Redundant Vulnerabilities::StateTransition records that don't actually present a state transition.

Per #324860 (comment 1099509574), it was noted that Vulnerabilities::StateTransition records are being created that don't appear to actually represent a state transition at all.

Example:

#<Vulnerabilities::StateTransition:0x00007ff15d452288
  id: 1251521,
  to_state: "dismissed",
  from_state: "dismissed",
  created_at: Tue, 13 Sep 2022 16:39:48.646844000 UTC +00:00,
  updated_at: Tue, 13 Sep 2022 16:39:48.646844000 UTC +00:00,
  author_id: nil,
  comment: nil,
  dismissal_reason: nil>

At time of discovery, this appears to already have occurred a substantial amount in Production, and is potentially polluting the vulnerability_state_transitions table with thousands of redundant records. We need to investigate how these are being created, and if it's reasonable to have a state transition that doesn't actually present any form of useful information.

Implementation plan:

  • If the vulnerability state is already in state which is requested by change status, skip state transition entry. for this services ee/app/services/vulnerabilities /{resolve,dismiss,revert_to_detected,confirm}\_service.rb
Edited by Subashis Chakraborty