Thanks for working on this, LGTM @bryan_valdiviezo. Left one non-blocking suggestion, setting to merge 🚀

What does this MR do and why?

Problem

When multiple SAST scans run in the same pipeline (e.g., from different sources), the vulnerability ingestion process did not consistently prioritize Scan Execution Policy (SEP) results. This could result in inconsistent vulnerability severity reporting depending on scan completion order.

Solution

Implemented artifact ordering in StoreGroupedScansService to ensure SEP artifacts are processed first during the ingestion phase. This guarantees that SEP scan findings are consistently selected for ingestion, providing predictable and enforced security scan results.

Impact

• Vulnerability reports now consistently reflect SEP scan results regardless of scan completion order
• Organizations can rely on SEP to enforce uniform security scan configurations across projects
• Improved predictability and consistency in security vulnerability reporting

References

Screenshots or screen recordings

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to: https://gitlab.com/gitlab-org/gitlab/-/work_items/500901

suggestion(test, non-blocking): I think report_2 is not used

Ugo Nnanna Okeadu (e0442d99) at 17 Mar 19:21

Ugo Nnanna Okeadu (7b666ff7) at 17 Mar 18:31

@bryan_valdiviezo any updates here?

Ugo Nnanna Okeadu (c0360d8f) at 17 Mar 17:24

Ugo Nnanna Okeadu (b7bea172) at 17 Mar 17:19

note: the query plan will be updated with the link once Add vulnerability_finding_due_dates table to st... (!226308) is merged.

@bryan_valdiviezo Could you please do the initial backend review?

@subashis Could you please do the initial database review and then forward it to @bwill for remaining approvals?

Ugo Nnanna Okeadu (0b81f673) at 17 Mar 16:51

Ugo Nnanna Okeadu (78a4698b) at 17 Mar 16:20

Not applicable anymore

Ugo Nnanna Okeadu (488eb4f3) at 17 Mar 15:32

Ugo Nnanna Okeadu (2ce1dd99) at 17 Mar 15:12

@subashis This is not needed see Add vulnerability finding due dates upsert service (!227665), removing scope.

Ugo Nnanna Okeadu (26ad412e) at 17 Mar 15:09

I would like to join reviewers for this if we change idea 🙂