Add definition-level UUID generation for vulnerabilities
Summary
This MR implements Phase 1 of the Vulnerability UUID migration to support the definition model transition.
Changes
- Added
generic_vuln_signature_uuidcolumn tovulnerabilitiestable - Extended
Security::VulnerabilityUUIDwithgenerate_for_vulnerabilitymethod that excludes location fingerprint - Populates
generic_vuln_signature_uuidon vulnerability creation via create services
UUID Composition
The new definition-level UUID (generic_vuln_signature_uuid) includes:
- Report type
- Primary identifier fingerprint
- Project ID
NOT included (unlike Finding UUID):
- Location fingerprint
- Security tracked context ID
This allows the same vulnerability type across different locations to share the same generic_vuln_signature_uuid, making it easier to compare vulnerabilities without implementation context.
Migration Phases
| Phase | Issue | Description |
|---|---|---|
| 1 | #587624 (this MR) | Start populating generic_vuln_signature_uuid for new vulnerabilities |
| 2 | #587802 | Backfill generic_vuln_signature_uuid for existing vulnerabilities |
| 3 | #587803 | Add NOT NULL constraint to generic_vuln_signature_uuid |
| 4 | #587804 | Transition GitLab to use generic_vuln_signature_uuid |
| 5 | #587805 | Drop old uuid column and rename |
Closes #587624
Edited by Gregory Havenga