- :white_check_mark: **Add the feature flag** `custom_scan_profiles_ui` in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252494+ — `config/feature_flags/wip/`, `type: wip`, `default_enabled: false`, `group: group::security controls`. Everything in this issue sits behind it. Renamed from `custom_secret_detection_profiles_ui` in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255684+ - Not `configurable_security_scan_profiles`, which is `type: beta`, `default_enabled: true`, with rollout already complete - :white_check_mark: **Push permissions to the frontend** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252340+ — `create_security_scan_profiles`, `update_security_scan_profiles` and `delete_security_scan_profiles` - `ScanProfileType` exposes no `userPermissions`, so read them from `group.userPermissions` - Disable each action's button when the user lacks its permission. Done in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Reuse `scan_profiles/insufficient_permissions_popover.vue` if necessary - :white_check_mark: **Drawer, opened from a `Manage profiles` button** next to a scanner in security configuration in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252494+ (trigger button + empty drawer) and https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253432+ (profile list + read-only detail pane) - Follow `security_attributes/attribute_drawer.vue` for the pattern, and the prototype for the layout: https://security-coverage-prototype-0b2bbb.gitlab.io/security-inventory-profiles/#/security-configuration - :white_check_mark: **Edit mode**, mutations and mapping util merged in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253807+, frontend form in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255995+ - Permissions: `update_security_scan_profiles`, gated in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Submitting the form calls `securityScanProfileUpdate` - Hide for `gitlabRecommended` profiles — the mutation refuses them - `triggers` is a complete set: omitted triggers are destroyed, and a trigger sent without configuration loses its configuration. Rebuild the array from the fetched `triggerSettings`, and cover it with tests - No mutation writes configuration on its own: `securityScanProfileUpdate` is the only one that can, and only through `triggers`. To change just the name or description, omit `triggers` entirely rather than restating it - No server-side defaults for Secret Detection, so render empty inputs with placeholders rather than prefilling - :white_check_mark: **Create a blank profile** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/256222+ - Permissions: `create_security_scan_profiles`, gated in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Submitting the form calls `securityScanProfileCreate` with name, description, scan type and at least one trigger - Name uniqueness and `MAX_PROFILES_PER_NAMESPACE = 20` are enforced on the backend — mirror them client-side for a faster error, but the server is the source of truth - :white_check_mark: **Delete** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255710+, with project count on the confirmation modal in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255822+ - Permissions: `delete_security_scan_profiles`, gated in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Confirming the dialog calls `securityScanProfileDelete`, and the dialog names the attached projects - Hide for `gitlabRecommended` profiles - :white_check_mark: **Duplicate** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257589+ - Permissions: `create_security_scan_profiles`, gated in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Clicking `Duplicate` opens the edit form pre-filled with the source profile's data (name, description, scan type, triggers) - Submitting the form calls `securityScanProfileCreate` with the modified data, creating a new profile - Name uniqueness enforced: form presents a distinct default name - Shown for `gitlabRecommended` profiles (duplicating to customize seems reasonable, unlike edit/delete) - :white_check_mark: **SAST support in the scan profile mapping util and mutations** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255625+, so the drawer can extend beyond Secret Detection - :white_check_mark: **Search the profile list** in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/256230+ - :white_check_mark: **Advanced configuration** - Closed drafts exploring where it goes: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252986+, https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253278+ and https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253279+ - Variable modal and section header in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257354+ - Read-only view in the drawer in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257984+ - SAST settings in the profile details modal in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257931+ - Variable catalog in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257505+ - Editable in the create and edit form in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258095+ - Fix enum-typed configuration values sent over GraphQL in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258343+ - Permissions: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/259383+ - Variable table on each scan trigger card in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258201+ - **Stretch** — open the read-only single-profile version of the drawer by clicking the profile name, which means making it a link in `scan_profiles/source_cell.vue`