Flows as Beta maturity level, while rest of AI Catalog is GA

What does this MR do and why?

All changes are behind the global_ai_catalog feature flag and so this MR does not have a changelog.

This change gives flows an independent feature maturity from the rest of the AI catalog.

Currently, the entire AI Catalog is at the same feature maturity level (Experiment, and soon GA).

However, flows should not be part of the AI catalog's GA, and should independently move from Experiment -> Beta -> GA.

The purpose of the changes is that for customers who have not opted-in to Experimental/Beta AI features, they should not see, or be able to interact with, Flows when AI Catalog is GA.

The MR defines flows as its own :beta feature maturity within Gitlab::Llm::Utils::AiFeaturesCatalogue::LIST.

There are new permissions defined related to flows:

• read_ai_catalog_flow
• create_ai_catalog_flow
• create_ai_catalog_flow_item_consumer

And changes to the existing permissions in ItemPolicy.

The permission changes all check:

1. The ai_catalog_flows feature flag is enabled
2. The feature maturity of Flows is compatible with the group/project's Experimental/Beta AI feature setting

References

• BE: Allow AI Catalog flows to be at Beta maturi... (#577764 - closed)

How to set up and validate locally

Enable the following feature flags:

Feature.enable(:global_ai_catalog)
Feature.enable(:ai_catalog_flows)
Feature.enable(:ai_catalog_third_party_flows)

QA with AI Catalog as Experiment (current state)

First, ensure the ai_duo_agent_platform_ga_rollout flag that puts the AI Catalog into GA is disabled. This ensures the AI Catalog is an Experiment.

Feature.disable(:ai_duo_agent_platform_ga_rollout)

In this state, AI Catalog flows should behave the same as they do on master:

Use a project with top-level group that has Duo Features enabled, and has enabled AI Experimental/Beta features:

• Select a project, go Settings > General:
  • Expand GitLab Duo section
  • Ensure GitLab Duo is enabled
• For project's top-level group, go Settings > GitLab Duo:
  • Click Change configuration
  • Ensure GitLab Duo is On by default
  • Ensure Turn on experiment and beta GitLab Duo features is selected

QA:

• Project can create flows
• Project's top-level group can enable/disable flows
• Project can enable/disable flows they have created
• Project can enable/disable flows that belong to another project (when flow is public)
• Project flows can be triggered
• Flows can be created for the project at explore level, and enabled
• Project Automate > Flows menu appears
• Group Automate > Flows menu appears
• Group can view enabled flows

Now disable the Flows feature flag

Feature.disable(:ai_catalog_flows)

Again, the behaviour should be the same as master branch, you now can't use Flows, but Agents should continue to work.

👉 Please note, there is an existing bug in master where you can trigger a previously enabled Flow when the flag is disabled - this bug exists on this branch too.

QA with AI Catalog as GA (future state)

Enable the ai_duo_agent_platform_ga_rollout flag that puts the AI Catalog into GA:

Feature.enable(:ai_duo_agent_platform_ga_rollout)

And enable the Flows feature flag

Feature.enable(:ai_catalog_flows)

And this time, disable AI Experimental/Beta features for the top-level group:

• For project's top-level group, go Settings > GitLab Duo:
  • Click Change configuration
  • Ensure Turn on experiment and beta GitLab Duo features is not selected

All the above QA steps for flows should now no longer be possible as flows is Beta while AI Catalog is GA.

Re-enable AI Experimental/Beta features for the top-level group:

• For project's top-level group, go Settings > GitLab Duo:
  • Click Change configuration
  • Ensure Turn on experiment and beta GitLab Duo features is selected

And it should again be possible to do all the above QA steps for flows again.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #577764 (closed)