Use case: > I was trying to test VR on some projects And I wanted to filter the vulnerability report and see only the findings for which Vulnerability Resolution is enabled. It looks like we currently have no easy way to do it. I believe that customers would like to do this kind of filtering and prioritize fixing findings that can be fixed automatically. Possible implementation: We can add a new activity filter: https://docs.gitlab.com/ee/user/application_security/vulnerability_report/index.html#activity-filter. Something like "Has resolve with AI". ## MVC 1. Filtering and activity icon for Vulnerability Resolution only 2. MVC Design: https://gitlab.com/gitlab-org/gitlab/-/issues/477284/designs/design_1724977457515.png ## Implementation Plan - Iteration 1 - Badge Only | Area | Function | Details | BE/FE | Issue | Complete | |------|----------|---------|-------|-------|----------| | **Vulnerability Report** | | | | | | | | Feature flag | `vulnerability_report_vr_badge` | ~"feature flag" | https://gitlab.com/gitlab-org/gitlab/-/issues/486549 | :white_check_mark: | | | GraphQL field | Add VR badge for supported CWEs on the vulnerability report page | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/485853 | :white_check_mark: | | | Badge | Add "ai resolution" badge & tooltip to Vulnerability Report | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/481530 | :white_check_mark: | ## Implementation Plan - Iteration 2 - Filtering | Area | Function | Details | BE/FE | Issue | | |------|----------|---------|-------|-------|--| | Project | | | | | | | | Feature flag | `vulnerability_report_vr_filter` | ~"feature flag" | https://gitlab.com/gitlab-org/gitlab/-/issues/486534 | | | | DB | Add `has_vulnerability_resolution` column to `vulnerability_reads` table | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/485583 | :white_check_mark: | | | DB | Backfill migration for `has_vulnerability_resolution` in VulnerabilityReads | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/486530 | :white_check_mark: | | | DB | Finalize `BackfillHasVulnerabilityResolution` migration | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/496437 | :white_check_mark: | | | DB | Begin populating the `has_vulnerability_resolution` column | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/488394 | :white_check_mark: | | | GraphQL | Expose \`has_ai_resolution\` via GraphQL | ~backend | gitlab#490323 | :white_check_mark: | | | DB | Sync indices for project and group level queries | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/493285 | :white_check_mark: | | | GraphQL | Add "has_ai_resolution" filter to Vulnerability Report Query | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/490323 | :white_check_mark: | | | GraphQL | Add "has_ai_resolution" filter to Vulnerability Report Counts Query | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/497210 | :white_check_mark: | | | UI | Add "has_ai_resolution" filter to Vulnerability Report | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/481528 | | | | UI | Add "has_ai_resolution" filter to Vulnerability Report **Count** | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/481529 | | | | UI | Pass permission ability for Group page | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/496332 | :white_check_mark: | | | UI | Pass permission ability for Security Center page | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/496463 | :white_check_mark: | | | UI | Add VR Filtering to Group and Security Center level | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/495644 | | | | Docs | Add VR Filtering to docs | ~documentation | https://gitlab.com/gitlab-org/gitlab/-/issues/486517 | | | | GraphQL | Update Vulnerability Report GraphQL to use `has_vulnerability_resolution` database field | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/499977 | :white_check_mark: | | | UI | Verify VR badge works after switching to vulnerability table instead of CWE object | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/492403 | | ## Post MVC / Stretch | Area | Function | Details | BE/FE | Issue | |------|----------|---------|-------|-------| | Project | | | | | | | GraphQL | Update Vulnerability Details GraphQL to use `has_vulnerability_resolution` database field | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/499978 | | | Export | Add `has_vulnerability_resolution` column to CSV export | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/482957 | ## Future considerations - A migration anytime the [static CWE list](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/models/vulnerabilities/finding.rb?ref_type=heads) is changed