Add post deployment migration for cleanup policies

that are enabled but linked to no container repositories.

Changelog: performance

db/post_migrate/20210610141711_disable_expiration_policies_linked_to_no_container_images.rb

+# frozen_string_literal: true
+
+class DisableExpirationPoliciesLinkedToNoContainerImages < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+
+  BATCH_SIZE = 1000
+
+  class ContainerExpirationPolicy < ActiveRecord::Base
+    include ::EachBatch
+    self.table_name = 'container_expiration_policies'
+  end
+
+  def up
+    ContainerExpirationPolicy.where(enabled: true).each_batch(of: BATCH_SIZE) do |batch, _|
+      sql = <<-SQL
+        WITH batched_relation AS #{Gitlab::Database::AsWithMaterialized.materialized_if_supported} (#{batch.limit(BATCH_SIZE).to_sql})
+        UPDATE container_expiration_policies
+        SET enabled = FALSE
+        FROM batched_relation
+        WHERE container_expiration_policies.project_id = batched_relation.project_id
+        AND NOT EXISTS (SELECT 1 FROM "container_repositories" WHERE container_repositories.project_id = container_expiration_policies.project_id)
+      SQL
+      execute(sql)
+    end
+  end
+
+  def down
+    # no-op
+
+    # we can't accuretaly know which policies were previously enabled during `#up`
+  end
+end

db/schema_migrations/20210610141711

+b8bfe0d67516f0fe71c166a616c2279fc9f45769c369d8ddd86e9705dbc55097
\ No newline at end of file

spec/migrations/disable_expiration_policies_linked_to_no_container_images_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+require_migration!
+
+RSpec.describe DisableExpirationPoliciesLinkedToNoContainerImages do
+  let(:projects) { table(:projects) }
+  let(:container_expiration_policies) { table(:container_expiration_policies) }
+  let(:container_repositories) { table(:container_repositories) }
+  let(:namespaces) { table(:namespaces) }
+
+  let!(:namespace) { namespaces.create!(name: 'test', path: 'test') }
+  let!(:project) { projects.create!(id: 1, namespace_id: namespace.id, name: 'gitlab1') }
+  let!(:container_expiration_policy) { container_expiration_policies.create!(project_id: project.id, enabled: true) }
+
+  before do
+    projects.create!(id: 2, namespace_id: namespace.id, name: 'gitlab2')
+    container_expiration_policies.create!(project_id: 2, enabled: true)
+    container_repositories.create!(id: 1, project_id: 2, name: 'image2')
+
+    projects.create!(id: 3, namespace_id: namespace.id, name: 'gitlab3')
+    container_expiration_policies.create!(project_id: 3, enabled: false)
+    container_repositories.create!(id: 2, project_id: 3, name: 'image3')
+  end
+
+  it 'correctly disable expiration policies linked to no container images' do
+    expect(enabled_policies.count).to eq 2
+    expect(disabled_policies.count).to eq 1
+    expect(container_expiration_policy.enabled).to eq true
+
+    migrate!
+
+    expect(enabled_policies.count).to eq 1
+    expect(disabled_policies.count).to eq 2
+    expect(container_expiration_policy.reload.enabled).to eq false
+  end
+
+  def enabled_policies
+    container_expiration_policies.where(enabled: true)
+  end
+
+  def disabled_policies
+    container_expiration_policies.where(enabled: false)
+  end
+end