Skip to content

FE: Disable the link when it is a container image

Why are we doing this work

From &6698 (comment 736310183):

Adding a name of the image as a `path` in the `dependency-scanning` report ([gl-dependency-scanning-report.json](https://gitlab.com/groups/gitlab-org/-/uploads/53c745e97ead6d8a28372a00ae76d337/gl-dependency-scanning-report.json)) will not be currently properly rendered on UI side (the link will be active and when you click on it you will be taken to Repository instead of Container Registry). I believe we need to extend the [schema](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/dependency-scanning-report-format.json) to support `image` attribute (or we could add new attribute: `pathType`) that will indicate if this is a dependency from `lock` file in Repository or from a Container).

Another problem is this requirement:

> For operating system packages, the `Location` column will be populated with **a link to the container image**.

I'm not sure if we currently have a resolver that allows us to generate for `alpine:3.7` the URL to the container registry (https://hub.docker.com/_/alpine?tab=tags&page=1&name=3.7) or even in GitLab from `https://registry.gitlab.com/security-products/cluster-image-scanning:0` to https://gitlab.com/security-products/cluster-image-scanning/container_registry/2241060.

Perhaps instead of doing that we will either disable the link or allow users to copy the image name.

Relevant links

Implementation plan

Edited by Alexander Turinske