gitlab-qa 14.13.0 → 14.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f22d815fd3ac524d090783dfbd902ff3c88aab3e4429cddac39168264524210d
-  data.tar.gz: 0d68738dc9dd3c5ef7350a5243221aa161919b9e8fc4e4296253124c137189c1
+  metadata.gz: 497913af708d5bd502f32c82f052d0dbcfddb70142979c9e2ecf76ea40ab76d8
+  data.tar.gz: 730eec75c41c7805635602a68d461844062dc786bf953071bc80a0256f5fec97
 SHA512:
-  metadata.gz: ba2ab93435b8078b4697b9f90bb7e189ff70dd12218890b1333a686f57b4ae498a3ee1b8eaf40861ba0b3e16fe3b65068c385f27345999ccf73e1eb78f9238a0
-  data.tar.gz: 6d6f7604d765ca59c5072477c28e29e298dc475d13bf614fcebead4e8612ba1dcd427c9920b536cb0bb9b0046e565f85db1e080918519ccbaab1dfef28d940ea
+  metadata.gz: e8e4b3d39cf8cdf652cdd0001bd1f3238e8f707e51159b3e48a8bf43d8827485684e18734b345a8a793afdb36bdc2fb8fe36437160ee997dc6a04a4647fb1b7b
+  data.tar.gz: c353c880a71f75860f0ffb6e8bfd13360680bdc5f31573abaa12b455194529273498728d9bbbbe48b61ffda62fddf1b7e02ddc93d5e1abb1ca96e0cbd68ae2be

data/.gitlab-ci.yml

@@ -152,7 +152,7 @@ package-and-test:
     include:
       - project: gitlab-org/gitlab
         ref: master
-        file: .gitlab/ci/package-and-test/main.gitlab-ci.yml
+        file: .gitlab/ci/test-on-omnibus/main.gitlab-ci.yml
   rules:
     - if: '$CI_MERGE_REQUEST_IID'
       when: manual

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (14.13.0)
+    gitlab-qa (14.15.0)
       activesupport (>= 6.1, < 7.2)
       gitlab (~> 4.19)
       http (~> 5.0)

data/docs/run_qa_against_gdk.md

@@ -59,6 +59,12 @@ variable.
 export GITLAB_INITIAL_ROOT_PASSWORD="<GDK root password>"
 ```
 
+**Note**: If you encounter the following error, you can resolve it by unsetting the Docker host environment variable using the command `unset DOCKER_HOST`:
+
+```
+ERROR: error during connect: get "http://docker.local:2375/v1.24/images/json": dial tcp: lookup docker.local: no such host
+```
+
 ### Running EE tests
 
 When running EE tests you'll need to have a license available. GitLab engineers can [request a license](https://about.gitlab.com/handbook/developer-onboarding/#working-on-gitlab-ee).

data/docs/what_tests_can_be_run.md

@@ -375,6 +375,30 @@ $ export EE_LICENSE=$(cat /path/to/Geo.gitlab_license)
 $ gitlab-qa Test::Integration::Geo EE
 ```
 
+[test-cvs]: ...
+
+### `Test::Integration::ContinuousVulnerabilityScanning EE|<full image address>`
+
+This tests [Continuous Vulnerability Scanning](https://docs.gitlab.com/ee/user/application_security/continuous_vulnerability_scanning/)
+which is functionality to allow updated vulnerabilities to be downloaded and shown for
+relevant software dependencies.
+
+It is designed to run against a particular end to end spec as per the example.
+
+It is EE functionality and requires a license to be set.
+
+**Required environment variables:**
+
+- `EE_LICENSE`: A valid EE license.
+
+Example:
+
+```shell
+$ export EE_LICENSE=$(cat /path/to/gitlab_license)
+$ export GITLAB_LICENSE_MODE=test
+$ gitlab-qa Test::Integration::ContinuousVulnerabilityScanning EE
+````
+
 [test-geo]: https://gitlab.com/gitlab-org/gitlab-ee/blob/master/qa/qa/ee/scenario/test/geo.rb
 
