability_scanning/create_vulnerability_service.rb index bb8b86abbf77..97d25fcbc6de 100644 --- a/ee/app/services/security/vulnerability_scanning/create_vulnerability_service.rb +++ b/ee/app/services/security/vulnerability_scanning/create_vulnerability_service.rb @@ -76,6 +76,8 @@ def finding_maps finding = finding_for_affected_component(affected_component) next if finding.nil? + next unless Feature.enabled?(:container_scanning_continuous_vulnerability_scans, affected_component.project) + track_upsert_for_project_id(affected_component.project.id) scanner_id = scanner_for_project(affected_component.project).id ``` Pros & cons: It's granular and allows an incremental rollout but at the cost of extra checks. See https://gitlab.com/gitlab-org/gitlab/-/issues/435435#note_1698421704 1. Add the toggle to [Sbom::PossiblyAffectedOccurrencesFinder#execute_in_batches](https://gitlab.com/gitlab-org/gitlab/-/blob/5758f93e0d4031caf6a51c3f2714422ae26ca50b/ee/app/finders/sbom/possibly_affected_occurrences_finder.rb#L18), similar to how this was done in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131454+s, however, we can't use a named scope because the `Feature.enabled?` method needs to be executed against each project. 1. [Publish an advisory](https://gitlab.com/gitlab-org/gitlab/-/blob/bc4b85bc771a0062379d47364db5acf767031971/ee/app/services/package_metadata/ingestion/advisory/ingestion_service.rb#L37) if the flag corresponding to the advisory source is enabled. See https://gitlab.com/gitlab-org/gitlab/-/issues/435435#note_1698421704 * Advisory source is Trivy DB and `container_scanning_continuous_vulnerability_scans` is enabled. * Advisory source is GLAD and `dependency_scanning_on_advisory_ingestion` is enabled. ### Implementation Plan The plan is based on the proposal N1. 1. Create a new feature flag `container_scanning_continuous_vulnerability_scans` of [beta](https://docs.gitlab.com/ee/development/feature_flags/#beta-type) type. 2. In [Gitlab::VulnerabilityScanning::ContainerScanning::AffectedVersionRangeMatcher#affected?](https://gitlab.com/gitlab-org/gitlab/blob/ca0c0dafe851/ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb#L18) add a check for this flag: ```ruby def affected? return false if Feature.disabled?(:container_scanning_continuous_vulnerability_scans) return false unless distro_matches? # a wildcard range means that all versions are affected return true if range == '*' SemverDialects::VersionChecker.version_sat?(purl_type, version, range) end ``` 3. Add tests for `Gitlab::VulnerabilityScanning::ContainerScanning::AffectedVersionRangeMatcher#affected?` to test this behaviour. /cc @thiagocsf @fcatteau @johncrowley