Remove cvs_malware_advisories feature flag

Bala Kumarrequested to merge
remove-ff-cvs-malware-advisories into master

What

Remove the cvs_malware_advisories flag so continuous vulnerability scanning always runs for ingested malware advisories.

Why

Continuous vulnerability scanning of malware advisories has run enabled-by-default in production since Beta. The flag is no longer needed for GA.

Changes

  • Delete the flag definition from the feature flags YAML
  • In PackageMetadata::GlobalMalwareAdvisoryScanWorker#handle_event, remove the flag guard so every ingested-advisory event is scanned
  • Remove specs for the disabled-state codepath

Testing

Flag-enabled and flag-disabled specs were updated (disabled-state contexts removed). Affected specs pass locally.

Related

Merge request reports