 ### `Test::Integration::GitalyCluster CE|EE|<full image address>`
@@ -1166,7 +1190,7 @@ Testing import [by direct transfer](https://docs.gitlab.com/ee/user/group/import
 
 ### `AiGateway` Scenarios
 
-The following `AiGateway` scenarios spin up a GitLab Omnibus instance integrated with a test AI Gateway using [fake models](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist#faking-out-ai-models). These scenarios help to verify various configurations of cloud licensing and seat assignment work as expected when authenticating for AI features on self-managed instances.
+The following `AiGateway` scenarios spin up a GitLab Omnibus instance integrated with a test AI Gateway using [mocked models](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist#mocking-ai-model-responses). These scenarios help to verify various configurations of cloud licensing and seat assignment work as expected when authenticating for AI features on self-managed instances.
 
 **Required environment variables:**
 

data/fixtures/cvs/vulnerabilities_template.erb

@@ -0,0 +1,2 @@
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Arbitrary test vulnerability","description":"An arbitrary vulnerability exists for testing. This vulnerability should be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= Date.today.prev_day.iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-12345","value":"CVE-2124-12345","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-12345"},{"type":"ghsa","name":"GHSA-abcd-123e-fg4h","value":"GHSA-abcd-123e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-42","value":"42","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Outdated test vulnerability","description":"An Outdated vulnerability exists for testing. This vulnerability should NOT be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= (Date.today - 15).iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-54321","value":"CVE-2124-54321","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-54321"},{"type":"ghsa","name":"GHSA-abcd-321e-fg4h","value":"GHSA-abcd-321e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-43","value":"43","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}

data/lib/gitlab/qa/component/ai_gateway.rb

@@ -76,6 +76,14 @@ module Gitlab
             -----END PRIVATE KEY-----
           VALIDATION_KEY
 
+        def initialize
+          super
+
+          # These keys are test keys and are safe to be shared, but masking them in logs so they do not raise concern
+          @secrets << TEST_SIGNING_KEY
+          @secrets << TEST_VALIDATION_KEY
+        end
+
         def name
           @name ||= 'ai-gateway'
         end

data/lib/gitlab/qa/component/base.rb

@@ -17,7 +17,8 @@ module Gitlab
           :environment,
           :runner_network,
           :airgapped_network,
-          :additional_hosts
+          :additional_hosts,
+          :secrets
 
         def initialize
           @docker = Docker::Engine.new
@@ -28,6 +29,7 @@ module Gitlab
           @network_aliases = []
           @exec_commands = []
           @additional_hosts = []
+          @secrets = []
         end
 
         def add_network_alias(name)
@@ -109,7 +111,7 @@ module Gitlab
         end
 
         def start # rubocop:disable Metrics/AbcSize
-          docker.run(image: image, tag: tag) do |command|
+          docker.run(image: image, tag: tag, mask_secrets: secrets) do |command|
             command << "-d"
             command << "--name #{name}"
             command << "--net #{network}"

data/lib/gitlab/qa/component/gitlab.rb

@@ -29,8 +29,7 @@ module Gitlab
           :seed_admin_token,
           :seed_db,
           :skip_server_hooks,
-          :gitaly_tls,
-          :secrets
+          :gitaly_tls
 
         attr_writer :name, :relative_path
 
@@ -52,7 +51,6 @@ module Gitlab
           @seed_admin_token = Runtime::Scenario.seed_admin_token
           @seed_db = Runtime::Scenario.seed_db
           @skip_server_hooks = Runtime::Scenario.skip_server_hooks
-          @secrets = []
 
