Merge branch 'label-auto-fix' into 'master'

Add auto-fix Label

See merge request gitlab-org/gitlab!50657

ee/app/policies/ee/project_policy.rb

@@ -234,6 +234,7 @@ module EE
         enable :push_code
         enable :create_merge_request_from
         enable :create_vulnerability_feedback
+        enable :admin_merge_request
       end
 
       rule { issues_disabled & merge_requests_disabled }.policy do

ee/app/services/security/auto_fix_label_service.rb

+# frozen_string_literal: true
+
+module Security
+  class AutoFixLabelService < BaseContainerService
+    LABEL_PROPERTIES = {
+      title: 'GitLab-auto-fix',
+      color: '#FF8167',
+      description: <<~DESCRIPTION.chomp
+        Merge Requests created automatically by @GitLab-Security-Bot \
+        as a remediation of a security vulnerability
+      DESCRIPTION
+    }.freeze
+
+    def initialize(container:, current_user: nil, params: {})
+      super
+
+      @project = container
+    end
+
+    def execute
+      label = ::Labels::FindOrCreateService
+        .new(current_user, project, **LABEL_PROPERTIES)
+        .execute(skip_authorization: true)
+
+      ServiceResponse.success(payload: { label: label })
+    end
+
+    private
+
+    attr_reader :project
+  end
+end

ee/app/services/security/auto_fix_service.rb

@@ -18,7 +18,12 @@ module Security
         next unless vulnerability.remediations
 
         result = VulnerabilityFeedback::CreateService.new(project, User.security_bot, service_params(vulnerability)).execute
-        processed_vuln_ids.push vulnerability.id if result[:status] == :success
+
+        if result[:status] == :success
+          assign_label(result[:vulnerability_feedback].merge_request)
+
+          processed_vuln_ids.push vulnerability.id
+        end
       end
 
       if processed_vuln_ids.any?
@@ -36,6 +41,18 @@ module Security
       project.security_setting.auto_fix_enabled_types
     end
 
+    def assign_label(merge_request)
+      ::MergeRequests::UpdateService.new(project, User.security_bot, add_label_ids: [label.id])
+        .execute(merge_request)
+    end
+
+    def label
+      return @label if @label
+
+      service = ::Security::AutoFixLabelService.new(container: project, current_user: User.security_bot).execute
+      @label = service.payload[:label]
+    end
+
     def service_params(vulnerability)
       {
         feedback_type: :merge_request,

ee/spec/policies/project_policy_spec.rb

@@ -557,6 +557,7 @@ RSpec.describe ProjectPolicy do
         create_merge_request_in
         create_vulnerability_feedback
         read_project
+        admin_merge_request
       )
     end
 

ee/spec/services/security/auto_fix_label_service_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::AutoFixLabelService do
+  describe '#execute' do
+    subject(:execute) { described_class.new(container: project, current_user: bot).execute }
+
+    let_it_be(:project) { create(:project) }
+    let_it_be(:bot) { create(:user, :security_bot) }
+    let(:label_attributes) { described_class::LABEL_PROPERTIES }
+    let(:title) { label_attributes[:title] }
+    let(:color) { label_attributes[:color] }
+    let(:description) { label_attributes[:description] }
+
+    context 'when label exists' do
+      let!(:label) { create(:label, project: project, title: title) }
+
+      it 'finds existing label' do
+        result = execute
+
+        expect(result).to be_success
+        expect(execute.payload).to eq(label: label)
+      end
+    end
+
+    context 'when label does not exists' do
+      it 'creates a new label' do
+        result = execute
+        label = result.payload[:label]
+
+        expect(result).to be_success
+        expect(label.title).to eq(title)
+        expect(label.color).to eq(color)
+        expect(label.description).to eq(description)
+      end
+    end
+  end
+end

ee/spec/services/security/auto_fix_service_spec.rb

@@ -57,6 +57,15 @@ RSpec.describe Security::AutoFixService do
         expect(merge_request.description).to include("[#{identifier.external_id}](#{identifier.url})")
       end
 
+      it 'assign auto-fix label' do
+        execute_service
+
+        label = MergeRequest.last.labels.last
+        title = ::Security::AutoFixLabelService::LABEL_PROPERTIES[:title]
+
+        expect(label.title).to eq(title)
+      end
+
       context 'when merge request exists' do
         let(:feedback) { create(:vulnerability_feedback, :merge_request) }