Clean up security manager test infrastructure after role release

Summary

Once the security manager role is fully released and enabled in production by default, we should clean up the temporary test infrastructure that was added to enable it. it globally in tests.

Background

In !216462 (merged) (replace with your MR number), we added test infrastructure to enable the security manager role globally across the test suite:

  • Set ENV["GITLAB_SECURITY_MANAGER_ROLE"] = 'true' in spec_helper.rb
  • Added :disable_security_manager tag support for tests that need it disabled
  • Added conditional logic in various tests to handle both enabled and disabled states

This was necessary because the role was behind a feature flag during development, but tests needed to verify behavior in both states.

What needs to be done

Once the security manager role is released and no longer behind a feature flag:

1. Remove the global ENV setup

  • Remove ENV["GITLAB_SECURITY_MANAGER_ROLE"] = 'true' from spec/spec_helper.rb (line ~26)
  • Remove the :disable_security_manager tag handler from spec/spec_helper.rb (lines ~449-451)
  • Remove :disable_security_manager from spec/support/known_rspec_metadata_keys.yml.

2. Clean up disabled test contexts

Remove all test contexts that test the "disabled" state, as this will no longer be a valid configuration:

  • spec/lib/gitlab/access_spec.rb - Remove "when the security manager role is disabled" contexts (3 instances)
  • spec/presenters/group_member_presenter_spec.rb - Remove "when security manager is disabled" context
  • ee/spec/lib/ee/gitlab/access_spec.rb - Check for disabled contexts
  • Search codebase for other tag use: :disable_security_manager.

3. Simplify test expectations

Since the security manager will always be enabled:

  • Remove conditional logic that checks SecurityManagerConfig.enabled? in tests
  • Simplify test setups that have separate enabled/disabled paths

4. Verify behavior

  • Ensure all remaining tests assume the security manager is always present
  • Run full test suite to verify no regressions

When to do this

This should be done after:

  • ✅ Security manager role is fully released to production
  • ✅ The feature flag (if any) is removed from the codebase
  • ✅ The SecurityManagerConfig.enabled? check always returns true or is removed entirely

Related

Edited by Diane Russel