Skip to content

Show license scanning widget when sbom scanner feature flag is enabled

What does this MR do and why?

Describe in detail what your merge request does and why.

Currently, the license scanning widget is only displayed when there is a license_scanning report. This causes the widget to not appear when we enable the license_scanning_sbom_scanner feature flag for a project and can lead to unwanted behavior. Specifically, it will cause the widget to not appear when new licenses are detected via the software components, and as a result a maintainer/reviewer may approve an unwanted license in a MR. This MR changes it so that we delegate the decision on whether or not to display the license scanning widget to the concretes classes of ::Gitlab::LicenseScanning::BaseScanner.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before

image of fixed license compliance widget

After

There's no new licenses because the existing licenses used by the project includes MIT already.

image of fixed license compliance widget

Relates to #384936 (closed)

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. Setup a project and add a cyclonedx sbom at the root of the project.
  2. Enable the feature flag for the project.
  3. Create a .gitlab-ci.yml in the project with the following pipeline and attempt to merge it.
dependency_scanning:
  script:
  - "echo Testing license scanning via SBOM component scanning."
  stage: test
  artifacts:
    reports:
      cyclonedx: gl-sbom-*.cdx.json
  1. Verify that the widget shows parsing then the results of the comparison.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Oscar Tovar

Merge request reports

Loading