feat(remediation): use rescored severity

[kanstantsinbuklis-sap]

Description

In this PR I've added logic related to the rescored remediation type

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation Update
• 🎨 Style
• 🧑‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🤖 Build
• 🔁 CI
• 📦 Chore (Release)
• ⏩ Revert

Related Tickets & Documents

• Related Issue feat(remediation): use rescored severity #1290

Added tests?

• 👍 yes
• 🙅 no, because they aren't needed
• 🙋 no, because I need help
• Separate ticket for tests # (issue/pr)

Added to documentation?

• 📜 README.md
• 🤝 Documentation pages updated
• 🙅 no documentation needed
• (if applicable) generated OpenAPI docs for CRD changes

[Copilot]

🟡 Changes recommended

It introduces a panic-stuck risk in the async MV trigger path and a join strategy in the batch vulnerability query that can unnecessarily multiply rows and degrade performance at scale.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the MariaDB materialized-view refresh logic and the image vulnerability batch query so that rescore remediations affect the severity shown to API/UI consumers (including service-scoped views), and wires remediation changes to trigger MV refreshes and cache invalidation.

Changes:

• Apply rescore remediation severity when computing vulnerability severities in MV refresh procedures and service-scoped views.
• Extend GetVulnerabilitiesByComponentIDs to accept optional service CCRNs and use mvVulnerabilityService.max_severity where applicable.
• Trigger MV refresh asynchronously on remediation create/update/delete events and invalidate related caches; add targeted tests.

File summaries

File	Description
internal/database/mariadb/test/fixture.go	Adds seeder helper for refreshing mvVulnerabilityService.
internal/database/mariadb/mvproc.go	Introduces reusable SQL expressions for effective severity and adjusts MV refresh queries to account for rescore remediations.
internal/database/mariadb/mve.go	Adds async trigger coalescing for MV refresh runs.
internal/database/mariadb/mv_vulnerabilities_test.go	Adds tests validating rescore behavior (rebucketing vs suppression; service scoping).
internal/database/mariadb/migrations/20260909120000_add_max_severity_to_mv_vulnerability_service.up.sql	Adds max_severity column to mvVulnerabilityService.
internal/database/mariadb/migrations/20260909120000_add_max_severity_to_mv_vulnerability_service.down.sql	Drops max_severity column on rollback.
internal/database/mariadb/image_batch.go	Extends batch vulnerability preload to compute effective severity with optional service CCRN scoping.
internal/database/interface.go	Updates DB interface for new GetVulnerabilitiesByComponentIDs signature.
internal/app/remediation/remediation_handler.go	Invalidates image/vulnerability-related caches on remediation create/update/delete.
internal/app/heureka.go	Subscribes to remediation change events to trigger MV refresh asynchronously.
internal/app/component/component_handler_interface.go	Updates component handler interface for new vulnerability batch signature.
internal/app/component/component_handler_batch.go	Passes service CCRNs into cached vulnerability batch calls.
internal/app/comment/comment_handler_test.go	Minor formatting-only change.
internal/api/graphql/graph/baseResolver/image.go	Passes service filter into vulnerability batch preload.

Review details

Suppressed comments (1)

internal/database/mariadb/image_batch.go:341

• The current LEFT JOIN on mvVulnerabilityService is only by issue_id; for issues present in many services this multiplies rows before the GROUP BY, even though only a small set of service CCRNs is needed. Constrain the join to the target services up front (e.g., via a service_id subquery) and drop the extra Service join.

		query = query.
			LeftJoin("mvVulnerabilityService MVS ON MVS.issue_id = I.issue_id").
			LeftJoin(fmt.Sprintf("Service S ON S.service_id = MVS.service_id AND S.service_ccrn IN (%s)", inPlaceholders), ccrnArgs...)
	}

• Files reviewed: 14/14 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

There is a confirmed race condition in the new async MV trigger implementation (and a nondeterministic SQL ordering in latest-rescore selection) that can lead to incorrect concurrent refresh behavior and unstable severity results.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 3
• Review effort level: Lite

[michalkrzyz]

Very good job.

[michalkrzyz]

nit: Could you use squirrel in this query?