Merge branch...

Merge branch '330882-dependency-scanning-vulnerability-reports-a-lot-of-duplicate-links' into 'master'

Use Feature Flag for Finding Links

See merge request gitlab-org/gitlab!66868

config/feature_flags/development/vulnerability_finding_replace_metadata.yml

+---
+name: vulnerability_finding_replace_metadata
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66868
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/337253
+group: group::threat insights
+type: development
+default_enabled: false
\ No newline at end of file

ee/app/models/vulnerabilities/finding.rb

@@ -209,7 +209,7 @@ module Vulnerabilities
     end
 
     def links
-      return metadata.fetch('links', []) if finding_links.load.empty?
+      return metadata.fetch('links', []) if Feature.disabled?(:vulnerability_finding_replace_metadata) || finding_links.load.empty?
 
       finding_links.as_json(only: [:name, :url])
     end

ee/spec/models/vulnerabilities/finding_spec.rb

@@ -12,6 +12,7 @@ RSpec.describe Vulnerabilities::Finding do
   with_them do
     before do
       stub_feature_flags(vulnerability_finding_tracking_signatures: vulnerability_finding_signatures_enabled)
+      stub_feature_flags(vulnerability_finding_replace_metadata: false)
       stub_licensed_features(vulnerability_finding_signatures: vulnerability_finding_signatures_enabled)
     end
 
@@ -360,7 +361,7 @@ RSpec.describe Vulnerabilities::Finding do
         create(
           :vulnerabilities_finding,
           raw_metadata: {
-            links: [{ url: 'https://raw.gitlab.com', name: 'raw_metadata_link' }]
+            links: [{ url: 'https://raw.example.com', name: 'raw_metadata_link' }]
           }.to_json
         )
       end
@@ -369,15 +370,27 @@ RSpec.describe Vulnerabilities::Finding do
 
       context 'when there are no finding links' do
         it 'returns links from raw_metadata' do
-          expect(links).to eq([{ 'url' => 'https://raw.gitlab.com', 'name' => 'raw_metadata_link' }])
+          expect(links).to eq([{ 'url' => 'https://raw.example.com', 'name' => 'raw_metadata_link' }])
         end
       end
 
       context 'when there are finding links assigned to given finding' do
-        let_it_be(:finding_link) { create(:finding_link, name: 'finding_link', url: 'https://link.gitlab.com', finding: finding) }
+        let_it_be(:finding_link) { create(:finding_link, name: 'finding_link', url: 'https://link.example.com', finding: finding) }
 
-        it 'returns links from finding link' do
-          expect(links).to eq([{ 'url' => 'https://link.gitlab.com', 'name' => 'finding_link' }])
+        context 'when the feature flag is enabled' do
+          before do
+            stub_feature_flags(vulnerability_finding_replace_metadata: true)
+          end
+
+          it 'returns links from finding link' do
+            expect(links).to eq([{ 'url' => 'https://link.example.com', 'name' => 'finding_link' }])
+          end
+        end
+
+        context 'when the feature flag is disabled' do
+          it 'returns links from raw_metadata' do
+            expect(links).to eq([{ 'url' => 'https://raw.example.com', 'name' => 'raw_metadata_link' }])
+          end
         end
       end
     end