<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=597916) </details> <!--IssueSummary end--> ## Summary Dual-write violation details into the new `scan_result_policy_violation_details` table alongside the existing `violation_data` JSONB blob on `scan_result_policy_violations`. This is the runtime counterpart to the backfill in [#597917](https://gitlab.com/gitlab-org/gitlab/-/work_items/597917) and unblocks the GraphQL surface in [#597914](https://gitlab.com/gitlab-org/gitlab/-/work_items/597914) / [#597915](https://gitlab.com/gitlab-org/gitlab/-/work_items/597915). ## Background POC [!232424](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/232424) productionises the approach: after each policy evaluation, `Security::SecurityOrchestrationPolicies::UpdateViolationsService` invokes a new `CreateViolationDetailsService` that, in one transaction: 1. Deletes existing `scan_result_policy_violation_details` rows for the violations being updated 2. `insert_all`s freshly built rows derived from the in-memory `violation_data` hash and a per-rule `violation_detail_data` hash (used to carry full counts for arrays that get truncated) The dual-write must be gated behind the same feature flag as the GraphQL field, `security_policy_violations_graphql_field`, so it can be rolled out and rolled back independently of the consumers. ## Scope 1. **Hook into `UpdateViolationsService`**: after policy rules are evaluated and the JSONB `violation_data` is persisted, call `CreateViolationDetailsService.new(merge_request:, violation_data:, violation_detail_data:).execute(violation_attrs)`. 2. **Implement `CreateViolationDetailsService`** with the mapping rules from the POC: - `scan_finding` → rows per UUID with `finding_state ∈ {newly_detected, previously_existing}` - `license_scanning` → rows per `(license_name, components[])`, `dependencies` truncated to `MAX_ARRAY_LIMIT` (10), full count stored in `metadata.total_dependencies_count` - `any_merge_request` → single row per violation with `commit_shas` truncated to `MAX_ARRAY_LIMIT`, full count stored in `metadata.total_commit_shas_count` 3. **Carry total counts from evaluation services**: - `Security::ScanResultPolicies::SyncAnyMergeRequestRulesService` must capture `unsigned_commits.size` before `trim_violations` and pass it via `violations.add_violation_detail_metadata(rule, total_commit_shas_count: count)` - `Security::ScanResultPolicies::UpdateLicenseApprovalsService#rule_violated?` must return the full `denied_licenses_with_dependencies` hash so `evaluation.add_detail_metadata!(approval_rule, total_dependencies_by_license: denied_licenses.transform_values(&:size))` can be called 4. **Update `PolicyRuleEvaluationService`** to expose `add_detail_metadata!(approval_rule, metadata)` that delegates to `violations.add_violation_detail_metadata(approval_rule.approval_policy_rule, metadata)`. Also switch all `approval_rule.scan_result_policy_read` references in `pass!`, `fail!`, `error!`, `skip!` to `approval_rule.approval_policy_rule`, matching the POC. 5. **Feature flag**: wrap the dual-write call in `Feature.enabled?(:security_policy_violations_graphql_field, project)` so it can be toggled per project. The JSONB write path remains unconditional. ## Acceptance criteria - [ ] `CreateViolationDetailsService` implemented per POC mapping, with `MAX_ARRAY_LIMIT = 10` truncation and metadata counts - [ ] Service is invoked from `UpdateViolationsService` after each evaluation when the FF is enabled - [ ] Dual-write is transactional and idempotent (delete-then-`insert_all` per violation) - [ ] `SyncAnyMergeRequestRulesService` and `UpdateLicenseApprovalsService` propagate total counts via `add_violation_detail_metadata` / `add_detail_metadata!` - [ ] `PolicyRuleEvaluationService` routes through `approval_policy_rule` (not `scan_result_policy_read`) - [ ] Feature flag `security_policy_violations_graphql_field` controls the new write path; JSONB `violation_data` writes unchanged - [ ] Specs cover all three `policy_rule_type` paths, truncation + metadata count, FF off path, and idempotency ## References - POC: [!232424](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/232424) — see `ee/app/services/security/security_orchestration_policies/create_violation_details_service.rb` - Schema: [#597912](https://gitlab.com/gitlab-org/gitlab/-/work_items/597912) - Backfill: [#597917](https://gitlab.com/gitlab-org/gitlab/-/work_items/597917) - Parent epic: [&20877](https://gitlab.com/groups/gitlab-org/-/work_items/20877)