Update vulnerability ingestion process to bulk upsert vulnerability read records
Why are we doing this work
In order to move away from the current database trigger methodology we use for updating Vulnerability Reads, we need to ensure that Vulnerability Reads are correctly upserted during the Vulnerability Ingestion Process.
It has been identified that inlining this into the vulnerability ingestion process is the most efficient choice, as doing it via a separate sidekiq process or such would require us to reconstruct the data that is already present during ingestion, resulting in far more DB and Application activity than would be necessary.
Explicitly, we want to put this new behavior behind a feature flag so that we don't attempt to double write vulnerability reads until we're ready to move this behavior from the database trigger to the application layer.
Relevant links
Implementation plan
- Implement a new vulnerability ingestion "task" that uses the finding maps to upsert Vulnerability Read records for vulnerabilities as they are ingested.
- Add this task to the vulnerability ingestion process task list.
Verification steps
Because Vulnerability::Read records are already created via database trigger this is going to be more than a little annoying to validate. Likely we will need to rely on thorough tests to ensure it works correctly. Gold points if we can write spec that disables the database trigger and checks that the vulnerability read is still created correctly.