SDLC - Add check for project setting for worker + branch push service

What does this MR do and why?

Gates the SDLC Context Agent behind the duo_vulnerability_context_analysis_enabled project setting so pushes to the default branch only trigger the agent when the setting is enabled.

References

• Main epic: https://gitlab.com/groups/gitlab-org/-/work_items/21005
• Project setting (backend): !249617 (merged)
• Project setting (frontend): !250024 (merged)
• Related issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/611376

How to set up and validate locally

Prerequisites

1. Follow the AI setup guide: https://gitlab-org.gitlab.io/gitlab-development-kit/howto/ai/gitlab_ai_gateway/
2. Ensure your GDK instance has an active EE Ultimate license with GitLab Duo enabled
3. Clone a test project from your GDK: git clone http://gdk.test:8080/<your-project-path>

Setup

4. Enable the feature flag:

   # bin/rails console
   Feature.enable(:sdlc_context_agent_trigger)

5. Checkout the backend branch and run migrations:

   git fetch origin duo/feature/611376-duo-vulnerability-context-analysis-project-setting
   git checkout duo/feature/611376-duo-vulnerability-context-analysis-project-setting
   bundle exec rails db:migrate

6. Checkout this branch:

   git checkout CK-add-project-settings-check-to-pushworker

7. Ensure the flow's service account has Maintainer access on the project:

   # bin/rails console
   project = Project.find(<PROJECT_ID>)
   sa = User.where("username LIKE '%vulnerability-context%' OR username LIKE '%business-context%'").first
   puts "#{sa.username} (ID: #{sa.id})"
   project.add_maintainer(sa)

8. Apply the workhorse patch (comment out require_gitlab_workhorse! in 3 places):

   Patch

   diff --git a/ee/lib/api/ai/duo_workflows/workflows_internal.rb b/ee/lib/api/ai/duo_workflows/workflows_internal.rb
   index c55613973bf0..6bc7b688eb96 100644
   --- a/ee/lib/api/ai/duo_workflows/workflows_internal.rb
   +++ b/ee/lib/api/ai/duo_workflows/workflows_internal.rb
   @@ -106,7 +106,7 @@ def uncompress_checkpoint(compressed_data)
                    end
                    route_setting :authorization, skip_granular_token_authorization: :ai_workflows_oauth_auth
                    get do
   -                  require_gitlab_workhorse!
   +                  # require_gitlab_workhorse! # TESTING ONLY — local ASCP flow run
   
                      workflow = find_workflow!(params[:id])
                      push_ai_gateway_headers(scope: workflow.resource_parent,
   @@ -140,7 +140,7 @@ def uncompress_checkpoint(compressed_data)
   
                    namespace :checkpoints do
                      before do
   -                    require_gitlab_workhorse!
   +                    # require_gitlab_workhorse! # TESTING ONLY — local ASCP flow run
                      end
                      desc 'Create workflow checkpoint' do
                        tags %w[gitlab_duo_workflows internal_operations]
   @@ -240,7 +240,7 @@ def uncompress_checkpoint(compressed_data)
   
                    namespace :checkpoint_writes_batch do
                      before do
   -                    require_gitlab_workhorse!
   +                    # require_gitlab_workhorse! # TESTING ONLY — local ASCP flow run
                      end
   
                      desc 'Create multiple workflow checkpoint writes' do

9. Run gdk restart

Validate: setting ON triggers the agent

10. Enable the project setting:

    # bin/rails console
    Project.find(<PROJECT_ID>).project_setting.update!(duo_vulnerability_context_analysis_enabled: true)

11. Monitor Sidekiq logs in a separate terminal:

    tail -f log/sidekiq.log | grep -i "daily_flow\|business_context\|foundational_flow\|DailyFlow"

12. Push a commit to the default branch of your test project:

    cd <test-project>
    echo "$(date)" >> .gitkeep
    git add .gitkeep
    git commit -m "test trigger - setting on"
    git push origin master

13. Verify Ai::DailyFlowOnPushWorker appears in the Sidekiq logs with job_status: "done".

Validate: setting OFF blocks the agent

14. Disable the project setting and clear the lease:

    # bin/rails console
    Project.find(<PROJECT_ID>).project_setting.update!(duo_vulnerability_context_analysis_enabled: false)
    Gitlab::ExclusiveLease.new("sdlc_context_agent:<PROJECT_ID>", timeout: 1).cancel

15. Push another commit to the default branch:

    echo "$(date)" >> .gitkeep
    git add .gitkeep
    git commit -m "test trigger - setting off"
    git push origin master

16. Verify Ai::DailyFlowOnPushWorker does not appear in the Sidekiq logs. The worker is not enqueued because the guard clause in BranchHooksService returns early.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.