## Problem to solve The Security reports are still generated on the frontend on the Merge Request and pipelines pages. In order to increase performance, reliability, and consistency, we should update them to generate these reports on the backend and have the frontend access them via a JSON API like [junit reports](https://docs.gitlab.com/ee//ci/junit_test_reports.html) do. This is how the Group Security Dashboard and Project security dashboard currently handle this. ### Proposal Create a new API to deliver reports content to the frontend, using a ready to use and common json entity. Such [entities already exist](https://gitlab.com/gitlab-org/gitlab-ee/blob/master/ee/app/serializers/vulnerabilities/occurrence_entity.rb) as part of the Group Security Dashboard and should be reused to provide the same structure everywhere and allow frontend to reuse standard components. Though, as it has not yet been decided if every branch will leverage the DB storage, we may need to adapt this to non persisted records. Reports will not be fetched by the frontend code anymore. Comparison between `base` and `head` will be done in the backend. This should apply to: 1. security reports in the pipeline view 1. security reports in the MR widget The plan is to tackle each of the reports on the pipelines page individually and put each implementation behind a feature flag so we can revert back to the old way should anything unexpected happen. Once the pipelines page is all moved across, we can start to think about how we tackle this on the MR widget. This would be a bit more complex than the pipelines and security dashboards as we'd need to do a comparison of two reports. This epic was previously issue https://gitlab.com/gitlab-org/gitlab/issues/8519 ## Status for reports: | Report Type | Frontend | Backend | Verified on Staging | Verified on .com | Feature flag | |---------------------|---------------------------------------------------------------------|------------------------------------------------------------------------|------------------------------------------------------------------------------|------------------|----------------------------------| | SAST | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15804) | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15114) | ✅ | ✅ | Default `true` | | DAST | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15403) | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/18660) | ✅ | ✅ | Default `true` | | Dependency Scanning | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15406) | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15023) | ✅ | ✅ | Default `true` | | Container Scanning | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/15226) | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/14898) | ✅ | ✅ | Default `true` | | License Compliance | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/17905) | [Merged](https://gitlab.com/gitlab-org/gitlab/merge_requests/14723) | :white_check_mark: | :white_check_mark: | Default `true` | | Pipeline Reports | [Merged]() | [Merged]() | ✅ | ✅ | Default `true` |