Skip to content

Adds analysis and summary for Vulnerability Resolution MR

What does this MR do and why?

This adds detailed AI analysis of vulnerability and summary of the fix in the AI generated MR description for vulnerability resolution MRs by Gitlab Duo.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After
Screenshot 2024-07-23 at 11.55.36 AM.png Screenshot 2024-07-23 at 11.55.25 AM.png

How to set up and validate locally

  1. Pre-requisites:

    1. Enable the resolve_vulnerability_ai_gateway feature flag:

      Feature.enable(:resolve_vulnerability_ai_gateway)
    2. Setup local AI Gateway

  2. If you have a security vulnerability created for your project, next step is optional. TO check if your project has an already created vulnerability, check if http://<GDK_HOST>:3000/-/security/vulnerabilities has any listed vulnerability.

  3. Create a vulnerability in a project with a file:

    source = <<~SOURCE
    #include <stdio.h>
    
    int main(int argc, char *argv[])
    {
      char buf[8];
      memcpy(&buf, "123456789");
      printf("hello, world!");
    }
    SOURCE
    
    project = Project.find(<my-project-id>)
    project.repository.create_file(User.find(<my-user-id>), 'src/main.c', source, message: 'Vulnerable file', branch_name: 'main')
    finding = FactoryBot.create(:vulnerabilities_finding, :sast, project: project, location: { 'file' => 'src/main.c', 'start_line' => 5, 'end_line' => 6 })
    FactoryBot.create(:vulnerability, findings: [finding], project: project)
  4. Go to http://<GDK_HOST>:3000/-/security/vulnerabilities/<vulnerability-id> and click Resolve with merge request button on the top. It takes some time (less than a minute) to process.

  5. You should be redirected to the newly created MR. Check for Summary and Analysis sections in the MR description.

Related to #473253

Edited by Surabhi Suman

Merge request reports

Loading