ee/spec/factories/security/ingestion/finding_maps.rb

+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :finding_map, class: '::Security::Ingestion::FindingMap' do
+    security_finding
+    report_finding factory: :ci_reports_security_finding
+
+    trait :with_finding do
+      finding factory: :vulnerabilities_finding
+    end
+
+    trait :new_record do
+      with_finding
+
+      new_record { true }
+      vulnerability factory: :vulnerability
+    end
+
+    initialize_with do
+      ::Security::Ingestion::FindingMap.new(*attributes.values_at(:security_finding, :report_finding)).tap do |object|
+        object.finding_id = attributes[:finding]&.id
+        object.vulnerability_id = attributes[:vulnerability]&.id
+        object.new_record = attributes[:new_record]
+        object.identifier_ids = attributes[:identifier_ids].to_a
+      end
+    end
+
+    skip_create
+  end
+end

ee/spec/factories/security_scans.rb

@@ -6,5 +6,9 @@
     build factory: [:ci_build, :success]
     pipeline { build.pipeline }
     project { build.project }
+
+    trait :with_error do
+      info { { errors: [{ type: 'ParsingError', message: 'Unknown error happened' }] } }
+    end
   end
 end

ee/spec/features/epics/epics_list_spec.rb

@@ -12,7 +12,6 @@
   before do
     stub_licensed_features(epics: true)
     stub_feature_flags(unfiltered_epic_aggregates: false)
-    stub_feature_flags(async_filtering: false)
     stub_feature_flags(vue_epics_list: false)
 
     sign_in(user)
@@ -127,42 +126,6 @@
       expect(page).to have_button('Last updated')
     end
 
-    it 'sorts by the selected value and stores the selection for roadmap' do
-      visit group_roadmap_path(group)
-
-      page.within('.epics-other-filters') do
-        click_button 'Start date'
-        sort_options = find('ul.dropdown-menu-sort li').all('a').collect(&:text)
-
-        expect(sort_options[0]).to eq('Start date')
-        expect(sort_options[1]).to eq('Due date')
-
-        click_link 'Due date'
-      end
-
-      expect(page).to have_button('Due date')
-
-      page.within('.content-wrapper .content') do
-        page.within('.epics-list-section') do
-          page.within('div.epic-item-container:nth-child(1) div.epics-list-item') do
-            expect(page).to have_content(epic1.title)
-          end
-
-          page.within('div.epic-item-container:nth-child(2) div.epics-list-item') do
-            expect(page).to have_content(epic3.title)
-          end
-
-          page.within('div.epic-item-container:nth-child(3) div.epics-list-item') do
-            expect(page).to have_content(epic2.title)
-          end
-        end
-      end
-
-      visit group_roadmap_path(group)
-
-      expect(page).to have_button('Due date')
-    end
-
     it 'renders the epic detail correctly after clicking the link' do
       page.within('.content-wrapper .content .issuable-list') do
         click_link(epic1.title)

ee/spec/features/groups/group_roadmap_spec.rb

@@ -10,30 +10,34 @@
   let(:user_dev) { create(:user) }
   let(:group) { create(:group) }
   let(:milestone) { create(:milestone, group: group) }
-  let(:filtered_search) { find('.filtered-search') }
-  let(:js_dropdown_label) { '#js-dropdown-label' }
-  let(:filter_dropdown) { find("#{js_dropdown_label} .filter-dropdown") }
   let(:state_dropdown) { find('.dropdown-epics-state') }
 
   let!(:bug_label) { create(:group_label, group: group, title: 'Bug') }
   let!(:critical_label) { create(:group_label, group: group, title: 'Critical') }
 
   def search_for_label(label)
-    init_label_search
-    filter_dropdown.find('.filter-dropdown-item', text: bug_label.title).click
-    filtered_search.send_keys(:enter)
+    page.within('.vue-filtered-search-bar-container .gl-search-box-by-click') do
+      page.find('input.gl-filtered-search-term-input').click
+      click_link 'Label'
+      page.first('.gl-filtered-search-suggestion-list .gl-filtered-search-suggestion').click # Select `=` operator
+      wait_for_requests
+      page.find('.gl-filtered-search-suggestion-list .gl-filtered-search-suggestion', text: bug_label.title).click
+    end
+    page.find('.gl-search-box-by-click-search-button').click
   end
 
