Changes from review

Remove unneeded test
Moved logic to project model

ee/app/models/ee/merge_request.rb

@@ -271,7 +271,7 @@ module EE
     end
 
     def security_reports_up_to_date?
-      project.latest_pipeline_with_security_reports(only_successful: true) == project.all_pipelines.newest_first(ref: target_branch).take
+      project.security_reports_up_to_date_for_ref?(target_branch)
     end
 
     private

ee/app/models/ee/project.rb

@@ -297,6 +297,10 @@ module EE
       all_pipelines.newest_first(ref: default_branch).with_reports(reports).take
     end
 
+    def security_reports_up_to_date_for_ref?(ref)
+      latest_pipeline_with_security_reports(only_successful: true) == ci_pipelines.newest_first(ref: ref).take
+    end
+
     def ensure_external_webhook_token
       return if external_webhook_token.present?
 

ee/spec/graphql/ee/types/merge_request_type_spec.rb

@@ -8,33 +8,4 @@ RSpec.describe GitlabSchema.types['MergeRequest'] do
   it { expect(described_class).to have_graphql_field(:approvals_left, complexity: 2, calls_gitaly?: true) }
   it { expect(described_class).to have_graphql_field(:has_security_reports, calls_gitaly?: true) }
   it { expect(described_class).to have_graphql_field(:security_reports_up_to_date_on_target_branch, calls_gitaly?: true) }
-
-  describe '#security_reports_up_to_date_on_target_branch' do
-    subject(:execute_query) { GitlabSchema.execute(query, context: { current_user: current_user }).as_json }
-
-    let!(:merge_request) { create(:merge_request, target_project: project, source_project: project) }
-    let(:project) { create(:project, :public) }
-    let(:current_user) { create :admin }
-    let(:query) do
-      %(
-        {
-          project(fullPath: "#{project.full_path}") {
-            mergeRequests {
-              nodes {
-                securityReportsUpToDateOnTargetBranch
-              }
-            }
-          }
-        }
-      )
-    end
-
-    it 'delegates the security_reports_up_to_date? call to the merge request entity' do
-      expect_next_found_instance_of(MergeRequest) do |instance|
-        expect(instance).to receive(:security_reports_up_to_date?)
-      end
-
-      execute_query
-    end
-  end
 end

ee/spec/models/project_spec.rb

@@ -1704,6 +1704,34 @@ RSpec.describe Project do
     end
   end
 
+  describe '#security_reports_up_to_date_for_ref?' do
+    let_it_be(:project) { create(:project, :repository) }
+    let_it_be(:merge_request) do
+      create(:ee_merge_request,
+             source_project: project,
+             source_branch: 'feature1',
+             target_branch: project.default_branch)
+    end
+
+    let_it_be(:pipeline) do
+      create(:ee_ci_pipeline,
+             :with_sast_report,
+             project: project,
+             ref: merge_request.target_branch)
+    end
+
+    subject { project.security_reports_up_to_date_for_ref?(merge_request.target_branch) }
+
+    context 'when the target branch security reports are up to date' do
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when the target branch security reports are out of date' do
+      let_it_be(:bad_pipeline) { create(:ee_ci_pipeline, :failed, project: project, ref: merge_request.target_branch) }
+      it { is_expected.to be_falsy }
+    end
+  end
+
   describe '#protected_environment_by_name' do
     let_it_be(:project) { create(:project) }