[Backend] Update graphql query to include Code Quality reports and match expected response structure
### Overview
In order to display [SAST](https://docs.gitlab.com/ee/user/application_security/sast/) and [Code Quality](https://docs.gitlab.com/ee/ci/testing/code_quality.html) findings in a merge request diff view, we have to reuse the `findingReportsComparer` field introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/122339 (as part of the effort to [expose merge request security findings publicly](https://gitlab.com/gitlab-org/gitlab/-/issues/408350)).
By using the graphql query `getMRSecurityReport` which exposes this field, we will also have the advantage of being able to display other types of security findings later on. There are a couple of ceveats though, that we have to work on to ensure we can smoothly integrate this endpoint with the rest of ~frontend work introduced in this [parent epic](https://gitlab.com/groups/gitlab-org/-/epics/10958).
### But, why?
Please refer to [this comment](https://gitlab.com/gitlab-org/gitlab/-/issues/393045#note_1500489441) to read through first, as it captures the current state of endpoints returning `codequality` reports to be displayed in merge requests (whether in the widget or in diff/changes tab).
The comment also provides a good overview of the thought process behind the [proposal](https://gitlab.com/groups/gitlab-org/-/epics/10995#proposals) below.
### Ceveats
Below are the ceveats mentioned above. For each one of them, we have created a child issue to ensure we work in iterations, and we have the smallest [viable and valuable change](https://handbook.gitlab.com/handbook/values/#iteration) delivered.
_:one: GraphQL field does not include Code Quality reports as of now._
The `findingReportsComparer` field doesn't allow specifying `CodeQuality` reports as a `report_type` because the underlying implementation depends on [resolving](https://gitlab.com/gitlab-org/gitlab/-/blob/c66944f4708dbc1a95e25306165e7cf217b8cf4d/ee/app/graphql/resolvers/security_report/finding_reports_comparer_resolver.rb#L18) those reports via [`Security::MergeRequestSecurityReportGenerationService`](https://gitlab.com/gitlab-org/gitlab/-/blob/c66944f4708dbc1a95e25306165e7cf217b8cf4d/ee/app/services/security/merge_request_security_report_generation_service.rb) service class, which doesn't include code quality reports.
This is because `code_quality` reports have a slightly different format than other security reports generated by that service class.
_:two: Expected response structure doesn't match current designs._
The [current design](https://gitlab.com/gitlab-org/gitlab/-/issues/415112) (see particularly this [overview mockup](https://gitlab.com/gitlab-org/gitlab/-/issues/415112/designs/Overview_-_click_SAST_finding.png)) requires a few more fields to be present in the structure of the `FindingType` objects, namely:
1. `location` object (to be able to present the file path and starting line).
2. `identifiers` object (so it can present more information on this type of vulnerability).
### Proposals
**:one: Create new graphql field to represent Code Quality reports.**
To ensure Code Quality reports can be queried via the same GraphQL query, we have to create a new field similar to [`findingReportsComparer`](https://gitlab.com/gitlab-org/gitlab/-/blob/c7e80813307fbf51c070a12c17cc48dd1690799f/ee/app/graphql/ee/types/merge_request_type.rb#L59-64). The new field, let's say is called `codequalityReportsComparer`, would need to:
* Have a new resolver to retrieve codequality degradations of a certain merge request.
* Can be achieved by calling [`MergeRequest#compare_codequality_reports`](https://gitlab.com/gitlab-org/gitlab/-/blob/c66944f4708dbc1a95e25306165e7cf217b8cf4d/app/models/merge_request.rb#L1693-1699) method.
* Have a corresponding type, similar to the existing entity, [`CodequalityReportsComparerEntity`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/serializers/codequality_reports_comparer_entity.rb).
* We may need to create some GraphQL type and entities for that structure (if they don't exist already).
* Be added behind [`sast_reports_in_inline_diff`](https://gitlab.com/gitlab-org/gitlab/-/issues/410191) feature flag.
* Be [marked as an alpha](https://docs.gitlab.com/ee/development/api_graphql_styleguide.html#mark-schema-items-as-alpha) field.
Please see the diagram below for an overview of how the overall setup:
```mermaid
flowchart TB
T["EE::Types::MergeRequestType / Types::MergeRequestType"]
A[findingReportsComparer]
Z[codequalityReportsComparer]
Y[CodequalityReportsComparerResolver]
B[FindingReportsComparerResolver]
T-->A
T-->Z
A-->B
Z-->Y
C[MergeRequestSecurityReportGenerationService]
D[MergeRequest#compare_codequality_reports]
B-->C
Y-->D
E[CompareCodequalityReportsService]
F[CompareSecurityReportsService]
D-->E
C-->F
```
The goal here is to ensure both `sast` and `code_quality` reports can be queried as follows:
```graphql
query getMRSecurityReport {
project(fullPath: "gitlab-org/govern/threat-insights-demos/frontend/security-reports") {
mergeRequest(iid: "1") {
title
hasSecurityReports
codequalityReportsComparer {
report {
status
newErrors {
description
severity
filePath
line
webUrl
engineName
}
resolvedErrors {
description
severity
filePath
line
webUrl
engineName
}
existingErrors {
description
severity
filePath
line
webUrl
engineName
}
summary {
totalCount
resolvedCount
errorsCount
}
}
}
sastReport: findingReportsComparer(reportType: SAST) {
status
report {
headReportCreatedAt
baseReportCreatedAt
baseReportOutOfDate
added {
uuid
title
description
state
severity
foundByPipelineIid
location {
...on
VulnerabilityLocationSast {
file
startLine
endLine
vulnerableClass
vulnerableMethod
blobPath
}
}
identifiers
}
fixed {
uuid
title
description
state
severity
foundByPipelineIid
location {
...on
VulnerabilityLocationSast {
file
startLine
endLine
vulnerableClass
vulnerableMethod
blobPath
}
}
identifiers
}
}
}
}
}
}
```
**:two: Update `FindingType` to include `location` and `identifiers` objects.**
To ensure both `location` and `identifiers` objects are available in the response of `getMRSecurityReport` query, they have to be included in [`FindingType`](https://gitlab.com/gitlab-org/gitlab/-/blob/26e351f57204bea649da081cc6dd5ea98f1c93e8/ee/app/graphql/types/security/finding_reports_comparer/finding_type.rb) graphql type. If no corresponding types and resolvers exist for those kind of objects already, they also need to be created to ensure appropriate representation of them.
### Later Work
Based on this [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/393045#note_1500489441), we might want to consider the following actions (can be added as issues to this epic later on):
- Deprecate and remove `/codequality_mr_diff_reports` internal endpoint.
- Stop creating pipeline artifacts for `codequality_mr_diff_reports` report (check [this service class](https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/services/ci/pipeline_artifacts/create_code_quality_mr_diff_report_service.rb?ref_type=heads)).
epic