   before do
     stub_licensed_features(epics: true)
     stub_feature_flags(unfiltered_epic_aggregates: false)
-    stub_feature_flags(async_filtering: false)
     stub_feature_flags(performance_roadmap: false)
+    stub_feature_flags(roadmap_daterange_filter: false)
 
     sign_in(user)
   end
 
   context 'when epics exist for the group' do
+    available_tokens = %w[Author Label Milestone Epic My-Reaction]
+
     let!(:epic_with_bug) { create(:labeled_epic, group: group, start_date: 10.days.ago, end_date: 1.day.ago, labels: [bug_label]) }
     let!(:epic_with_critical) { create(:labeled_epic, group: group, start_date: 20.days.ago, end_date: 2.days.ago, labels: [critical_label]) }
     let!(:closed_epic) { create(:epic, :closed, group: group, start_date: 20.days.ago, end_date: 2.days.ago) }
@@ -45,25 +49,25 @@ def search_for_label(label)
 
     describe 'roadmap page' do
       it 'renders roadmap preset buttons correctly' do
-        page.within('.js-btn-roadmap-presets') do
-          expect(page).to have_css('.btn-roadmap-preset input[value="QUARTERS"]')
-          expect(page).to have_css('.btn-roadmap-preset input[value="MONTHS"]')
-          expect(page).to have_css('.btn-roadmap-preset input[value="WEEKS"]')
+        page.within('.gl-segmented-control') do
+          expect(page).to have_css('input[value="QUARTERS"]')
+          expect(page).to have_css('input[value="MONTHS"]')
+          expect(page).to have_css('input[value="WEEKS"]')
         end
       end
 
       it 'renders the filtered search bar correctly' do
         page.within('.content-wrapper .content .epics-filters') do
-          expect(page).to have_css('.filtered-search-box')
+          expect(page).to have_css('.vue-filtered-search-bar-container')
         end
       end
 
       it 'renders the sort dropdown correctly' do
-        page.within('.content-wrapper .content .epics-other-filters') do
-          expect(page).to have_css('.filter-dropdown-container')
-          find('.epics-sort-btn').click
-          page.within('.dropdown-menu') do
-            expect(page).to have_selector('li a', count: 3)
+        page.within('.vue-filtered-search-bar-container') do
+          expect(page).to have_css('.sort-dropdown-container')
+          find('.sort-dropdown-container .dropdown-toggle').click
+          page.within('.sort-dropdown-container .dropdown-menu') do
+            expect(page).to have_selector('li button', count: 2)
             expect(page).to have_content('Start date')
             expect(page).to have_content('Due date')
           end
@@ -89,7 +93,7 @@ def search_for_label(label)
       end
 
       it 'renders open epics only' do
-        state_dropdown.find('a', text: 'Open epics').click
+        state_dropdown.find('button', text: 'Open epics').click
 
         page.within('.roadmap-container .epics-list-section') do
           expect(page).to have_selector('.epics-list-item .epic-title', count: 2)
@@ -97,16 +101,17 @@ def search_for_label(label)
       end
 
       it 'renders closed epics only' do
-        state_dropdown.find('a', text: 'Closed epics').click
+        state_dropdown.find('button', text: 'Closed epics').click
 
         page.within('.roadmap-container .epics-list-section') do
           expect(page).to have_selector('.epics-list-item .epic-title', count: 1)
         end
       end
 
-      it 'saves last selected epic state' do
-        state_dropdown.find('a', text: 'Open epics').click
+      it 'saves last selected epic state', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/341827' do
+        state_dropdown.find('button', text: 'Open epics').click
 
+        wait_for_all_requests
         visit group_roadmap_path(group)
         wait_for_requests
 
@@ -123,7 +128,7 @@ def search_for_label(label)
       end
 
       it 'renders filtered search bar with applied filter token' do
-        expect_tokens([label_token(bug_label.title)])
+        expect_vue_tokens([label_token(bug_label.title)])
       end
 
       it 'renders roadmap view with matching epic' do
@@ -135,7 +140,7 @@ def search_for_label(label)
 
       it 'keeps label filter when filtering by state' do
         state_dropdown.find('.dropdown-toggle').click
-        state_dropdown.find('a', text: 'Open epics').click
+        state_dropdown.find('button', text: 'Open epics').click
 
