Merge branch '35860-notify-user-when-a-vulnerability-is-resolved' into 'master'

Add #resolved_on_default_branch to Vulnerability

See merge request gitlab-org/gitlab!26906

ee/app/models/vulnerability.rb

@@ -60,6 +60,8 @@ class Vulnerability < ApplicationRecord
   scope :with_severities, -> (severities) { where(severity: severities) }
   scope :with_states, -> (states) { where(state: states) }
 
+  delegate :default_branch, to: :project, prefix: :project
+
   # There will only be one finding associated with a vulnerability for the foreseeable future
   def finding
     findings.first
@@ -70,4 +72,12 @@ class Vulnerability < ApplicationRecord
   def self.parent_class
     ::Project
   end
+
+  def resolved_on_default_branch
+    return false unless findings.any?
+
+    latest_successful_pipeline_for_default_branch = project.latest_successful_pipeline_for_default_branch
+    latest_pipeline_with_vulnerability = finding.pipelines.order(created_at: :desc).first
+    latest_pipeline_with_vulnerability != latest_successful_pipeline_for_default_branch
+  end
 end

ee/changelogs/unreleased/35860-notify-user-when-a-vulnerability-is-resolved.yml

+---
+title: 'Add #resolved_on_default_branch to Vulnerability'
+merge_request: 26906
+author:
+type: added

ee/lib/ee/api/entities/vulnerability.rb

@@ -16,6 +16,8 @@ module EE
         expose :project, using: ::API::Entities::ProjectIdentity
 
         expose :finding
+        expose :resolved_on_default_branch
+        expose :project_default_branch
 
         expose :author_id
         expose :updated_by_id

ee/spec/models/vulnerability_spec.rb

@@ -171,4 +171,37 @@ describe Vulnerability do
 
     it { is_expected.to eq(finding.scanner_name) }
   end
+
+  describe '#project_default_branch' do
+    let_it_be(:project) { create(:project, :repository, :with_vulnerabilities) }
+    let_it_be(:vulnerability) { project.vulnerabilities.first }
+
+    subject { vulnerability.project_default_branch }
+
+    it { is_expected.to eq("master") }
+  end
+
+  describe '#resolved_on_default_branch' do
+    let_it_be(:project) { create(:project, :repository, :with_vulnerabilities) }
+    let_it_be(:pipeline_with_vulnerability) { create(:ci_pipeline, :success, project: project, sha: project.commit.id) }
+    let_it_be(:vulnerability) { project.vulnerabilities.first }
+    let_it_be(:finding1) { create(:vulnerabilities_occurrence, vulnerability: vulnerability, pipelines: [pipeline_with_vulnerability]) }
+    let_it_be(:finding2) { create(:vulnerabilities_occurrence, vulnerability: vulnerability, pipelines: [pipeline_with_vulnerability]) }
+
+    subject { vulnerability.resolved_on_default_branch }
+
+    context 'Vulnerability::Occurrence is present on the pipeline for default branch' do
+      it { is_expected.to eq(false) }
+    end
+
+    context 'Vulnerability::Occurrence is not present on the pipeline for default branch' do
+      before do
+        project.instance_variable_set(:@latest_successful_pipeline_for_default_branch, pipeline_without_vulnerability)
+      end
+
+      let_it_be(:pipeline_without_vulnerability) { create(:ci_pipeline, :success, project: project, sha: project.commit.id) }
+
+      it { is_expected.to eq(true) }
+    end
+  end
 end