Fix 500 when securityReportFindings cursor is empty string

Harrison Petersrequested to merge
hptrs-599789-fix-security-report-findings-endpoint-regression into master

What does this MR do and why?

Gitlab::Pagination::Keyset::GraphqlCursorBuilder.build used truthiness checks (if after / elsif before) instead of .present?. Since an empty string is truthy in Ruby, passing after: "" (or before: "") to Query.project.pipeline.securityReportFindings was treated the same as a real cursor and forwarded to Base64CursorConverter.parse, which raised a NoMethodError on the blank value. That exception was unhandled by GraphQL and surfaced as a bare 500 with no GraphQL error payload.

Before the regression (introduced in 2dd564bf, 2026-05-08), cursors weren't passed to the finder at all, so empty strings were silently ignored — hence reports that this "used to work".

This MR switches the checks to .present?, so an empty-string cursor now behaves like an absent one (same as passing null), instead of crashing.

References

Resolves #599789 (closed)

Screenshots or screen recordings

Not applicable — backend GraphQL fix.

How to set up and validate locally

  1. Start a pipeline with SAST/dependency-scanning findings on a project.
  2. Query project.pipeline(iid).securityReportFindings(after: "") via GraphiQL or curl.
  3. Before this change: 500 Internal Server Error with no GraphQL error payload.
  4. After this change: 200 OK, returning the first page of findings, same as passing after: null.

Also see the added specs:

  • spec/lib/gitlab/pagination/keyset/graphql_cursor_builder_spec.rb
  • ee/spec/requests/api/graphql/project/pipeline/security_report_findings_spec.rb

Merge request reports