[FE] Bulk status change for findings in the pipeline security dashboard for "dismiss" and "needs triage"
Why are we doing this work
Recently, with !61536 (merged) we started using the vulnerability_list.vue
component in the Pipeline Security Dashboard
. This list is backed by GraphQL and was already used in the Project
, Group
and Instance
. The bulk update works only for the vulnerabilities, we need to write a different query for the findings.
In this issue, we'll only allow the "Dismiss" and "Needs triage" bulk state actions because those two have graphql mutations for findings. The other two will be added after [BE] Bulk status change for findings in the pip... (#431818) • Unassigned • Backlog is closed.
Steps to reproduce:
- Fork a repository (such as https://gitlab.com/gitlab-examples/security/security-reports/)
- Run the pipeline
- Enable the feature flag:
:pipeline_security_dashboard_graphql
- Go to Project > CI/CD > Pipelines > Your Pipeline > Security Tab
Relevant links
Implementation plan
-
frontend ee/app/assets/javascripts/security_dashboard/components/selection_summary.vue
contains the logic to handle the bulk status change for vulnerabilities. We need to extend it so that it uses different mutations when injecteddashboardType === 'pipeline'
-
frontend add entries findingMutation
inVULNERABILITY_STATE_OBJECTS
inee/app/assets/javascripts/vulnerabilities/constants.js
pointing to the finding mutations. -
frontend Implement tests.
Verification steps
- Go to the verification project latest pipeline on the security tab: https://gitlab.com/gitlab-org/govern/threat-insights-demos/verification-projects/security-reports-pipeline-security-listing-migration-and-enhancements/-/pipelines/1100011493/security
- Select a couple of findings and validate you can change state to "dismiss" (with dismissal reason) or "needs triage".
Edited by Lorenz van Herwaarden