Reduce example count in all_policies_finder

What does this MR do and why?

ee/spec/finders/security/all_policies_finder_spec.rb ran the whole security policies finder shared example group (21 examples) once for each of five policy types. Security::AllPoliciesFinder passes :all_policies to Security::SecurityPolicyBaseFinder, and that base finder never looks at the policy type when it checks authorization, picks configurations by params[:relationship], filters by policy_scope, or deduplicates by security_policy_management_project_id. The only type-dependent step is Security::OrchestrationPolicyConfiguration#all_policies_with_type (ee/app/models/security/orchestration_policy_configuration.rb:264), which tags each policy with type: type.to_s, policy_index: index. Running the same licensing, role, relationship, scope, limit, and deduplication scenarios five times exercised identical code paths.

This MR runs the full shared suite once, with scan_execution_policy. Each of the five types keeps one example that asserts the finder returns that policy with its type and policy_index, plus the config, project, namespace, inherited, and csp attributes.

No coverage was removed: every shared-suite scenario still runs (once), and every policy type is still checked end to end through the finder, including its type tag. The existing "with all_policies and with type" filtering examples are unchanged.

Spec Run Time Optimization Results

Before optimization:

  • 109 examples
  • Run time: 3m 44s

After optimization:

  • 30 examples
  • Run time: 1m 24s

Improvement:

  • Example count reduced by: 72.5% (109 to 30)
  • Run time reduced by: 2m 20s (140.43s)

Verified with:

bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb --dry-run  # example count
bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb            # full run

Both runs measured in the same local checkout for a fair comparison (same warm Rails boot, same DB/Gitaly state), swapping only this file's content between the pre- and post-optimization version.

bundle exec rubocop ee/spec/finders/security/all_policies_finder_spec.rb reports no offenses.

Estimated CI Cost Savings

Using the same methodology as https://gitlab.com/gitlab-org/gitlab/-/merge_requests/248403: 140.43s saved per pipeline × $0.03/minute (large runners: 3x cost factor on $10/1,000 base minutes).

Scenario Pipelines/month Time saved/month Savings/year
Pessimistic 15,000 585.1h $12,638.70
Moderate 30,000 1170.2h $25,277.40
Optimistic 50,000 1950.4h $42,129.00

How to set up and validate locally

  1. Checkout this branch.
  2. Run bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb.
  3. Confirm 30 examples, 0 failures.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

Edited by Marcos Rocha

Merge request reports

Loading
Loading