### References: - prototype: https://atr-prototype-201201.gitlab.io/#/version/enablement/security-coverage, select projects, then `Select bulk action` > `Apply Automated Triage and Remediation profile`. Read at commit https://gitlab.com/gitlab-com/gitlab-ux/security-compliance-ux/srm-ux-group/atr-prototype/-/commit/53af1d2, 2026-10-27. It shows a different bulk selection summary bar. This issue uses the existing bulk selection summary bar in the inventory. - description: https://gitlab.com/gitlab-org/gitlab/-/work_items/634570, section "Bulk apply". It applies to every selected project, replacing where present. - the drawer is the preset drawer with the apply button from https://gitlab.com/gitlab-org/gitlab/-/work_items/631414. This issue lets it target several items. - needs https://gitlab.com/gitlab-org/gitlab/-/work_items/631414 for the apply button - `<selection>` below follows the prototype's `selectionLabel`, with `subgroups` as the inventory says elsewhere (`name_cell.vue`): `<count> projects` when only projects are selected, `<count> subgroups` when only subgroups are, and `<count> subgroups and <count> projects` when both are. Singular for one. Build it as one string with two `n__` placeholders, as `name_cell.vue` does, and split the selected ids by type, as `bulk_scanners_update_drawer.vue` does. - attach mode: leave `mode` out. The default is `SET`, since https://gitlab.com/gitlab-org/gitlab/-/merge_requests/262310 merged. Do not pass `REPLACE`, which only acts on projects that already have a profile. - on master, the triage row is one of the rows in the scanners table, under the `Scanner` column. It is added behind the flag in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258623, in `ee/app/assets/javascripts/security_inventory/components/bulk_scanner_profile_configuration.vue`, from the triage category in `SCAN_PROFILE_CATEGORIES`. This issue removes it from there. - the bulk menu is `ee/app/assets/javascripts/security_inventory/components/bulk_edit_actions_dropdown.vue` - selection works as it does for scanners and attributes: project and subgroup checkboxes, or all filtered projects from the header, capped by `isSelectedLimitReached` - how existing attach callers report failures, on master: | Case | Inventory `bulk_scanners_update_drawer.vue` | Scanner wizard `enable_scanners_wizard/app.vue` | |---|---|---| | Whole request rejected (user cannot apply to a selected item) | Generic alert: "An error has occurred while applying the scan profile." | Error text in a danger `GlAlert`, stays on the page | | `errors` for some selected projects, such as the scan profile limit | The same generic alert. It drops the error text, and reads as total failure though the other projects applied | Lists each error in the `GlAlert`, naming the projects | | Selected groups, failures found in the background and emailed | Success toast "<name> applied" before the group work runs. No mention of the email | Confirmation page. No mention of the email | - Follow the wizard here: list `errors` in an alert, rather than the inventory drawer's generic message. ### Acceptance criteria: - **Given** the `triage_and_remediation_profiles_ui` feature flag is enabled - **Given** the user has selected projects or subgroups in the Security inventory - **When** the user opens `Select bulk action`, **then** it offers `Apply Automated Triage and Remediation profile` after `Manage security scanners` and `Manage security attributes` - **When** the user selects it, **then** the preset drawer opens, titled `Select an Automated Triage and Remediation profile for <count> items`, or `item` for one - **Then** its apply button reads `Apply profile` - **When** the user applies, **then** the drawer closes and a confirmation dialog opens, for any number of selected items - title: `Apply <preset> to <selection>?` - body: "<preset> uses GitLab Credits." Every preset here is GitLab-managed, so the body does not suggest it can be edited - then a line: "Acts on new vulnerabilities. Existing ones keep their current state." - buttons: `Apply profile` and `Cancel` - **When** the user cancels, **then** the dialog closes, nothing is applied, and the selection is kept - **When** the user confirms, **then** the preset is attached to every selected item, replacing any triage and remediation preset already there - **When** the apply succeeds, **then** a toast reads "<preset> applied to <selection>. Runs on new vulnerabilities only.", the selection is cleared, and the inventory refetches. The toast has no undo. - **When** some of the preset's capabilities are off for the top-level group, **then** the toast adds "Some capabilities won't run yet." This is tentative copy, to confirm with Celeste. Where that comes from is https://gitlab.com/gitlab-org/gitlab/-/work_items/635294. - The toast's `View configuration` link is in https://gitlab.com/gitlab-org/gitlab/-/work_items/633906 - **When** the apply returns `errors`, **then** the drawer reopens on the chosen preset and lists them in its alert, as https://gitlab.com/gitlab-org/gitlab/-/work_items/631414 does for one project - **Then** the `Manage security scanners` panel has no triage and remediation row - **When** the flag is disabled, **then** the bulk menu has no triage and remediation action, and the scanners panel is unchanged ### Decisions: - Provisional, 2026-10-22: triage and remediation gets its own bulk action opening the preset drawer, as in the prototype's crawl version. It is not a second table in `Manage security scanners`, as the 2026-10-19 design walkthrough had it (https://youtu.be/Slq8d-KeB-w at 42:24). - This leaves the scanner copy alone, so the "security tools" rename is not needed here. - The drawer cannot show which preset the selected projects have now, and the confirmation copy does not say an existing preset is replaced. - Provisional, 2026-10-22: every bulk apply asks for confirmation, as the prototype now does, since one project also spends GitLab Credits. - Provisional, 2026-10-22: a request rejected because the user cannot apply to one selected item shows the returned error in the drawer's alert. No pre-filtering of the selection in 19.6. - Provisional, 2026-10-22: errors reopen the drawer rather than showing on the page. The prototype closes the drawer before the confirmation so a dialog never sits over a drawer, and reopening keeps that. - Provisional, 2026-10-22: the drawer title, button, confirmation and toast copy match the prototype's crawl version. Updated 2026-10-27 to the enablement version, which is also 19.6. Selections name subgroups and projects separately, as the prototype does, but say `subgroups` rather than `groups`. - Provisional, 2026-10-22: the toast does not mention the failure email for selected groups in 19.6. - Provisional, 2026-10-26: the toast's line for capabilities that are off has no count, to match the alert in https://gitlab.com/gitlab-org/gitlab/-/work_items/635294 after the 2026-10-22 design critique (https://gitlab.com/gitlab-org/gitlab/-/work_items/635294#note_4076761343). - The copy is tentative. The prototype still shows the counted line, at https://gitlab.com/gitlab-com/gitlab-ux/security-compliance-ux/srm-ux-group/atr-prototype/-/blob/e599ecc/src/prototypes/security-platform/automation-first/_data.js#L3762-3763. - Not in this issue: the prototype's enablement version adds a bulk `Turn off`. The Owner's capability turn-on checkbox was removed from the prototype on 2026-10-27. ### Out of scope for 19.6: - In the confirmation dialog's list: "Opens up to <n> merge requests per project.", or "Opens fix merge requests with no limit." when a fix capability has no limit - Why: only dependency scanning auto-remediation's cap is enforced, and SAST vulnerability resolution can open fix merge requests with no cap, so a per-project cap would be false. Source: https://gitlab.com/gitlab-org/gitlab/-/work_items/633904, Decisions