Support finding Sbom::Occurrences via dependency names
What does this MR do and why?
This MR:
- Adds
Query.components
to findSbom::Components
by their name - Changes
Sbom::DependenciesFinder
to support looking up bycomponent_ids
For performance reasons (see !153596 (comment 1927321689) and https://gitlab.slack.com/archives/CNZ8E900G/p1722605163019149) we:
- First have the user select names of the dependencies for which they want to see the vulnerabilities
- Find them using
Sbom::DependenciesFinder
usingcomponent_id
only so we don't perform a join
Related to #454305 (closed)
Database review
component_id
Look up Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/30655/commands/95150
Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/30655/commands/95151
Sbom::Occurrences
Look up I believe the initial slowness here stems from the AS MATERIALIZED
Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96309
Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96310
Sbom::Occurrences
using AggregationsFinder
Look up Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96306
Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96308