         page.within('.roadmap-container .epics-list-section') do
           expect(page).to have_selector('.epics-list-item .epic-title', count: 1)
@@ -143,6 +148,35 @@ def search_for_label(label)
         end
       end
     end
+
+    describe 'filtered search tokens' do
+      let!(:epic1) { create(:epic, group: group, end_date: 10.days.ago) }
+      let!(:epic2) { create(:epic, group: group, start_date: 2.days.ago) }
+      let!(:award_emoji_star) { create(:award_emoji, name: 'star', user: user, awardable: epic1) }
+
+      before do
+        group.add_developer(user_dev)
+        visit group_roadmap_path(group)
+        wait_for_requests
+      end
+
+      it_behaves_like 'filtered search bar', available_tokens
+    end
+
+    describe 'that is a sub-group' do
+      let!(:subgroup) { create(:group, parent: group, name: 'subgroup') }
+      let!(:sub_epic1) { create(:epic, group: subgroup, end_date: 10.days.ago) }
+      let!(:sub_epic2) { create(:epic, group: subgroup, start_date: 2.days.ago) }
+      let!(:award_emoji_star) { create(:award_emoji, name: 'star', user: user, awardable: sub_epic1) }
+
+      before do
+        subgroup.add_developer(user_dev)
+        visit group_roadmap_path(subgroup)
+        wait_for_requests
+      end
+
+      it_behaves_like 'filtered search bar', available_tokens
+    end
   end
 
   context 'when no epics exist for the group' do
@@ -193,41 +227,4 @@ def search_for_label(label)
       end
     end
   end
-
-  context 'async filtered search' do
-    available_tokens = %w[Author Label Milestone Epic My-Reaction]
-
-    before do
-      stub_feature_flags(async_filtering: true)
-    end
-
-    describe 'within a group' do
-      let!(:epic1) { create(:epic, group: group, end_date: 10.days.ago) }
-      let!(:epic2) { create(:epic, group: group, start_date: 2.days.ago) }
-      let!(:award_emoji_star) { create(:award_emoji, name: 'star', user: user, awardable: epic1) }
-
-      before do
-        group.add_developer(user_dev)
-        visit group_roadmap_path(group)
-        wait_for_requests
-      end
-
-      it_behaves_like 'filtered search bar', available_tokens
-    end
-
-    describe 'within a sub-group group' do
-      let!(:subgroup) { create(:group, parent: group, name: 'subgroup') }
-      let!(:sub_epic1) { create(:epic, group: subgroup, end_date: 10.days.ago) }
-      let!(:sub_epic2) { create(:epic, group: subgroup, start_date: 2.days.ago) }
-      let!(:award_emoji_star) { create(:award_emoji, name: 'star', user: user, awardable: sub_epic1) }
-
-      before do
-        subgroup.add_developer(user_dev)
-        visit group_roadmap_path(subgroup)
-        wait_for_requests
-      end
-
-      it_behaves_like 'filtered search bar', available_tokens
-    end
-  end
 end

ee/spec/frontend/roadmap/components/roadmap_app_spec.js

@@ -45,7 +45,6 @@ describe('RoadmapApp', () => {
         presetType,
       },
       provide: {
-        glFeatures: { asyncFiltering: true },
         groupFullPath: 'gitlab-org',
         groupMilestonesPath: '/groups/gitlab-org/-/milestones.json',
         listEpicsPath: '/groups/gitlab-org/-/epics',

ee/spec/models/security/scan_spec.rb

@@ -106,6 +106,75 @@
     it { is_expected.to match_array(expected_scans) }
   end
 
+  describe '.without_errors' do
+    let(:scan_1) { create(:security_scan, :with_error) }
+    let(:scan_2) { create(:security_scan) }
+
+    subject { described_class.without_errors }
+
+    it { is_expected.to contain_exactly(scan_2) }
+  end
+
+  describe '.latest' do
+    let!(:latest_scan) { create(:security_scan, latest: true) }
+    let!(:retried_scan) { create(:security_scan, latest: false) }
+
+    subject { described_class.latest }
+
+    it { is_expected.to match_array([latest_scan]) }
+  end
+
+  describe '#report_findings' do
+    let(:artifact) { create(:ee_ci_job_artifact, :dast) }
+    let(:scan) { create(:security_scan, build: artifact.job) }
+    let(:artifact_finding_uuids) { artifact.security_report.findings.map(&:uuid) }
+
+    subject { scan.report_findings.map(&:uuid) }
+
+    it { is_expected.to match_array(artifact_finding_uuids) }
+  end
+
+  describe '#processing_errors' do
+    let(:scan) { build(:security_scan, :with_error) }
+
+    subject { scan.processing_errors }
+
+    it { is_expected.to eq([{ 'type' => 'ParsingError', 'message' => 'Unknown error happened' }]) }
+  end
+
+  describe '#processing_errors=' do
+    let(:scan) { create(:security_scan) }
+
+    subject(:set_processing_errors) { scan.processing_errors = [:foo] }
+
+    it 'sets the processing errors' do
+      expect { set_processing_errors }.to change { scan.info['errors'] }.from(nil).to([:foo])
+    end
+  end
+
+  describe '#add_processing_error!' do
+    let(:error) { { type: 'foo', message: 'bar' } }
+
+    subject(:add_processing_error) { scan.add_processing_error!(error) }
+
+    context 'when the scan does not have any errors' do
+      let(:scan) { create(:security_scan) }
+
+      it 'persists the error' do
+        expect { add_processing_error }.to change { scan.reload.info['errors'] }.from(nil).to([{ 'type' => 'foo', 'message' => 'bar' }])
+      end
+    end
+
+    context 'when the scan already has some errors' do
+      let(:scan) { create(:security_scan, :with_error) }
+
+      it 'persists the new error with the existing ones' do
+        expect { add_processing_error }.to change { scan.reload.info['errors'] }.from([{ 'type' => 'ParsingError', 'message' => 'Unknown error happened' }])
+                                                                                .to([{ 'type' => 'ParsingError', 'message' => 'Unknown error happened' }, { 'type' => 'foo', 'message' => 'bar' }])
+      end
+    end
+  end
+
   it_behaves_like 'having unique enum values'
 
   it 'sets `project_id` and `pipeline_id` before save' do

ee/spec/models/vulnerabilities/feedback_spec.rb

@@ -159,6 +159,15 @@
     end
   end
 
+  describe '.by_finding_uuid' do
+    let(:feedback_1) { create(:vulnerability_feedback) }
+    let(:feedback_2) { create(:vulnerability_feedback) }
+
+    subject { described_class.by_finding_uuid([feedback_2.finding_uuid]) }
+
+    it { is_expected.to eq([feedback_2]) }
+  end
+
   describe '.with_category' do
     it 'filters by category' do
       described_class.categories.each do |category, _|

ee/spec/models/vulnerabilities/finding_remediation_spec.rb

@@ -5,4 +5,13 @@
 RSpec.describe Vulnerabilities::FindingRemediation do
   it { is_expected.to belong_to(:finding).class_name('Vulnerabilities::Finding').required }
   it { is_expected.to belong_to(:remediation).class_name('Vulnerabilities::Remediation').required }
+
+  describe '.by_finding_id' do
+    let(:finding_1) { create(:vulnerabilities_finding) }
+    let!(:remediation) { create(:vulnerabilities_remediation, findings: [finding_1]) }
+
+    subject { described_class.by_finding_id(finding_1.id) }
+
+    it { is_expected.to eq(remediation.finding_remediations) }
+  end
 end

ee/spec/services/security/ingestion/finding_map_collection_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::FindingMapCollection do
+  describe '#each_slice' do
+    let(:security_scan) { create(:security_scan) }
+    let(:security_findings) { create_list(:security_finding, 3, scan: security_scan, deduplicated: true) }
+    let(:report_findings) { [] }
+    let(:finding_map_collection) { described_class.new(security_scan) }
+    let(:finding_maps) { [] }
+    let(:finding_pairs) { finding_maps.map { |finding_map| [finding_map.security_finding, finding_map.report_finding] } }
+    let(:test_block) { proc { |slice| finding_maps.concat(slice) } }
+    let(:expected_finding_pairs) do
+      [
+        [security_findings[0], report_findings[0]],
+        [security_findings[1], report_findings[1]],
+        [security_findings[2], report_findings[2]]
+      ]
+    end
+
+    before do
+      create(:security_finding, scan: security_scan, deduplicated: false)
+
+      security_findings.each { |security_finding| report_findings << create(:ci_reports_security_finding, uuid: security_finding.uuid) }
+
+      allow(security_scan).to receive(:report_findings).and_return(report_findings)
+      allow(finding_maps).to receive(:concat).and_call_original
+    end
+
+    context 'when the size argument given' do
+      subject(:run_each_slice) { finding_map_collection.each_slice(1, &test_block) }
+
+      it 'calls the given block for each slice by the given size argument' do
+        run_each_slice
+
+        expect(finding_maps).to have_received(:concat).exactly(3).times
+        expect(finding_pairs).to match_array(expected_finding_pairs)
+      end
+    end
+  end
+end

ee/spec/services/security/ingestion/finding_map_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::FindingMap do
+  let(:security_finding) { build(:security_finding) }
+  let(:identifier) { build(:ci_reports_security_identifier) }
+  let(:report_finding) { build(:ci_reports_security_finding, identifiers: [identifier]) }
+  let(:finding_map) { build(:finding_map, security_finding: security_finding, report_finding: report_finding) }
+
+  describe '#uuid' do
+    subject { finding_map }
+
+    it { is_expected.to delegate_method(:uuid).to(:security_finding) }
+  end
+
+  describe '#identifiers' do
+    subject { finding_map.identifiers }
+
+    it { is_expected.to eq([identifier]) }
+  end
+
+  describe '#set_identifier_ids_by' do
+    let(:identifiers_map) { { identifier.fingerprint => 1 } }
+
+    subject(:set_idenrifier_ids) { finding_map.set_identifier_ids_by(identifiers_map) }
+
+    it 'changes the identifier_ids of the finding_map' do
+      expect { set_idenrifier_ids }.to change { finding_map.identifier_ids }.from([]).to([1])
+    end
+  end
+
+  describe '#to_hash' do
+    let(:expected_hash) do
+      {
+        uuid: security_finding.uuid,
+        scanner_id: security_finding.scanner_id,
+        primary_identifier_id: nil,
+        location_fingerprint: report_finding.location.fingerprint,
+        project_fingerprint: report_finding.project_fingerprint,
+        name: 'Cipher with no integrity',
+        report_type: :sast,
+        severity: :high,
+        confidence: :medium,
+        metadata_version: 'sast:1.0',
+        details: {},
+        raw_metadata: report_finding.raw_metadata,
+        description: 'The cipher does not provide data integrity update 1',
+        solution: 'GCM mode introduces an HMAC into the resulting encrypted data, providing integrity of the result.',
+        message: nil,
+        cve: nil,
+        location: {
+          "class" => "com.gitlab.security_products.tests.App",
+          "end_line" => 29,
+          "file" => "maven/src/main/java/com/gitlab/security_products/tests/App.java",
+          "method" => "insecureCypher",
+          "start_line" => 29
+        }
+      }
+    end
+
+    subject { finding_map.to_hash }
+
+    it { is_expected.to eq(expected_hash) }
+  end
+end

ee/spec/services/security/ingestion/ingest_report_service_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::IngestReportService do
+  let(:service_object) { described_class.new(security_scan) }
+
+  describe '#execute' do
+    let(:security_scan) { create(:security_scan, scan_type: :sast) }
+
+    subject(:ingest_report) { service_object.execute }
+
+    before do
+      create_list(:security_finding, 2, scan: security_scan, deduplicated: true)
+
+      stub_const("#{described_class}::BATCH_SIZE", 1)
+
+      allow(Security::Ingestion::FindingMapCollection).to receive(:new).with(security_scan).and_return([:foo, :bar])
+      allow(Security::Ingestion::IngestReportSliceService).to receive(:execute).with(security_scan.pipeline, [:foo]).and_return([1])
+      allow(Security::Ingestion::IngestReportSliceService).to receive(:execute).with(security_scan.pipeline, [:bar]).and_return([2])
+    end
+
+    it 'calls IngestReportSliceService for each slice of findings and accumulates the return values' do
+      expect(ingest_report).to eq([1, 2])
+
+      expect(Security::Ingestion::IngestReportSliceService).to have_received(:execute).twice
+    end
+
+    context 'when ingesting a slice of vulnerabilities fails' do
+      let(:exception) { RuntimeError.new }
+      let(:expected_processing_error) { { 'type' => 'IngestionError', 'message' => 'Ingestion failed for some vulnerabilities' } }
+
+      before do
+        allow(Security::Ingestion::IngestReportSliceService).to receive(:execute).with(security_scan.pipeline, [:foo]).and_raise(exception)
+        allow(Gitlab::ErrorTracking).to receive(:track_exception)
+      end
+
+      it 'tracks the exception' do
+        ingest_report
+
+        expect(Gitlab::ErrorTracking).to have_received(:track_exception).with(exception)
+      end
+
+      it 'captures the error and sets the processing error for security scan record' do
+        expect { ingest_report }.to change { security_scan.processing_errors }.from([]).to([expected_processing_error])
+      end
+
+      it 'accumulates the return value of only the succeeded executions' do
+        expect(ingest_report).to eq([2])
+      end
+    end
+  end
+end

ee/spec/services/security/ingestion/ingest_report_slice_service_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::IngestReportSliceService do
+  let(:service_object) { described_class.new(pipeline, finding_maps) }
+  let(:pipeline) { create(:ci_pipeline) }
+  let(:finding_maps) { [create(:finding_map)] }
+
+  describe '#execute' do
+    subject(:ingest_report_slice) { service_object.execute }
+
+    before do
+      described_class::TASKS.each do |task_name|
+        task = Object.const_get("Security::Ingestion::Tasks::#{task_name}", false)
+
+        allow(task).to receive(:execute)
+      end
+    end
+
+    it 'runs the series of tasks in correct order' do
+      ingest_report_slice
+
+      expect(Security::Ingestion::Tasks::IngestIdentifiers).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestFindings).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestVulnerabilities).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::AttachFindingsToVulnerabilities).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestFindingPipelines).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestFindingIdentifiers).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestFindingLinks).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestFindingSignatures).to have_received(:execute).ordered.with(pipeline, finding_maps)
+      expect(Security::Ingestion::Tasks::IngestRemediations).to have_received(:execute).ordered.with(pipeline, finding_maps)
+    end
+
+    context 'when an exception happens' do
+      let(:mock_task_1) { double(:task) }
+      let(:mock_task_2) { double(:task) }
+
+      before do
+        allow(mock_task_1).to receive(:execute) { |pipeline, *| pipeline.update_column(:updated_at, 3.months.from_now) }
+        allow(mock_task_2).to receive(:execute) { raise 'foo' }
+
+        allow(Security::Ingestion::Tasks).to receive(:const_get).with(:IngestIdentifiers, false).and_return(mock_task_1)
+        allow(Security::Ingestion::Tasks).to receive(:const_get).with(:IngestFindings, false).and_return(mock_task_2)
+      end
+
+      it 'rollsback the recent changes to not to leave the database in an inconsistent state' do
+        expect { ingest_report_slice }.to raise_error('foo')
+                                      .and not_change { pipeline.reload.updated_at }
+      end
+    end
+  end
+end

ee/spec/services/security/ingestion/ingest_reports_service_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::IngestReportsService do
+  let(:service_object) { described_class.new(pipeline) }
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:pipeline) { create(:ci_pipeline, project: project) }
+  let_it_be(:build) { create(:ci_build, pipeline: pipeline) }
+  let_it_be(:security_scan_1) { create(:security_scan, build: build, scan_type: :sast) }
+  let_it_be(:security_scan_2) { create(:security_scan, :with_error, build: build, scan_type: :dast) }
+  let_it_be(:security_scan_3) { create(:security_scan, build: build, scan_type: :secret_detection) }
+  let_it_be(:vulnerability_1) { create(:vulnerability, project: pipeline.project) }
+  let_it_be(:vulnerability_2) { create(:vulnerability, project: pipeline.project) }
+
+  describe '#execute' do
+    let(:ids_1) { [vulnerability_1.id] }
+    let(:ids_2) { [] }
+
+    subject(:ingest_reports) { service_object.execute }
+
+    before do
+      allow(Security::Ingestion::IngestReportService).to receive(:execute).and_return(ids_1, ids_2)
+    end
+
+    it 'calls IngestReportService for each succeeded security scan' do
+      ingest_reports
+
+      expect(Security::Ingestion::IngestReportService).to have_received(:execute).twice
+      expect(Security::Ingestion::IngestReportService).to have_received(:execute).once.with(security_scan_1)
+      expect(Security::Ingestion::IngestReportService).to have_received(:execute).once.with(security_scan_3)
+    end
+
+    it 'sets the resolved vulnerabilities, latest pipeline ID and has_vulnerabilities flag' do
+      expect { ingest_reports }.to change { project.reload.project_setting&.has_vulnerabilities }.to(true)
+                               .and change { project.reload.vulnerability_statistic&.latest_pipeline_id }.to(pipeline.id)
+                               .and change { vulnerability_2.reload.resolved_on_default_branch }.from(false).to(true)
+                               .and not_change { vulnerability_1.reload.resolved_on_default_branch }.from(false)
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/attach_findings_to_vulnerabilities_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::AttachFindingsToVulnerabilities do
+  describe '#execute' do
+    let(:pipeline) { create(:ci_pipeline) }
+    let(:finding_maps) { create_list(:finding_map, 3, :new_record) }
+    let(:service_object) { described_class.new(pipeline, finding_maps) }
+    let(:finding_1) { Vulnerabilities::Finding.find(finding_maps.first.finding_id) }
+    let(:finding_2) { Vulnerabilities::Finding.find(finding_maps.second.finding_id) }
+    let(:finding_3) { Vulnerabilities::Finding.find(finding_maps.third.finding_id) }
+    let(:vulnerability_id_1) { finding_maps.first.vulnerability_id }
+    let(:vulnerability_id_2) { finding_maps.second.vulnerability_id }
+    let(:vulnerability_id_3) { finding_maps.third.vulnerability_id }
+
+    subject(:attach_findings_to_vulnerabilities) { service_object.execute }
+
+    before do
+      finding_maps.third.new_record = false
+    end
+
+    it 'associates the findings with vulnerabilities for the new records' do
+      expect { attach_findings_to_vulnerabilities }.to change { finding_1.reload.vulnerability_id }.from(nil).to(vulnerability_id_1)
+                                                   .and change { finding_2.reload.vulnerability_id }.from(nil).to(vulnerability_id_2)
+                                                   .and not_change { finding_3.reload.vulnerability_id }.from(nil)
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_finding_identifiers_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestFindingIdentifiers do
+  describe '#execute' do
+    let(:pipeline) { create(:ci_pipeline) }
+    let(:identifier) { create(:vulnerabilities_identifier) }
+    let(:finding_1) { create(:vulnerabilities_finding) }
+    let(:finding_2) { create(:vulnerabilities_finding) }
+    let(:finding_map_1) { create(:finding_map, finding: finding_1, identifier_ids: [identifier.id]) }
+    let(:finding_map_2) { create(:finding_map, finding: finding_2, identifier_ids: [identifier.id]) }
+    let(:service_object) { described_class.new(pipeline, [finding_map_1, finding_map_2]) }
+
+    subject(:ingest_finding_identifiers) { service_object.execute }
+
+    before do
+      finding_1.identifiers << identifier
+    end
+
+    it 'associates findings with the identifiers' do
+      expect { ingest_finding_identifiers }.to change { Vulnerabilities::FindingIdentifier.count }.by(1)
+                                           .and change { finding_2.reload.identifiers }.from([]).to([identifier])
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_finding_links_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestFindingLinks do
+  describe '#execute' do
+    let(:pipeline) { create(:ci_pipeline) }
+    let(:finding_link) { create(:ci_reports_security_link) }
+    let(:finding_1) { create(:vulnerabilities_finding) }
+    let(:finding_2) { create(:vulnerabilities_finding) }
+    let(:report_finding_1) { create(:ci_reports_security_finding, links: [finding_link]) }
+    let(:report_finding_2) { create(:ci_reports_security_finding, links: [finding_link]) }
+    let(:finding_map_1) { create(:finding_map, finding: finding_1, report_finding: report_finding_1) }
+    let(:finding_map_2) { create(:finding_map, finding: finding_2, report_finding: report_finding_2) }
+    let(:service_object) { described_class.new(pipeline, [finding_map_1, finding_map_2]) }
+
+    subject(:ingest_finding_links) { service_object.execute }
+
+    before do
+      create(:finding_link, finding: finding_2, url: finding_link.url)
+    end
+
+    it 'creates finding links for the new records' do
+      expect { ingest_finding_links }.to change { Vulnerabilities::FindingLink.count }.by(1)
+                                     .and change { finding_1.finding_links.count }.by(1)
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_finding_pipelines_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestFindingPipelines do
+  describe '#execute' do
+    let(:pipeline) { create(:ci_pipeline) }
+    let(:finding) { create(:vulnerabilities_finding) }
+    let(:finding_maps) { create_list(:finding_map, 1, finding: finding) }
+    let(:service_object) { described_class.new(pipeline, finding_maps) }
+
+    subject(:ingest_finding_pipelines) { service_object.execute }
+
+    it 'associates the findings with pipeline' do
+      expect { ingest_finding_pipelines }.to change { finding.finding_pipelines.pluck(:pipeline_id) }.from([]).to([pipeline.id])
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_finding_signatures_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestFindingSignatures do
+  describe '#execute' do
+    let(:pipeline) { create(:ci_pipeline) }
+    let(:finding_1) { create(:vulnerabilities_finding) }
+    let(:finding_2) { create(:vulnerabilities_finding) }
+    let(:report_signature) { create(:ci_reports_security_finding_signature) }
+    let(:report_finding_1) { create(:ci_reports_security_finding, signatures: [report_signature]) }
+    let(:report_finding_2) { create(:ci_reports_security_finding, signatures: [report_signature]) }
+    let(:finding_map_1) { create(:finding_map, finding: finding_1, report_finding: report_finding_1) }
+    let(:finding_map_2) { create(:finding_map, finding: finding_2, report_finding: report_finding_2) }
+    let(:service_object) { described_class.new(pipeline, [finding_map_1, finding_map_2]) }
+
+    subject(:ingest_finding_signatures) { service_object.execute }
+
+    before do
+      create(:vulnerabilities_finding_signature, finding: finding_1, signature_sha: report_signature.signature_sha)
+    end
+
+    it 'ingests new finding signatures' do
+      expect { ingest_finding_signatures }.to change { Vulnerabilities::FindingSignature.count }.by(1)
+                                          .and change { finding_2.signatures.count }.by(1)
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_findings_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestFindings do
+  describe '#execute' do
+    let_it_be(:pipeline) { create(:ci_pipeline) }
+    let_it_be(:identifier) { create(:vulnerabilities_identifier) }
+
+    let(:finding_maps) { create_list(:finding_map, 4, identifier_ids: [identifier.id]) }
+    let!(:existing_finding) { create(:vulnerabilities_finding, :detected, uuid: finding_maps.first.uuid) }
+
+    subject(:ingest_findings) { described_class.new(pipeline, finding_maps).execute }
+
+    it 'ingests findings' do
+      expect { ingest_findings }.to change { Vulnerabilities::Finding.count }.by(3)
+    end
+
+    it 'sets the finding and vulnerability ids' do
+      expected_finding_ids = Array.new(3) { an_instance_of(Integer) }.unshift(existing_finding.id)
+      expected_vulnerability_ids = [existing_finding.vulnerability_id, nil, nil, nil]
+
+      expect {ingest_findings }.to change { finding_maps.map(&:finding_id) }.from(Array.new(4)).to(expected_finding_ids)
+                               .and change { finding_maps.map(&:vulnerability_id) }.from(Array.new(4)).to(expected_vulnerability_ids)
+    end
+  end
+end

ee/spec/services/security/ingestion/tasks/ingest_identifiers_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Security::Ingestion::Tasks::IngestIdentifiers do
+  describe '#execute' do
+    let_it_be(:pipeline) { create(:ci_pipeline) }
+
+    let(:existing_fingerprint) { Digest::SHA1.hexdigest('type:id') }
+    let(:vulnerability_identifier) { create(:vulnerabilities_identifier, project: pipeline.project, fingerprint: existing_fingerprint, name: 'bar') }
+    let(:existing_report_identifier) { create(:ci_reports_security_identifier, external_id: 'id', external_type: 'type') }
+    let(:extra_identifiers) { Array.new(21) { |index| create(:ci_reports_security_identifier, external_id: "id-#{index}", external_type: 'type') } }
+    let(:identifiers) { extra_identifiers.unshift(existing_report_identifier) }
+    let(:expected_fingerprints) { Array.new(19) { |index| Digest::SHA1.hexdigest("type:id-#{index}") }.unshift(existing_fingerprint).sort }
+
+    let(:report_finding) { create(:ci_reports_security_finding, identifiers: identifiers) }
+    let(:finding_map) { create(:finding_map, report_finding: report_finding) }
+    let(:service_object) { described_class.new(pipeline, [finding_map]) }
+    let(:project_identifiers) { pipeline.project.vulnerability_identifiers }
+
+    subject(:ingest_identifiers) { service_object.execute }
+
+    it 'creates new records and updates the existing ones' do
+      expect { ingest_identifiers }.to change { project_identifiers.count }.from(1).to(20)
+                                   .and change { vulnerability_identifier.reload.name }
+    end
+
+    it 'sets the identifier_ids for the finding_map object' do
+      expect { ingest_identifiers }.to(
+        change { project_identifiers.where(id: finding_map.identifier_ids).pluck(:fingerprint).sort }
+          .from([])
+          .to(expected_fingerprints))
+    end
+  end
+end