Cap the size of each release evidence

What does this MR do and why?

Context

Each release evidence copies the issues of the release's milestones, descriptions included, and nothing bounds its size. This MR is part 1 of the plan in https://gitlab.com/gitlab-org/gitlab/-/work_items/638257#note_4197891367, which has the figures and the approach; parts 2 and 3 have their own MRs.

This MR

• Each evidence is capped by a new ci_cd_settings application setting, release_evidence_max_size_bytes (default 2 MiB). It is on Admin > Settings > CI/CD > Continuous Integration and Deployment and in the application settings API, and 0 disables it.
• The stored issues are never served (the download strips them), so they are trimmed first: their descriptions, then whole issues. Issues are read in batches only until the bytes are spent, so a release with many issues no longer loads all of them.
• The parts users see (release, project, milestones, packages, report artifacts) are never trimmed. They are measured in SQL from column lengths, without loading the text. When they alone exceed the limit, no evidence is collected:
  • the evidence API returns 422 Unprocessable Entity with a message to ask an administrator to raise the limit;
  • a release create still succeeds, and the REST and GraphQL responses include a warnings array, shown as an alert on the release page. An upcoming release gets the warning at create, because its evidence is collected on the release date;
  • Releases::CreateEvidenceWorker checks again before building the evidence, because scheduled releases and imports never pass the request check. It stores nothing and logs the skip with the measured and limit bytes.
• With the flag off, evidence collection is unchanged; the setting is not gated.
• Docs: the release evidence page and the instance limits page, plus the releases and settings APIs. The Changelog entry comes with the flag-removal MR.

Feature Flag: release_evidence_size_limit

References

• https://gitlab.com/gitlab-org/gitlab/-/work_items/638257+
• https://gitlab.com/gitlab-org/gitlab/-/work_items/639446+

Database

New queries, one comment each on the line that runs it, with plans on a production clone. The four measure queries run on every evidence POST and release create while the flag is on, and in the worker; the issue reads run only in the worker.

Screenshots or screen recordings

Admin setting

Admin > Settings > CI/CD > Continuous Integration and Deployment gets a new field.

Before	After

Release page warning

With the flag on, a release created through the form whose evidence would exceed the limit shows this warning on the release page (limit set to 500 B on GDK). On master there is no size check, so no warning appears.

How to set up and validate locally

1. In a Rails console, enable the flag and set a small limit:

   Feature.enable(:release_evidence_size_limit)
   ApplicationSetting.current.update!(release_evidence_max_size_bytes: 1000)

2. Wait a minute for the settings cache. In a project, create a release whose description is longer than 1,000 bytes. The release is created, and the release page shows a warning that no evidence was collected.
3. Collect evidence for it with a personal access token (api scope):

   curl --include --request POST --header "PRIVATE-TOKEN: <your_access_token>" \
     "http://gdk.test:3000/api/v4/projects/<project_id>/releases/<tag_name>/evidence"

   It returns 422 with the size-limit message.
4. Set the limit back to 2097152 and repeat the call: it returns 202, and the evidence appears on the release.
5. Clean up: Feature.remove(:release_evidence_size_limit).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.