Return evidence id when creating release evidence via API

Manish Kumarrequested to merge
gitlab-community/gitlab-org/gitlab:214819-return-evidence-id-api into master

What does this MR do and why?

Closes #214819

When generating release evidence through the API (POST /projects/:id/releases/:tag_name/evidence), GitLab previously scheduled a background job and returned 202 Accepted with an empty response body. Callers had no identifier or handle to track or retrieve the generated evidence.

This MR resolves this by:

  1. Immediately creating a stub evidence record (with empty summary) in ee/lib/ee/api/releases.rb.
  2. Scheduling CreateEvidenceWorker passing release.id, evidence_pipeline&.id, and evidence.id so the worker asynchronously collects the summary and sha for that specific evidence.
  3. Exposing id in API::Entities::Releases::Evidence alongside sha, filepath, and collected_at.
  4. Returning the serialized evidence record in the 202 Accepted response.
  5. Updating Releases::CreateEvidenceService and Releases::CreateEvidenceWorker to accept an optional evidence: parameter, ensuring 100% backward compatibility with other worker callers and existing in-flight jobs.
  6. Updating OpenAPI v3 documentation (doc/api/openapi/openapi_v3.yaml) and API documentation (doc/api/releases/_index.md).

Verification

  • Added request specs in ee/spec/requests/api/releases_spec.rb verifying response body includes id, job token authorization, and Sidekiq scheduling.
  • Added service specs in spec/services/releases/create_evidence_service_spec.rb testing updates to existing evidence stub without creating duplicate records.
  • Added worker specs in spec/workers/releases/create_evidence_worker_spec.rb ensuring stub evidence is populated when evidence_id is supplied and verifying backward compatibility when omitted.
  • Validated Ruby syntax and OpenAPI specifications across all modified files.

MR Acceptance Checklist

  • Conforms to GitLab Ruby style guidelines
  • Preserves backward compatibility for Sidekiq worker invocations
  • Updated OpenAPI v3 documentation and user API docs
  • Verified with request, service, and worker specs

Merge request reports