Skip to content

Modify Vulnerability `for_projects` scope

Michael Becker requested to merge 213144-vulnerabilities-for-archived-projects-appear-in-group-level-and-security-center-dashboards into master

What does this MR do and why?

We have issue 213144 open to stop including archived project vulnerabilities in various places in the UI

As step 1 for this change, we want to modify the for_projects scope to:

  1. take a param to toggle whether to include archived projects in the response
  2. default this new param to false (so only non-archived projects are returned by default)

follow-up MRs will use this field to:

  • Add filter in VulnerabilitiesFinder and VulnerabilityReadsFinder to use this field
  • expose this as a nullable argument in the VulnerabilitiesResolver

SQL

determined by running the following locally:

def test_change(group, toggle = false)
  project_ids = Project.for_group_and_its_subgroups(group).without_deleted.pluck(:id)
  vulnerabilities = Vulnerability.for_projects(project_ids, toggle)
end

Group.find(33)

test_change(group, false)
test_change(group, true)
when `toggle == false` 
SELECT
    "vulnerabilities".*
FROM
    "vulnerabilities"
    INNER JOIN "projects" ON "projects"."id" = "vulnerabilities"."project_id"
WHERE
    "projects"."id" = 7
    AND "projects"."archived" = FALSE
when `toggle == true` 
SELECT
    "vulnerabilities".*
FROM
    "vulnerabilities"
WHERE
    "vulnerabilities"."project_id" = 7

explain

when toggle == false

https://postgres.ai/console/gitlab/gitlab-production-tunnel-pg12/sessions/20544/commands/67373

when toggle == true

https://postgres.ai/console/gitlab/gitlab-production-tunnel-pg12/sessions/20544/commands/67374

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #213144 (closed)

Edited by Michael Becker

Merge request reports