Skip to content

Show explain vuln based on experimental and 3rd party API toggles

What does this MR do and why?

This MR changes whether the "Explain this vulnerability" feature:

ksnip_20230504-020504

is shown based on whether "Use experiment features" and "Use third-party AI services" are checked in the group's general settings (both have to be checked for it to show):

ksnip_20230504-020414

How to set up and validate locally

This one will take some setting up to do.

  1. Enable the following feature flags: openai_experimentation, explain_vulnerability, and ai_related_settings.
  2. Enable the GITLAB_SIMULATE_SAAS env variable:
export GITLAB_SIMULATE_SAAS=1
  1. Go to Admin -> Settings -> General -> Account and limit and check Allow use of licensed EE features. Save the changes.
  2. Go to Admin -> Groups, find a group, and click the Edit button.
  3. Under Permissions and group features, change Plan to Ultimate. Save the changes.
  4. Go to the group -> Settings -> General -> Permissions and group features and check Use experiment features and Use third-party AI services.
  5. Go to a project under the group, then view its vulnerability report.
  6. Filter by SAST results and click on a vulnerability to go to the details page.
  7. Verify that the "Explain this Vulnerability" feature is shown.
  8. Uncheck either Use experiment features or Use third-party AI services. Verify that the "Explain this Vulnerability" feature is hidden.
  9. Uncheck Allow use of licensed EE features. Verify that the feature is shown. When we do not check this, all features should be available.

2023-05-04_02-59-55

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #409535 (closed)

Edited by Daniel Tian

Merge request reports

Loading