Trigger SAST FP + VR detection for all existing vulnerabilities
## Problem to Solve
Currently, the SAST FP detection workflow only triggers for brand new vulnerabilities created during a pipeline run (via `after_create_commit` in MR gitlab!208276). This means:
- Existing vulnerabilities in the project are never analyzed for false positives
- Customers with vulnerability backlogs must wait for new detections to benefit from the feature
- Running a new pipeline doesn't re-analyze existing High/Critical vulnerabilities
This significantly limits the feature's value for customers with existing security debt.
## Decision
Similarly to https://gitlab.com/groups/gitlab-org/-/work_items/21734+:
* In the vulnerability report, users should be able to bulk-select findings to run the flow on.
* Users would alternatively be able to utilise a "Select All" button to run the flow on the entire backlog.
* Once a job is running, we should present the user with a progress bar/indicator in the vulnerability report page.
* Once a job is running, we should also allow the user to cancel/terminate the job at will.
## Implementation Approach
Add a button to the Vulnerability Report banner that:
* Queues FP detection workflow for all qualifying vulnerabilities
* Create separate worker for "backfills" as to not block "global" worker for all customers
* Provide user feedback/progress indicator
* Allow user to cancel backfill operation
## Current Behavior
From MR gitlab!208276:
```ruby
# ee/app/models/ee/vulnerability.rb
after_create_commit :trigger_false_positive_detection, if: :sast?
def trigger_false_positive_detection
return unless ::Feature.enabled?(:enable_vulnerability_fp_detection, group)
::Vulnerabilities::TriggerFalsePositiveDetectionWorkflowWorker.perform_async(id)
end
```
This only fires when a **new** vulnerability record is created.
## Proposed Behavior
When the user clicks the button in the banner:
1. Identify all High/Critical SAST vulnerabilities in the project
2. Trigger FP detection workflow for each vulnerability
3. Respect concurrency limits to prevent resource exhaustion
4. Provide feedback to the user about the processing
## Implementation Considerations
```ruby
# Potential implementation
class Vulnerabilities::TriggerBulkFpDetectionWorker
def perform(project_id, user_id)
project = Project.find(project_id)
# Find all High/Critical SAST vulnerabilities
vulnerabilities = project.vulnerabilities
.sast
.with_severity([:critical, :high])
.not_recently_analyzed(48.hours)
# Trigger FP detection with rate limiting
vulnerabilities.find_each do |vulnerability|
Vulnerabilities::TriggerFalsePositiveDetectionWorkflowWorker.perform_async(vulnerability.id)
end
end
end
```
## Related Issues
- Parent Epic: gitlab#18977
- Related: gitlab#581652 (Banner implementation)
- Related: gitlab#581975 (Manual trigger for single vulnerability)
- Related: https://gitlab.com/groups/gitlab-org/-/epics/18977#note_2904564049
- Related: https://gitlab.com/groups/gitlab-org/-/epics/19897 (Event-based triggers architecture)
## Questions to Resolve
- [ ] Should the button be available only once or multiple times?
- [ ] How do we handle projects with hundreds of existing vulnerabilities?
- [ ] What feedback should we provide to users during processing?
- [ ] What's the impact on Duo Workflow Service capacity?
- [ ] Should we add a cooldown period between bulk processing requests?
epic