ROX-35762: Add CISA KEV UI display and policy criteria

[ajheflin]

Description

Wire CISA KEV data through the UI and add policy criteria support. PR 4/4 in a stack.

• Wire exploit { knownRansomwareCampaignUse } into all WorkloadCves GraphQL fragments so the existing KnownExploitLabel and KnownRansomwareCampaignLabel components (merged in ROX-31903: Add ROX_CISA_KEV in WorkloadCves #17901) receive data
• Add Go-side boolean policy field (CISA KEV) following the Fixable pattern: field name, query builder, field metadata, violation message printer
• Add UI policy criteria descriptor (radioGroup type) under Image Scanning, gated behind ROX_CISA_KEV

Stack: [Proto changes] → [Converter wiring] → [Reporting] → 4/4 — UI + Policy

Depends on: #21752

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• modified existing tests

How I validated my change

• Go policy tests pass: go test ./pkg/booleanpolicy/... -count=1
• GraphQL fragments only add fields to existing template literals — no TypeScript logic changed
• Policy criteria descriptor follows the established Fixable radioGroup pattern

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

🚀 Build Images Ready

Images are ready for commit 491e43a. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.0.x-23-g491e43af31

[codecov]

Codecov Report

❌ Patch coverage is 25.00000% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.27%. Comparing base (9ec768f) to head (491e43a).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/booleanpolicy/querybuilders/special_cases.go	0.00%	6 Missing ⚠️
pkg/booleanpolicy/field_metadata.go	50.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22103      +/-   ##
==========================================
- Coverage   51.31%   51.27%   -0.05%     
==========================================
  Files        2858     2858              
  Lines      179015   179047      +32     
==========================================
- Hits        91865    91801      -64     
- Misses      79082    79156      +74     
- Partials     8068     8090      +22     

Flag	Coverage Δ
go-unit-tests	51.27% <25.00%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c4c9e512-f695-475a-b83f-99e6dbc3c4cc

📥 Commits

Reviewing files that changed from the base of the PR and between 3fd2182 and 491e43a.

📒 Files selected for processing (10)

• pkg/booleanpolicy/field_metadata.go
• pkg/booleanpolicy/fieldnames/list.go
• pkg/booleanpolicy/querybuilders/special_cases.go
• pkg/booleanpolicy/violationmessages/printer.go
• ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.test.ts
• ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.tsx
• ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/ImageCve/ImageCvePage.tsx
• ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/DeploymentVulnerabilitiesTable.tsx
• ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/ImageVulnerabilitiesTable.tsx
• ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/WorkloadCVEOverviewTable.tsx

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added a CISA KEV policy criterion for identifying CVEs included in or absent from the CISA Known Exploited Vulnerabilities catalog.
  • Available across build, deploy, and runtime policy stages when enabled.
  • Added ransomware campaign usage details to vulnerability data displayed in CVE views and tables.

Walkthrough

Changes

CISA KEV policy

Layer / File(s)	Summary
CISA KEV policy backend pkg/booleanpolicy/...	Registers the CisaKev field, query builder, search mapping, validation, and violation-message printer.
CISA KEV policy wizard descriptor ui/apps/platform/src/Containers/Policies/Wizard/Step3/policyCriteriaDescriptors.*	Adds feature-gated catalog membership options for BUILD, DEPLOY, and RUNTIME stages. Updates sentence-case allowlists.

CVE exploit metadata

Layer / File(s)	Summary
CVE exploit metadata queries ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/...	Adds knownRansomwareCampaignUse to image and workload CVE queries and removes obsolete comments.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 491e4

This change adds CISA KEV vulnerability display and feature-gated policy criteria without any supplied evidence of a current correctness or production issue; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: alanonthegit, alexvulaj

Sequence Diagram(s)

sequenceDiagram
  participant PolicyWizard
  participant BooleanPolicy
  participant ForCisaKev
  participant Search
  PolicyWizard->>BooleanPolicy: Submit CISA KEV criterion
  BooleanPolicy->>ForCisaKev: Build vulnerability query
  ForCisaKev->>Search: Map value to search.CisaKev

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 10 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the issue and summarizes the main UI and policy criteria changes.
Description check	✅ Passed	The description covers the required sections, explains the changes, records documentation and feature-flag status, and describes validation; CI inspection is unchecked.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rox-34928/ui-and-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@ajheflin: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/gke-nongroovy-e2e-tests	491e43a	link	true	/test gke-nongroovy-e2e-tests
ci/prow/gke-qa-e2e-tests	491e43a	link	false	/test gke-qa-e2e-tests
ci/prow/ocp-4-22-ui-e2e-tests	491e43a	link	false	/test ocp-4-22-ui-e2e-tests
ci/prow/ocp-4-12-qa-e2e-tests	491e43a	link	false	/test ocp-4-12-qa-e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.