Set tracked context on trigger-created vulnerability reads

What does this MR do and why?

Fixes a regression from commit d9418042 ("Add finding to upsert service & callers"). It only happens when the turn_off_vulnerability_read_create_db_trigger_function flag is off (the default while it rolls out).

The problem

1. CreateServiceBase sets the default-branch tracked context on the finding.
2. In the transaction, finding.update!(vulnerability_id: ...) fires the insert_or_update_vulnerability_reads DB trigger. The trigger doesn't know about the tracked context column, so the new vulnerability_reads row has a NULL context.
3. UpsertService sees the read already exists and runs update_all(security_project_tracked_context_id: X).
4. That update is now scoped with by_tracked_context(X), which doesn't match the NULL row. The context is never set.

The existing spec passes only because specs enable all feature flags, which skips the trigger path. StarboardVulnerabilityCreateService follows the same pattern and is affected the same way.

The fix

In ee/app/services/vulnerabilities/reads/upsert_service.rb, the update now also matches reads with no context: reads.by_tracked_context([context_id, nil]). Reads assigned to a different context are still left alone.

References

• #608065 (closed) (issue where this was found)
• #553939 (trigger flag rollout)
• d9418042 (regression commit)

How to set up and validate locally

1. In a Rails console, run Feature.disable(:turn_off_vulnerability_read_create_db_trigger_function).
2. Create a vulnerability manually, either from Secure > Vulnerability report > Submit vulnerability, or with the vulnerabilityCreate GraphQL mutation.
3. In the console, check that Vulnerability.last.vulnerability_read.security_project_tracked_context_id is present and equals Vulnerability.last.finding.security_project_tracked_context_id. Before the fix it was nil.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code