Add batched background migration to backfill security_project_tracked_context_id

Gregory Havenga (is on PTO from 15 December 2025 to 02 January 2026)requested to merge
backfill-security-project-tracked-context-id into master

What does this MR do?

This MR adds a batched background migration to backfill the security_project_tracked_context_id column for vulnerability-related tables as requested in #558135.

Background

The tables vulnerability_occurrences, vulnerability_historical_statistics, vulnerability_statistics and vulnerability_reads now have a security_project_tracked_context_id column that needs to be populated with references to the default security_project_tracked_context for each project.

Changes

Migration Logic

The migration processes projects in batches and:

  1. Filters projects: Only processes projects where project_settings.has_vulnerabilities = true
  2. Ensures default context exists: For each project, creates a default security_project_tracked_context if one doesn't exist
  3. Backfills vulnerability tables: Updates all vulnerability-related records to reference the default tracked context

Default Context Creation

When creating a default tracked context:

  • Uses the project's default_branch (falls back to 'main' if null)
  • Sets context_type = 1 (branch)
  • Sets is_default = true
  • Sets state = 2 (tracked)

Tables Updated

  • vulnerability_occurrences
  • vulnerability_reads
  • vulnerability_statistics
  • vulnerability_historical_statistics

Safety Features

  • Only updates records where security_project_tracked_context_id is null
  • Handles race conditions when creating tracked contexts
  • Uses appropriate batch sizes (1000/100) with 2-minute intervals
  • Includes comprehensive test coverage

Database Impact

  • Schema: gitlab_sec
  • Batch size: 1000 projects per batch, 100 per sub-batch
  • Interval: 2 minutes between batches
  • Tables affected: All vulnerability-related tables for projects with vulnerabilities

Testing

  • Unit tests for the background migration job
  • Migration spec for the queue setup
  • Edge case handling (nil default_branch, existing contexts, race conditions)

Closes #558135

Merge request reports