## Description As a Product Manager, I want the ability to easily move features which make up ~"Category:SAST" or ~"Category:Secret Detection" between license tiers so that I can more nimbly respond to customer requests and company needs. Similarly, Engineering Management wants the ability to address these changes with smaller teams so that it costs less to make features be more broadly available. We are treating the SAST and Secret Detection _feature categories_ as _features_ within the codebase. This is causing us to break the abstraction in our licensing model by bleeding license and feature usage into source code. This is causing our application to contradict itself, like with the implication that the [`sast` feature](https://gitlab.com/gitlab-org/gitlab/-/blob/36763306bd8dee3f694920cd87aa7131cfb448a7/ee/app/models/license.rb#L147) is only available as an EE feature in the Ultimate license. This is not true as SAST and Secret Detection is available to all levels. We should instead break the categories into their composite features and make them separately licensable. We started to do that with Custom Rulesets and FP reduction, but we need to do that with the all the other features. ## Requirements - Availability of SAST, Secret Detection features should be controlled exclusively through the license model. - Features available in official documentation should be reconciled against a [feature breakdown document](https://docs.google.com/document/d/1gPYRQGyiauAAbHxvkm6nc7hU0GDmfvlTbu1hLvJaSF0/edit?usp=sharing) provided by product management. - Do not change tiers at which features are currently made available. ## Proposal Replace Secure ~backend code feature references with more specific features. In the case of gitlab~3712019, https://docs.gitlab.com/ee/user/application_security/sast/index.html#summary-of-features-per-tier lays out what should be available. ## Tasks - [ ] Create a feature string for all top-level features that aren't available to all levels. - [ ] Replace usage of the `sast` string feature value with policy references when possible <!-- start-discoto-summary --> ## Auto-Summary :robot: <details> <summary>Discoto Usage</summary> --- > **Points** > > Discussion points are declared by headings, list items, and single > lines that start with the text (case-insensitive) `point:`. For > example, the following are all valid points: > > * `#### POINT: This is a point` > * `* point: This is a point` > * `+ Point: This is a point` > * `- pOINT: This is a point` > * `point: This is a **point**` > > Note that any markdown used in the point text will also be propagated > into the topic summaries. > > **Topics** > > Topics can be stand-alone and contained within an issuable (epic, > issue, MR), or can be inline. > > Inline topics are defined by creating a new thread (discussion) > where the first line of the first comment is a heading that starts > with (case-insensitive) `topic:`. For example, the following are all > valid topics: > > * `# Topic: Inline discussion topic 1` > * `## TOPIC: **{+A Green, bolded topic+}**` > * `### tOpIc: Another topic` > > **Quick Actions** > > | Action | Description | > |-------------------------------|---------------------------------------------------------| > | `/discuss sub-topic TITLE` | Create an issue for a sub-topic. Does not work in epics | > | `/discuss link ISSUABLE-LINK` | Link an issuable as a child of this discussion | > --- </details> Last updated by [this job](https://gitlab.com/theoretick/discoto-runner/-/jobs/13854367726) * **TOPIC** parse vulnerability data on non-ultimate tiers https://gitlab.com/groups/gitlab-org/-/issues/6704#note_674722670 * **TOPIC** Tie report storage feature check to security_dashboard https://gitlab.com/groups/gitlab-org/-/issues/6704#note_674722680 <!-- end-discoto-summary --> <!-- start-discoto-topic-settings --><details> <summary>Discoto Settings</summary> <br/> ```yaml --- summary: max_items: -1 sort_by: created sort_direction: ascending ``` See the [settings schema](https://gitlab.com/gitlab-org/secure/pocs/discoto#settings-schema) for details. </details> <!-- end-discoto-topic-settings -->