Set vulnerability_occurrence_id during sbom_occurrences_vulnerabilities ingestion

Summary

Update the SBOM ingestion to populate vulnerability_occurrence_id when creating sbom_occurrences_vulnerabilities records.

Background

The vulnerability_occurrence_id column was added to sbom_occurrences_vulnerabilities as part of the Vulnerabilities Across Contexts initiative, but the ingestion code was never updated to populate it. This was noted in !213084 (merged) which excluded this table from the backfill with the comment "We are not setting this ID during ingestion yet."

This gap was identified by @schmil.monderer while reviewing !225631 (merged) (ES preloaders using occurrence_id).

Current State

The Sbom::Ingestion::Tasks::IngestOccurrencesVulnerabilities task only sets:

  • sbom_occurrence_id
  • vulnerability_id

It does not set vulnerability_occurrence_id.

https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/sbom/ingestion/tasks/ingest_occurrences_vulnerabilities.rb#L35-42

Proposed Solution

Update IngestOccurrencesVulnerabilities#ingested_links to include vulnerability_occurrence_id:

def ingested_links
  insertable_maps.flat_map do |occurrence_map|
    occurrence_map.vulnerability_ids.map do |vulnerability_id|
      {
        sbom_occurrence_id: occurrence_map.occurrence_id,
        vulnerability_id: vulnerability_id,
        vulnerability_occurrence_id: occurrence_map.finding_id
      }
    end
  end
end

This requires the occurrence_map to have access to the finding_id. The exact implementation depends on how finding information flows through the SBOM ingestion pipeline.

Acceptance Criteria

  • IngestOccurrencesVulnerabilities sets vulnerability_occurrence_id for new records
  • Tests verify the column is populated correctly
  • Works for both dependency scanning and container scanning SBOM reports

Related