Reduce example count in processor
What does this MR do and why?
The shared example 'with different scan type' in ee/spec/lib/gitlab/ci/config/security_orchestration_policies/processor_spec.rb ran its whole suite (15 examples) once per pipeline source in %w[api pipeline merge_request_event schedule]. It is included three times (DAST, secret detection, SAST), so that loop produced 180 examples. Now only 'collects the injected jobs and metadata in the pipeline context' stays inside the per-source loop. The other 14 examples (stage insertion, job naming, reserved .pre/.post stages, invalid stages) run once per scan type under the spec's default source of 'pipeline'.
The source does not affect those 14 examples, for these reasons:
Gitlab::Ci::Config::SecurityOrchestrationPolicies::Processornever reads the pipeline source. It buildsScanPipelineService.new(context)with nopipeline_source.- In
Gitlab::Ci::Pipeline::ScanExecutionPolicies::PipelineContext, the source only gates applicability throughreturn false unless Enums::Ci::Pipeline.ci_sources.key?(source). All four looped sources areci_sources, and none is inEnums::Ci::Pipeline.dangling_sources. Security::ScanExecutionPolicy#applicable_for_pipeline_source?filters policies withrule_pipeline_sources.blank? || rule_pipeline_sources.include?(pipeline_source.to_s). The spec's policies have nopipeline_sourcesin their rules, so this is true for all four sources.- The one source-sensitive branch is
PipelineContext#job_options, throughscheduled_source?. It is true only for:security_orchestration_policyor:ondemand_dast_scan. That is why the job options example stays looped per source.
No coverage was removed. Every assertion still runs for every scan type, and the per-source job options check still runs for all four sources.
Spec Run Time Optimization Results
Before optimization:
- 194 examples
- Run time: 0m 38s (37.92s)
After optimization:
- 68 examples
- Run time: 0m 20s (20.10s; a second run gave 20.21s)
Improvement:
- Example count reduced by: 64.9% (194 to 68)
- Run time reduced by: 0m 18s (17.82s)
Verified with:
bundle exec rspec ee/spec/lib/gitlab/ci/config/security_orchestration_policies/processor_spec.rb --dry-run # example count
bundle exec rspec ee/spec/lib/gitlab/ci/config/security_orchestration_policies/processor_spec.rb # full runBoth runs measured in the same local checkout for a fair comparison (same warm Rails boot, same DB/Gitaly state), swapping only this file's content between the pre- and post-optimization version.
bundle exec rubocop ee/spec/lib/gitlab/ci/config/security_orchestration_policies/processor_spec.rb reports no offenses.
Estimated CI Cost Savings
Using the same methodology as this earlier spec optimization MR:
17.82s saved per pipeline × $0.03/minute (large runners: 3x cost factor on $10/1,000 base minutes).
| Scenario | Pipelines/month | Time saved/month | Savings/year |
|---|---|---|---|
| Pessimistic | 15,000 | 74.2h | $1,603.80 |
| Moderate | 30,000 | 148.5h | $3,207.60 |
| Optimistic | 50,000 | 247.5h | $5,346.00 |
How to set up and validate locally
- Checkout this branch.
- Run
bundle exec rspec ee/spec/lib/gitlab/ci/config/security_orchestration_policies/processor_spec.rb. - Confirm 68 examples, 0 failures.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist.