Remove core_security_mr_widget feature flag

Addresses https://gitlab.com/gitlab-org/gitlab/-/issues/249550, part of
https://gitlab.com/groups/gitlab-org/-/epics/4393.

app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue

@@ -181,7 +181,7 @@ export default {
       );
     },
     shouldRenderSecurityReport() {
-      return Boolean(window.gon?.features?.coreSecurityMrWidget && this.mr.pipeline.id);
+      return Boolean(this.mr.pipeline.id);
     },
     mergeError() {
       let { mergeError } = this.mr;

app/controllers/projects/merge_requests_controller.rb

@@ -36,7 +36,6 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     push_frontend_feature_flag(:drag_comment_selection, @project, default_enabled: true)
     push_frontend_feature_flag(:unified_diff_components, @project, default_enabled: true)
     push_frontend_feature_flag(:default_merge_ref_for_diffs, @project)
-    push_frontend_feature_flag(:core_security_mr_widget, @project, default_enabled: true)
     push_frontend_feature_flag(:core_security_mr_widget_counts, @project)
     push_frontend_feature_flag(:remove_resolve_note, @project, default_enabled: true)
     push_frontend_feature_flag(:diffs_gradual_load, @project, default_enabled: true)

config/feature_flags/development/core_security_mr_widget.yml

----
-name: core_security_mr_widget
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/44639
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/249543
-milestone: '13.5'
-type: development
-group: group::static analysis
-default_enabled: true

doc/user/application_security/index.md

@@ -128,14 +128,7 @@ with this approach, however, and there is a
 > - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/4393) in GitLab Free 13.5.
 > - Made [available in all tiers](https://gitlab.com/gitlab-org/gitlab/-/issues/273205) in 13.6.
 > - Report download dropdown [added](https://gitlab.com/gitlab-org/gitlab/-/issues/273418) in 13.7.
-> - It's [deployed behind a feature flag](../feature_flags.md), enabled by default.
-> - It's enabled on GitLab.com.
-> - It can be enabled or disabled for a single project.
-> - It's recommended for production use.
-> - For GitLab self-managed instances, GitLab administrators can opt to [disable it](#enable-or-disable-the-basic-security-widget). **(FREE SELF)**
-
-WARNING:
-This feature might not be available to you. Check the **version history** note above for details.
+> - [Feature flag removed](https://gitlab.com/gitlab-org/gitlab/-/issues/249550) in GitLab 13.9.
 
 Merge requests which have run security scans let you know that the generated
 reports are available to download. To download a report, click on the
@@ -667,31 +660,6 @@ Analyzer results are displayed in the [job logs](../../ci/jobs/index.md#expand-a
 or [Security Dashboard](security_dashboard/index.md).
 There is [an open issue](https://gitlab.com/gitlab-org/gitlab/-/issues/235772) in which changes to this behavior are being discussed.
 
-### Enable or disable the basic security widget **(FREE SELF)**
-
-The basic security widget is under development but ready for production use.
-It is deployed behind a feature flag that is **enabled by default**.
-[GitLab administrators with access to the GitLab Rails console](../feature_flags.md)
-can opt to disable it.
-
-To enable it:
-
-```ruby
-# For the instance
-Feature.enable(:core_security_mr_widget)
-# For a single project
-Feature.enable(:core_security_mr_widget, Project.find(<project id>))
-```
-
-To disable it:
-
-```ruby
-# For the instance
-Feature.disable(:core_security_mr_widget)
-# For a single project
-Feature.disable(:core_security_mr_widget, Project.find(<project id>))
-```
-
 ### Error: job `is used for configuration only, and its script should not be executed`
 
 [Changes made in GitLab 13.4](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/41260)

ee/spec/frontend/vue_mr_widget/ee_mr_widget_options_spec.js

@@ -1007,12 +1007,11 @@ describe('ee merge request widget options', () => {
 
   describe('CE security report', () => {
     describe.each`
-      context                               | canReadVulnerabilities | hasPipeline | featureFlag | shouldRender
-      ${'user cannot read vulnerabilities'} | ${false}               | ${true}     | ${true}     | ${true}
-      ${'user can read vulnerabilities'}    | ${true}                | ${true}     | ${true}     | ${false}
-      ${'no pipeline'}                      | ${false}               | ${false}    | ${true}     | ${false}
-      ${'the feature flag is disabled'}     | ${false}               | ${true}     | ${false}    | ${false}
-    `('given $context', ({ canReadVulnerabilities, hasPipeline, featureFlag, shouldRender }) => {
+      context                               | canReadVulnerabilities | hasPipeline | shouldRender
+      ${'user cannot read vulnerabilities'} | ${false}               | ${true}     | ${true}
+      ${'user can read vulnerabilities'}    | ${true}                | ${true}     | ${false}
+      ${'no pipeline'}                      | ${false}               | ${false}    | ${false}
+    `('given $context', ({ canReadVulnerabilities, hasPipeline, shouldRender }) => {
       beforeEach(() => {
         gl.mrWidgetData = {
           ...mockData,
@@ -1020,8 +1019,6 @@ describe('ee merge request widget options', () => {
           pipeline: hasPipeline ? mockData.pipeline : undefined,
         };
 
-        gon.features = { coreSecurityMrWidget: featureFlag };
-
         createComponent({
           propsData: { mrData: gl.mrWidgetData },
           apolloProvider: createMockApollo([

spec/frontend/vue_mr_widget/mr_widget_options_spec.js

@@ -821,14 +821,11 @@ describe('MrWidgetOptions', () => {
 
   describe('security widget', () => {
     describe.each`
-      context                             | hasPipeline | isFlagEnabled | shouldRender
-      ${'has pipeline and flag enabled'}  | ${true}     | ${true}       | ${true}
-      ${'has pipeline and flag disabled'} | ${true}     | ${false}      | ${false}
-      ${'no pipeline and flag enabled'}   | ${false}    | ${true}       | ${false}
-    `('given $context', ({ hasPipeline, isFlagEnabled, shouldRender }) => {
+      context                  | hasPipeline | shouldRender
+      ${'there is a pipeline'} | ${true}     | ${true}
+      ${'no pipeline'}         | ${false}    | ${false}
+    `('given $context', ({ hasPipeline, shouldRender }) => {
       beforeEach(() => {
-        gon.features.coreSecurityMrWidget = isFlagEnabled;
-
         const mrData = {
           ...mockData,
           ...(hasPipeline ? {} : { pipeline: null }),