[go: up one dir, main page]

Expose matches_auto_dismiss_policy for FindingEntity

What does this MR do and why?

Expose matches_auto_dismiss_policy for FindingEntity

To display a badge for findings in the MR security widget that will be automatically dismissed by a auto-dismiss policy, we need to include a new attribute in the FindingEntity. We use a batch preloader to avoid N+1.

References

  1. Support Security::Finding for auto-dismiss matc... (!216178 - merged)
  2. Add auto dismissal checker for batch preloading... (!216340)
  3. 👉 Expose matches_auto_dismiss_policy for FindingE... (!216342)
  4. FE changes: Show an icon in MR widget for findings matched ... (!216179)

Screenshots or screen recordings

With the FE changes, the end result will be:

Before After
CleanShot_2025-12-11_at_09.46.04_2x CleanShot_2025-12-11_at_10.03.10_2x

How to set up and validate locally

  1. Enable the feature flag auto_dismiss_vulnerability_policies
  2. Create a project
  3. Create an auto-dismiss policy:
    vulnerability_management_policy:
    - name: Auto-dismiss acceptable secrets
      description: Auto-dismiss secrets
      enabled: true
      actions:
      - type: auto_dismiss
        dismissal_reason: not_applicable
      rules:
      - type: detected
        criteria:
        - type: file_path
          value: ".env"
  4. Add .gitlab-ci.yml with secret detection
    include:
    - template: Jobs/Secret-Detection.latest.gitlab-ci.yml    
  5. Add two secrets in a new MR:
    1. .env:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGQ
    2. .env2:
      AWS_TOKEN=AKIAZYONPI3G4JNCCWGA
  6. Wait for the pipeline to finish
  7. Inspect the network requests and open the response for merge_requests/:id/security_reports. Verify that the added findings have the attribute matches_auto_dismiss_policy correctly set.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #581394

Edited by Martin Cavoj

Merge request reports

Loading