[Chain of Custody Report] Expand the scope from Merge Commits to All Commits

Release notes

Problem to solve

In #213364 (closed), we introduced the Chain of Custody report to include for only Merge Commits.

We soon observed a need to expand this for all commits, as we build features such as filters and search functionalities on top of it. This has also been noted as an action item in the list of Iteration 2.

Intended users

Cameron (Compliance Manager)

User experience goal

A user should be able to find any commit that was pushed to a project that belongs in a group. Only one layer of depth Group ⇢ Project to maintain performant queries.

Proposal

• Update the query in the csv export service to query for all commits in a group
  • Looks like we can use the existing finder method to do this: app/finders/merge_requests_finder.rb:88
• Update to resultant CSV attributes here (for e.g. merge_commit_sha may not be applicable for all commits)
• Update buttons in the UI

Screenshots

Before	After

Further details

Since we are querying for all commits in a group, we may need to account for:

• Records been truncated due to the 15 MB limit
• Query performance

Permissions and Security

Available to Group owners and instance administrators

Documentation

Updates to Chain of Custody report documentation