Commit 3ad54556 authored by Subashis's avatar Subashis

Create vulnerability issue link after merging the MR

- Create issue link for vulnerability after merging MR.
- Update specs.
- Add change log.
parent a3aa78d8
......@@ -213,11 +213,21 @@ module Security
end
def create_vulnerability(vulnerability_finding, pipeline)
if vulnerability_finding.vulnerability_id
Vulnerabilities::UpdateService.new(vulnerability_finding.project, pipeline.user, finding: vulnerability_finding, resolved_on_default_branch: false).execute
else
Vulnerabilities::CreateService.new(vulnerability_finding.project, pipeline.user, finding_id: vulnerability_finding.id).execute
end
vulnerability = if vulnerability_finding.vulnerability_id
Vulnerabilities::UpdateService.new(vulnerability_finding.project, pipeline.user, finding: vulnerability_finding, resolved_on_default_branch: false).execute
else
Vulnerabilities::CreateService.new(vulnerability_finding.project, pipeline.user, finding_id: vulnerability_finding.id).execute
end
create_vulnerability_issue_link(vulnerability)
vulnerability
end
def create_vulnerability_issue_link(vulnerability)
vulnerability_issue_feedback = vulnerability.finding.feedback(feedback_type: 'issue')
return unless vulnerability_issue_feedback
vulnerability.issue_links.create!(issue_id: vulnerability_issue_feedback.issue_id)
end
def scanners_objects
......
---
title: Create vulnerability issue link after merging the MR
merge_request: 56038
author:
type: added
......@@ -277,6 +277,33 @@ RSpec.describe Security::StoreReportService, '#execute' do
expect(Gitlab::AppLogger).to have_received(:warn).exactly(new_report.findings.length).times
end
end
context 'vulnerability issue link' do
context 'when there is no assoiciated issue feedback with finding' do
it 'does not insert issue links from the new pipeline' do
expect { subject }.to change { Vulnerabilities::IssueLink.count }.by(0)
end
end
context 'when there is an assoiciated issue feedback with finding' do
let(:issue) { create(:issue, project: project) }
let(:issue_feedback) do
create(
:vulnerability_feedback,
:sast,
:issue,
issue: issue,
project: project,
project_fingerprint: new_report.findings.first.project_fingerprint
)
end
it 'inserts issue links from the new pipeline' do
issue_feedback
expect { subject }.to change { Vulnerabilities::IssueLink.count }.by(1)
end
end
end
end
context 'with existing data from same pipeline' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment