<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=611434) </details> <!--IssueSummary end--> ## Summary Roll out [malware detection on the dependency list](https://gitlab.com/gitlab-org/gitlab/-/work_items/587758), currently behind the `dependency_malware_detection` feature flag introduced in !249360. - DRI: @dpisek - Team Slack channel: `#<slack-channel-of-dri-team>` This flag gates the dependency list frontend: | Surface | What it gates | |---|---| | Project and group dependency list | Malware badge in the Risk column | | Project and group dependency list | Malware filter token | | Project and group dependency list | Risk column popover copy that mentions malware packages | It replaces half of `malicious_package_detection`, which !249360 splits into `vulnerability_malware_detection` (rollout: #597347) and this flag, so that the vulnerability report can be rolled out without also turning on dependency list UI. ## Feature flag | Flag | Type | Actor | Default | |---|---|---|---| | `dependency_malware_detection` | beta | root namespace | disabled | ## What could go wrong? The dependency list backend is not finished, so enabling this flag on its own does not produce a working feature: - The `malware` field on dependencies was previously gated separately by `dependency_malware_field_project` (#600274); !251948 merged that flag into this one, so the field is now gated directly by `dependency_malware_detection`. The badge renders once this flag is on, so that half of the problem is resolved. - The `malware` filter argument is still gated separately, by `malicious_packages_dependency_list_filtering` (rollout: #600025), and `Sbom::DependenciesFinder` does not apply it yet. `Resolvers::Sbom::DependencyInterfaceResolver#mapped_params` validates the argument and then discards it (#587758), so a user who filters by malware silently gets unfiltered results. - Because the frontend filter token is gated on this flag while the GraphQL argument is gated on `malicious_packages_dependency_list_filtering`, enabling only `dependency_malware_detection` shows the malware filter token, and using it raises `The malware filter is not available.` The badge is safe to roll out on this flag alone now that the field gating has been folded in. The filter token is the part to be careful about: enable it only alongside `malicious_packages_dependency_list_filtering`, and treat the finder work in #587758 as a prerequisite for the filter to actually work. Blast radius is otherwise limited to rendering on the dependency list, with no data or write path involved. ## Rollout ### Prerequisites Both original prerequisites are now met: !249418 merged, so the frontend reads the `dependency_malware_detection` flag name directly, and !251948 merged, so the `malware` field on the REST and GraphQL dependency APIs is gated by this flag with no separate field flag needed. One prerequisite remains, but it applies only to the malware filter token, not the badge: enable `malicious_packages_dependency_list_filtering` (#600025) for the same actors, and land the finder integration tracked in #587758. Until then, the filter token is visible but non-functional. Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to the team channel. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). Non-production: ``` /chatops gitlab run feature set dependency_malware_detection 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set dependency_malware_detection true --dev --pre --staging --staging-ref ``` Production, percentage rollout (wait at least 15 minutes between steps, watch dashboards): ``` /chatops gitlab run feature set dependency_malware_detection <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --group=gitlab-org,gitlab-com dependency_malware_detection true /chatops gitlab run feature set --user=dpisek dependency_malware_detection true ``` ### Verification - [ ] Malware badge renders in the Risk column on the project dependency list - [ ] Malware badge renders on the group dependency list - [ ] Malware filter token appears in the project and group filtered search - [ ] Risk column popover copy mentions malware packages - [ ] Filtering by malware returns the expected results rather than silently unfiltered ones ## Before global rollout Confirm the relevant gotchas before going to 100%, see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [ ] `malicious_packages_dependency_list_filtering` is enabled for the same actors - [ ] The finder integration in #587758 has landed, so the malware filter returns real results - [ ] [Docs and version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [ ] [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle), see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete dependency_malware_detection --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set dependency_malware_detection false # production /chatops gitlab run feature set dependency_malware_detection false --dev --pre --staging --staging-ref # non-production ``` ## Related - Implementation MRs: !249360, !249418 (frontend flag split), !251948 (dependency field flag folded in) - Sibling flag rollout: #597347 (`vulnerability_malware_detection`) - Dependency `malware` field flag rollout: #600274 (closed; folded into this flag by !251948) - Dependency `malware` filter flag rollout: #600025 - Parent issue: #587758 - Parent epic: https://gitlab.com/groups/gitlab-org/-/epics/18456