Remove security_policy_target_branch_desync_detection feature flag

Sashi Kumar Kumaresanrequested to merge
remove-desync-ff-623321 into master

What does this MR do and why?

This MR removes the feature flag security_policy_target_branch_desync_detection, which has been at 100% on GitLab.com since 2026-09-15 with no issues found during the rollout.

The flag gated fail-closed desync detection in MergeRequests::Mergeability::CheckSecurityPolicyViolationsService#approval_rules_out_of_sync?. With the flag removed, this detection is now always on. When an open merge request in a project covered by an approval policy is missing approval policy rules for its target branch, the security policy mergeability check returns a checking status, logs security_policy_approval_rules_desync_detected, and schedules Security::ScanResultPolicies::ResyncMergeRequestRulesWorker to re-sync the rules. The worker is debounced with a 1-minute exclusive lease to avoid duplicate scheduling.

The Feature.enabled? guard has been removed from the service, along with its YAML definition at ee/config/feature_flags/gitlab_com_derisk/security_policy_target_branch_desync_detection.yml. The spec context that covered the flag-disabled path has also been removed, since that behavior no longer exists. The remaining specs already cover the flag-enabled behavior: checking status with resync scheduled, debounce, logging, synced rules, and merged/closed merge requests being skipped.

References

Screenshots or screen recordings

Not applicable. This is a backend-only change with no UI impact.

How to set up and validate locally

  1. In GDK, create a project and add a merge request approval policy that covers a protected target branch (for example, main).
  2. Open a merge request against that protected target branch.
  3. In the Rails console, delete the merge request's report approver rules to simulate a desync: mr.approval_rules.report_approver.delete_all.
  4. Reload the merge request page and check the merge widget. The security policy check should show a checking state.
  5. Wait for Security::ScanResultPolicies::ResyncMergeRequestRulesWorker to run, then reload the page again and confirm the approval policy rules have been re-synced.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports