Show SBOM ingestion errors on the licenses tab of the pipeline page
Why are we doing this work
With #364709 (closed), we added the ability for GitLab to ingest CycloneDX SBoMs. Currently, SBoMs are validated and the warnings + errors from schema validation are collected, but there is no way to show those errors to the end user.
The SBOM report data is necessary to complete the License Scanning for every branches. So an SBOM ingestion error will prevent the licenses to show up and the MR License Approval policies won't work correctly, possibly blocking MRs. This makes this information very relevant to be displayed here. Though, this requires to store the information on a per pipeline basis. This data is likely to grow indefinitely so we must have a data retention limit on this and e.g. only keep the sbom ingestion errors for 30 days.
Relevant links
Non-functional requirements
-
Documentation: -
Feature flag: -
Performance: -
Testing:
Implementation plan
- BE (might already be done with #471317 (closed)): Store the ingestion errors for each pipeline in redis ( 1 redis key:value per pipeline) with a TTL of 30 days (to be adjusted if necessary). NB: we could go with storing errors only for the most recent pipeline for the purpose of this issue, but other needs will require to have it per pipeline so we're going with that. This logic can be added to the IngestReportsService like the
set_latest_ingested_sbom_pipeline_idmethod call. - BE: expose the latest sbom pipline's
has_errorsboolean value in the pipeline license tab setup data (pipeline_helper.rb) - FE: load the errors in the vueJS state for the pipeline license tab and trigger the display of the error messages if anny
- FE: reuse dedicated component to display SBOM ingestion errors (implemented in Show SBOM ingestion errors on the project level... (#471317 - closed))