Avoid loading all MR commits in cross-reference guard

Philipp Stutzrequested to merge
gitlab-community/gitlab-org/gitlab:fix/cross-reference-disallowed-avoid-loading-all-commits into master

What does this MR do and why?

SystemNotes::IssuablesService#cross_reference_disallowed? checks whether a commit is part of a merge request by loading every MergeRequestDiffCommit of the MR, with metadata and both users preloaded, then building a Commit for each.

On a 27k-commit merge request on GitLab 19.2.4 self-managed, one comment citing a commit SHA kept NewNoteWorker at 100% CPU for 33 minutes at 1.8 GB RSS. Path: cross_reference_disallowed? → MergeRequest#commits → MergeRequestDiff#load_commits.

For persisted diffs this now uses MergeRequestDiff.ids_including_any_commits, already used by MergeRequests::RefreshService. Unpersisted diffs keep the old path.

On GitLab.com the same comment on a 28,001-commit reproducer takes about 9s, because mr_diff_commits_read_new_table is rolling out there. That flag is default_enabled: false, and even with it on, every diff commit is still loaded. With this change the check is at most three queries for the single SHA, independent of the commit count.

References

Screenshots or screen recordings

Not applicable, no UI change.

How to set up and validate locally

  1. Import https://gitlab.com/philstutz/gitlab-592062-reproducer into GDK, then open its merge request philstutz/gitlab-592062-reproducer!1 (28,001 commits).
  2. Comment on it with the SHA of the probe-1 head commit, which is not part of the MR.
  3. NewNoteWorker does not load the MR's diff commits, and the commit gets a mentioned in system note.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports