Skip to content

[FE] - [CS ForRegistry] - Implement Image/Tag column in vuln report table

Why are we doing this work

  • add image/tag column to table

Relevant links

vulnerability report

Non-functional requirements

  • Documentation:
  • Testing:

Implementation plan

  • Add behind feature flag CS_FOR_REGISTRY
  • If using @skip or @include directive, then the resolver must exist in backend FIRST but featured flag out to return undefined or null if the flag is off.
  • Otherwise client side feature flag uses two versions of a query conditionally.
    • frontend do not request continuous container registry vulnerability scan image/tag for other tabs
    • frontend ensure the new column does not show up on the security center
    • frontend ensure the new column does show up at project/group level.
  • frontend show the image, severity, and status filters
  • frontend show the Image and tag column

Implementation Details

backend backend Needs

  • Look at !145758 (fc6d9ed9)

  • Need to add new image_and_tag key or something similar for new table column

  • NO-OP resolvers must exist for the fields we are requesting image_and_tag behind feature flag if I am to use the @include, @skip directives, otherwise a javascript exception will occur.

Weight Reasoning

3 - If need two queries

2 - If can use @skip, @include directives if we have a stubbed out resolver.

  • Still need to handle feature flag logic. Depending if backend gets feature flagged resolvers implemented first, or if I will need to work around that by implementing 2 queries client side. 2 query versions increases complexity.

Verification steps

  1. Upload a GitLab Ultimate license
  2. Navigate to a project => Security & Compliance => Vulnerability Report => Container registry vulnerabilities tab
  3. Ingest a SBOM report with metadata.tools as registry event set as a part of [CS For Registry] Set SBOM occurrence source to... (#443634 - closed)
  4. Verify that db records are created as per the requirements.
  5. Run advisory scanner and report parser.
  6. Verify that the vulnerabilities are created with report_type: CONTAINER_SCANNING_FOR_REGISTRY
  7. Verify that the group and project GraphQL endpoints returns these vulnerabilities on applying the filter for report_type: CONTAINER_SCANNING_FOR_REGISTRY.
Edited by Fernando Cardenas