Reduce example count in all_policies_finder
What does this MR do and why?
ee/spec/finders/security/all_policies_finder_spec.rb ran the whole security policies finder shared example group (21 examples) once for each of five policy types. Security::AllPoliciesFinder passes :all_policies to Security::SecurityPolicyBaseFinder, and that base finder never looks at the policy type when it checks authorization, picks configurations by params[:relationship], filters by policy_scope, or deduplicates by security_policy_management_project_id. The only type-dependent step is Security::OrchestrationPolicyConfiguration#all_policies_with_type (ee/app/models/security/orchestration_policy_configuration.rb:264), which tags each policy with type: type.to_s, policy_index: index. Running the same licensing, role, relationship, scope, limit, and deduplication scenarios five times exercised identical code paths.
This MR runs the full shared suite once, with scan_execution_policy. Each of the five types keeps one example that asserts the finder returns that policy with its type and policy_index, plus the config, project, namespace, inherited, and csp attributes.
No coverage was removed: every shared-suite scenario still runs (once), and every policy type is still checked end to end through the finder, including its type tag. The existing "with all_policies and with type" filtering examples are unchanged.
Spec Run Time Optimization Results
Before optimization:
- 109 examples
- Run time: 3m 44s
After optimization:
- 30 examples
- Run time: 1m 24s
Improvement:
- Example count reduced by: 72.5% (109 to 30)
- Run time reduced by: 2m 20s (140.43s)
Verified with:
bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb --dry-run # example count
bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb # full runBoth runs measured in the same local checkout for a fair comparison (same warm Rails boot, same DB/Gitaly state), swapping only this file's content between the pre- and post-optimization version.
bundle exec rubocop ee/spec/finders/security/all_policies_finder_spec.rb reports no offenses.
Estimated CI Cost Savings
Using the same methodology as https://gitlab.com/gitlab-org/gitlab/-/merge_requests/248403:
140.43s saved per pipeline × $0.03/minute (large runners: 3x cost factor on $10/1,000 base minutes).
| Scenario | Pipelines/month | Time saved/month | Savings/year |
|---|---|---|---|
| Pessimistic | 15,000 | 585.1h | $12,638.70 |
| Moderate | 30,000 | 1170.2h | $25,277.40 |
| Optimistic | 50,000 | 1950.4h | $42,129.00 |
How to set up and validate locally
- Checkout this branch.
- Run
bundle exec rspec ee/spec/finders/security/all_policies_finder_spec.rb. - Confirm 30 examples, 0 failures.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist.