License compliance bug: Report comparison performed on a base pipeline with no license reports
In gitlab-runner!4430 (merged), the merge request widget showed that there were new license violations even though many of those violations were already present in https://gitlab.com/gitlab-org/gitlab-runner/-/licenses:
It appears that in MergeRequest#has_denied_policies?, the call to compare_reports(::Ci::CompareLicenseScanningReportsService) in https://gitlab.com/gitlab-org/gitlab/-/blob/671a93516a349688fa73e8213a8688f197310427/ee/app/models/ee/merge_request.rb#L262 is using the merge request base_pipeline and head_pipeline:
[ gprd ] production> base_report.license_scanning_report
=>
#<Gitlab::Ci::Reports::LicenseScanning::Report:0x00007f735b536378
@found_licenses={},
@version="1.0">
[ gprd ] production> mr.base_pipeline.created_at
=> Tue, 24 Oct 2023 10:45:29.811532000 UTC +00:00
[ gprd ] production> mr.head_pipeline.created_at
=> Tue, 24 Oct 2023 21:10:08.945936000 UTC +00:00
[ gprd ] production> mr.base_pipeline.id
=> 1047422919
[ gprd ] production> mr.head_pipeline.id
=> 1048169461The problem is that the base pipeline is a docs-only change (https://gitlab.com/gitlab-org/gitlab-runner/-/pipelines/1047422919), which does not run the license scanning job!
The logic needs to be adjusted to either:
- Find another pipeline in the merge request that does have a license scanning report.
- Abandon the license comparison (?), with perhaps a warning.


