Proposal: Do not use LLM in X-Ray scanner to get libraries descriptions

This the extension of Allen's idea raised in this comment with some additional thoughts described here.

The idea is to make X-Ray to only scan list of dependencies and upload them to GitLab monolith. Then the monolith will request LLM to get the list of descriptions and store them in the database.

That provides several improvements:

  • X-Ray scan will be very fast, so fast that it won't use a lot of CI minutes. My assumption it will take a couple of seconds to run. And we might avoit optimisations in this area.
  • X-Ray won't need to spend LLM's tokens.
  • We can control on Rails side whether we need to call LLM for to get libraries descriptions or not. The monolith can check the provided checksum and only request LLM when it was changed.