<details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=609285) </details>  ## Summary Roll out [the feature](https://gitlab.com/groups/gitlab-org/-/epics/22064) currently behind the `vulnerability_ascp_security_context` feature flag. - DRI: @dpisek - Team Slack channel: `#g_security-insights` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? The flag gates read-only rendering of the matched ASCP component's security context in the Risk panel of the vulnerability details page. It does not write any data. The blast radius is limited to vulnerability details pages in projects where a finding has a matched ASCP component; the worst case is a rendering issue on that page. Disabling the flag restores the current behavior. ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_security-insights`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set vulnerability_ascp_security_context 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set vulnerability_ascp_security_context true --dev --pre --staging --staging-ref ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set vulnerability_ascp_security_context <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss vulnerability_ascp_security_context true /chatops gitlab run feature set --group=gitlab-org,gitlab-com vulnerability_ascp_security_context true /chatops gitlab run feature set --user=dpisek vulnerability_ascp_security_context true ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249077 19.3 /chatops gitlab run feature delete vulnerability_ascp_security_context --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set vulnerability_ascp_security_context false # production /chatops gitlab run feature set vulnerability_ascp_security_context false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete vulnerability_ascp_security_context --dev --pre --staging --staging-ref --production # remove entirely ```