Remove security_report_related_pipelines feature flag
What does this MR do and why?
Removes the security_report_related_pipelines feature flag. The merge request security report comparison and the enabled security scans now always include scans and findings from related pipelines for the same sha, for example the branch pipeline next to the merge request pipeline.
The flag is already enabled for all projects on GitLab.com. The flag YAML, the three Feature.enabled? checks, and the two flag-off spec contexts are removed. No behavior change on GitLab.com.
Related to #599102 (closed)
How this was validated
Specs: enabled_security_scans_spec.rb and compare_security_reports_service_spec.rb pass together (80 examples, 0 failures). RuboCop reports no offenses on the changed files.
End to end on GitLab.com, with the flag already on, using a test merge request whose branch pipeline ran SAST only and whose merge request pipeline ran Secret Detection only:
- The merge request security widget showed 4 new vulnerabilities: 3 SAST findings from the branch pipeline and 1 Secret Detection finding from the merge request pipeline.
enabledSecurityScanson the merge request head pipeline reported bothsastandsecretDetection. Amainpipeline that only ran SAST correctly reportedsecretDetection: false.
MR acceptance checklist
- Feature flag removed in the same MR as the code that used it
- Changelog entry added through the commit trailer
Screenshots or screen recordings
Not applicable: no UI change on GitLab.com.