Show explain vuln based on experimental and 3rd party API toggles
What does this MR do and why?
This MR changes whether the "Explain this vulnerability" feature:
is shown based on whether "Use experiment features" and "Use third-party AI services" are checked in the group's general settings (both have to be checked for it to show):
How to set up and validate locally
This one will take some setting up to do.
- Enable the following feature flags:
openai_experimentation
,explain_vulnerability
, andai_related_settings
. - Enable the
GITLAB_SIMULATE_SAAS
env variable:
export GITLAB_SIMULATE_SAAS=1
- Go to
Admin -> Settings -> General -> Account and limit
and checkAllow use of licensed EE features
. Save the changes. - Go to
Admin -> Groups
, find a group, and click theEdit
button. - Under
Permissions and group features
, changePlan
toUltimate
. Save the changes. - Go to the
group -> Settings -> General -> Permissions and group features
and checkUse experiment features
andUse third-party AI services
. - Go to a project under the group, then view its vulnerability report.
- Filter by SAST results and click on a vulnerability to go to the details page.
- Verify that the "Explain this Vulnerability" feature is shown.
- Uncheck either
Use experiment features
orUse third-party AI services
. Verify that the "Explain this Vulnerability" feature is hidden. - Uncheck
Allow use of licensed EE features
. Verify that the feature is shown. When we do not check this, all features should be available.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #409535 (closed)
Edited by Daniel Tian