EPSS GraphQL Querying

What does this MR do and why?

Relates to Add EPSS to GitLab database and enable querying... (#470835 - closed) • Yasha Rise • 17.4 • At risk

Query changes

We added a new query for the EPSS table. It queries data from the pm_epss table for specific CVEs. The query runs for all available CVE values in a set of vulnerabilities:

      BatchLoader::GraphQL.for(object.cve_value).batch do |cves, loader|
        ::PackageMetadata::Epss.by_cve(cves).each do |epss|
          loader.call(epss.cve, epss)
        end
      end

where by_cve is defined as:

scope :by_cve, ->(cve) { where(cve: cve) }

so the query will always run for a specified set of CVEs.

A sample query may be:

SELECT
    "pm_epss".*
FROM
    "pm_epss"
WHERE
    "pm_epss"."cve" IN ('CVE-2023-3635', 'CVE-2023-2976', 'CVE-2022-24329', 'CVE-2020-8908');

Query plan

The query plan is run on a local environment (since the feature doesn't exist in production) using EXPLAIN ANALYZE SELECT "pm_epss".* FROM "pm_epss" WHERE "pm_epss"."cve" IN ('CVE-2023-3635', 'CVE-2023-2976', 'CVE-2022-24329', 'CVE-2020-8908');. Prior to running the query plan, I added 250,000 rows to pm_epss, around the amount expected in production.

                                                          QUERY PLAN
-------------------------------------------------------------------------------------------------------------------------------
 Index Scan using index_pm_epss_on_cve on pm_epss  (cost=0.15..6.67 rows=4 width=64) (actual time=0.004..0.006 rows=3 loops=1)
   Index Cond: (cve = ANY ('{CVE-2023-3635,CVE-2023-2976,CVE-2022-24329,CVE-2020-8908}'::text[]))
 Planning Time: 0.029 ms
 Execution Time: 0.010 ms
(4 rows)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before	After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Related to #470835 (closed)