Iteration 5 for Vulnerabilities Across Contexts covers the expansion of the feature to support additional development workflows. Specifically, supporting merging branch workflows by preserving MR security findings at merge time. ## MR Merge Security Findings Retention ### Summary Preserve MR security findings at merge time by ingesting them into an untracked security context. This enables historical tracking of vulnerabilities introduced and fixed by each MR, supporting compliance, audit, and developer workflow use cases. ### Problem Statement Currently, MR security findings have limited retention: | Data Source | Retention | Use Case | |-------------|-----------|----------| | `security_findings` table | 30-90 days | MR widget comparison | | CI job artifacts | Configurable (default varies) | Raw scan reports | | `vulnerability_occurrences` | 12 months + archive | **Default branch only** | **After an MR is merged:** 1. Security widget may work for 30-90 days (while `security_findings` exist) 2. After purge, there's no way to see what vulnerabilities the MR introduced or fixed 3. Compliance teams can't audit historical MR security state 4. Developers can't track their security improvements over time ### Proposed Solution Leverage the existing **Vulnerabilities Across Contexts (VAC)** infrastructure: 1. **On MR merge:** Subscribe to `MergeRequests::MergedEvent` 2. **Create untracked context:** For the MR's source branch 3. **Ingest findings:** Using existing `IngestReportsService` (now context-aware) 4. **Capture fixed findings:** Compare with target branch to identify what was fixed 5. **Expose via API:** New GraphQL field for historical MR findings 6. **Display in UI:** Updated MR widget for merged MRs ### Architecture ``` ┌─────────────────────────────────────────────────────────────────┐ │ MR Merged Event │ └─────────────────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ IngestMergedMrFindingsWorker │ │ - Validates MR has security reports │ │ - Checks target is default/tracked branch │ └─────────────────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ IngestMergedMrFindingsService │ │ - Creates untracked context for source branch │ │ - Triggers standard ingestion (context-aware) │ │ - Captures "fixed" findings │ └─────────────────────────────────────────────────────────────────┘ │ ┌────────────────┼────────────────┐ ▼ ▼ ┌──────────────────────────┐ ┌──────────────────────────┐ │ vulnerability_occurrences│ │ "Fixed" findings │ │ with context_id │ │ marked as resolved │ └──────────────────────────┘ └──────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ GraphQL API │ │ MergeRequest.securityFindingsAtMerge │ │ - addedFindings, fixedFindings │ │ - counts, timestamps │ └─────────────────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ MR Security Widget │ │ - Shows historical data for merged MRs │ │ - Clear "at merge time" indicator │ └─────────────────────────────────────────────────────────────────┘ ``` ### Prerequisites This epic depends on **Context-Aware Services** work being completed first (tracked in &18653): | Prerequisite Issue | Description | |--------------------|-------------| | https://gitlab.com/gitlab-org/gitlab/-/issues/589784 | Make MarkAsResolvedService Context-Aware | | https://gitlab.com/gitlab-org/gitlab/-/issues/589786 | Make BaseAutoStateTransitionService Context-Aware | | https://gitlab.com/gitlab-org/gitlab/-/issues/589787 | Make Statistics Services Context-Aware | | https://gitlab.com/gitlab-org/gitlab/-/issues/589788 | Thread Tracked Context Through Ingestion | ## Delivery Scope ### Backend | Issue | Description | Weight | Priority | |-------|-------------|--------|----------| | https://gitlab.com/gitlab-org/gitlab/-/issues/589789 | MR Merge Event Handler | 2 | P0 | | https://gitlab.com/gitlab-org/gitlab/-/issues/589790 | Ingestion Service for Merged MRs | 3 | P0 | | https://gitlab.com/gitlab-org/gitlab/-/issues/589791 | Capture Fixed Findings | 3 | P1 | | https://gitlab.com/gitlab-org/gitlab/-/issues/589792 | Historical Findings API | 3 | P1 | ### Frontend | Issue | Description | Weight | Priority | |-------|-------------|--------|----------| | https://gitlab.com/gitlab-org/gitlab/-/issues/589794 | MR Widget Historical View | 5 | P2 | ### Total Estimated Effort - **Backend:** 11 story points / ~2 weeks - **Frontend:** 5 story points / ~1 week - **Total:** ~3 weeks ## Benefits ### For Compliance Teams - Audit trail of security state at each merge - 12-month retention aligned with vulnerability retention policy - Evidence for security reviews and attestations ### For Developers - See historical impact of their security work - Track vulnerabilities fixed over time - No data loss after MR security findings purge ### For Security Teams - Understand which MRs introduce vs fix vulnerabilities - Better metrics on security posture changes - Historical context for vulnerability investigations ## Non-Goals (for this iteration) - Backfilling historical MRs (data doesn't exist after purge) - Cross-MR vulnerability tracking (e.g., "this vuln was introduced in MR A, fixed in MR B") - MR-level security policies based on historical data - Exposing historical data in Security Dashboard (could be future enhancement) ## Feature Flag ```yaml name: ingest_mr_security_findings_at_merge type: development group: group::security infrastructure default_enabled: false ``` ## Success Metrics | Metric | Target | |--------|--------| | MRs with preserved security findings | 95%+ of eligible MRs | | API query latency (p99) | < 500ms | | Storage growth per MR | < 500 KB average | ## Related Epics - &3430 - Parent: Track Vulnerabilities in locations other than the default branch - &18653 - Prerequisite: Vulnerability Management Across Contexts (context-aware services)