           self.release = 'CE'
         end

data/lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'date'
+require 'erb'
+require 'pathname'
+
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Integration
+          class ContinuousVulnerabilityScanning < Scenario::Template
+            def initialize
+              @network = Runtime::Env.docker_network
+              @tag = 'secure_cvs'
+            end
+
+            def perform(release, *rspec_args)
+              Component::Gitlab.perform do |gitlab|
+                setup_and_run_tests(gitlab, release, *rspec_args)
+              end
+            end
+
+            private
+
+            def setup_and_run_tests(gitlab, release, *rspec_args)
+              set_up_gitlab(gitlab, release)
+              gitlab.instance do
+                place_new_vulnerabilities(gitlab)
+                run_specs(gitlab, *rspec_args)
+              end
+            end
+
+            def set_up_gitlab(gitlab, release)
+              gitlab.release = QA::Release.new(release)
+              gitlab.name = 'gitlab'
+              gitlab.network = @network
+            end
+
+            def place_new_vulnerabilities(gitlab)
+              write_vulnerabilities(gitlab, generate_filepath, generate_vulnerabilities)
+              start_advisory_sync_worker(gitlab)
+            end
+
+            def generate_vulnerabilities
+              template = File.read(File.expand_path('../../../../../../fixtures/cvs/vulnerabilities_template.erb', __dir__))
+              ERB.new(template).result(binding)
+            end
+
+            def generate_filepath
+              File.join(
+                "/opt/gitlab/embedded/service/gitlab-rails/vendor/package_metadata/advisories/v2/rubygem/#{Time.now.to_i}",
+                '000000000.ndjson'
+              )
+            end
+
+            def write_vulnerabilities(gitlab, filepath, content)
+              gitlab.docker.exec(gitlab.name, "mkdir -p #{File.dirname(filepath)}")
+              gitlab.docker.write_files(gitlab.name) { |f| f.write(filepath, content, false) }
+            end
+
+            def start_advisory_sync_worker(gitlab)
+              gitlab.docker.exec(gitlab.name, "PM_SYNC_IN_DEV=true gitlab-rails runner 'loop do PackageMetadata::AdvisoriesSyncWorker.new.perform; sleep 30; end' &")
+            end
+
+            def run_specs(gitlab, *rspec_args)
+              Runtime::Logger.info('Running Continuous Vulnerability Scanning spec...')
+              rspec_args << "--" unless rspec_args.include?('--')
+              rspec_args << "--tag" << @tag
+              run_spec_component(gitlab, rspec_args)
+            end
+
+            def run_spec_component(gitlab, rspec_args)
+              Component::Specs.perform do |specs|
+                specs.suite = 'Test::Instance::All'
+                specs.release = gitlab.release
+                specs.network = gitlab.network
+                specs.args = [gitlab.address, *rspec_args]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '14.13.0'
+    VERSION = '14.15.0'
   end
 end

data/support/data/admin_access_token_seed.rb

@@ -18,6 +18,7 @@ class AdminAccessTokenSeed
 
     admin_user.personal_access_tokens.build(token_params).tap do |pat|
       pat.set_token(TOKEN_VALUE)
+      pat.organization = Organizations::Organization.default_organization if Gitlab.version_info >= Gitlab::VersionInfo.new(17, 4)
       pat.save!
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 14.13.0
+  version: 14.15.0
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-07-18 00:00:00.000000000 Z
+date: 2024-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -376,6 +376,7 @@ files:
 - docs/waits.md
 - docs/what_tests_can_be_run.md
 - exe/gitlab-qa
+- fixtures/cvs/vulnerabilities_template.erb
 - fixtures/ldap/1_add_nodes.ldif
 - fixtures/ldap/2_add_users.ldif
 - fixtures/ldap/3_add_groups.ldif
@@ -450,6 +451,7 @@ files:
 - lib/gitlab/qa/scenario/test/integration/ai_gateway_no_seat_assigned.rb
 - lib/gitlab/qa/scenario/test/integration/chaos.rb
 - lib/gitlab/qa/scenario/test/integration/client_ssl.rb
+- lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb
 - lib/gitlab/qa/scenario/test/integration/elasticsearch.rb
 - lib/gitlab/qa/scenario/test/integration/geo.rb
 - lib/gitlab/qa/scenario/test/integration/gitaly_cluster.rb