Correctly populate Vulnerability Issue description from GQL mutation
requested to merge 385616-correctly-populate-issue-description-from-security-finding-create-issue-service into master
What does this MR do and why?
This MR reworks the creation of issues from vulnerabilities using the GraphQL securityFindingCreateIssue
mutation so that the issue description is correctly populated in the same way that it would be if an issue was created from the web (via Vulnerability -> Create Issue).
This MR also fixes issues descriptions when created from VulnerabilityFeedback::CreateService
.
Before
After
Before and after screenshots of _Create Issue_ from the web, via the Vulnerability page _Create Issue_ button. (unchanged)
Before
After
How to set up and validate locally
- Find the
id
of aVulnerability
without an existing linked issue - Find the
uuid
of theVulnerability::Finding
related to theVulnerability
rails runner 'puts Vulnerability.find(542).finding.uuid' # 512ae9b8-ec23-586b-b5f1-6147c9e2a1c8
- Find the
id
of theProject
related to theVulnerability
rails runner 'puts Vulnerability.find(542).project_id' # 20
- Load
/-/graphql-explorer
in your web browser - Enter the following query, substituting the
Vulnerability::Finding#uuid
andProject#id
mutation { securityFindingCreateIssue( input: { clientMutationId: "abc123", uuid: "512ae9b8-ec23-586b-b5f1-6147c9e2a1c8", project: "gid://gitlab/Project/20" } ) { clientMutationId errors issue { id } } }
- Click
Execute Query
- The GQL response should contain a
gid
for the created issue containing the issue number, e.g.gid://gitlab/Issue/123
- Visit the corresponding issue on the project page to check the issue content.
This MR also impacts the workflow when creating an issue from the vulnerabilities page. To validate this:
- Find a vulnerability that does not have an existing linked issue at Security and Compliance -> Vulnerability Report
- Click the Vulnerability description and then click Create Issue
- On the subsequent New Issue page click Create Issue
- Check the resulting issue is displayed correctly
Technical notes
- The largest change in this MR is the removal of a lot of spec boilerplate from
ee/spec/services/ee/issues/create_from_vulnerability_service_spec.rb
(renamed fromcreate_from_vulnerability_data_service_spec.rb
). Most of the contextual behaviour of that spec was actually executing conditional code in the viewee/app/views/vulnerabilities/issue_description.md.erb
. Consequently I've simplified the service class spec and added a spec for the view with some extra coverage.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #385616 (closed)
Edited by Malcolm Locke