Skip to content

Support finding Sbom::Occurrences via dependency names

What does this MR do and why?

This MR:

  1. Adds Query.components to find Sbom::Components by their name
  2. Changes Sbom::DependenciesFinder to support looking up by component_ids

For performance reasons (see !153596 (comment 1927321689) and https://gitlab.slack.com/archives/CNZ8E900G/p1722605163019149) we:

  1. First have the user select names of the dependencies for which they want to see the vulnerabilities
  2. Find them using Sbom::DependenciesFinder using component_id only so we don't perform a join

Related to #454305 (closed)

Database review

Look up component_id

Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/30655/commands/95150

Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/30655/commands/95151

Look up Sbom::Occurrences

I believe the initial slowness here stems from the AS MATERIALIZED

Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96309

Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96310

Look up Sbom::Occurrences using AggregationsFinder

Cold cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96306

Warm cache: https://console.postgres.ai/gitlab/gitlab-production-main/sessions/31008/commands/96308

Edited by Michał Zając

Merge request reports

Loading