Skip to content

Add project filter API for Group Dependency List

mo khan requested to merge mokhax/422294/filter-by-projects into master

What does this MR do and why?

This change introduces support for a ?project_ids[]= filter on the Group Dependency List so that end users to view dependencies that were detected in a subset of projects under a group hierarchy.

#422294 (closed)

SELECT
    sbom_occurrences.*
FROM
    sbom_occurrences
WHERE
    sbom_occurrences.project_id IN (
    SELECT
        projects.id
    FROM
        projects
    WHERE
        projects.id IN (
            37790050,
            41055203,
            44480542,
            44674376,
            51124750,
            50773741,
            21525059,
            23495190,
            31253983,
            35086421
        ) AND
        projects.namespace_id IN (
            SELECT
                namespaces.id
            FROM
                namespaces
            WHERE
                namespaces.type = 'Group' AND
                traversal_ids @> '{9970}'
        )
    )
ORDER BY
    sbom_occurrences.id ASC
LIMIT 100
OFFSET 100;
Time: 234.574 ms  
  - planning: 10.774 ms  
  - execution: 223.800 ms  
    - I/O read: 219.440 ms  
    - I/O write: 0.000 ms  
  
Shared buffers:  
  - hits: 74 (~592.00 KiB) from the buffer pool  
  - reads: 91 (~728.00 KiB) from the OS file cache, including disk I/O  
  - dirtied: 3 (~24.00 KiB)  
  - writes: 0  

https://postgres.ai/console/gitlab/gitlab-production-tunnel-pg12/sessions/23530/commands/75640

Screenshots or screen recordings

Before After
image

How to set up and validate locally

  1. In rails console enable the experiment fully
    Feature.enable(:group_level_dependencies_filtering)
  2. Visit any group dependency list JSON endpoint such as http://127.0.0.1:3000/groups/flightjs/-/dependencies.json
  3. Append a query string parameter to filter by project e.g. ?project_ids[]=19&project_ids[]=20.
  4. Verify the filtered list of results.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Brian Williams

Merge request reports