Fix the flakiness of SetReportTypeForVulnerabilities migration

db/post_migrate/20191105094625_set_report_type_for_vulnerabilities.rb

@@ -4,12 +4,20 @@ class SetReportTypeForVulnerabilities < ActiveRecord::Migration[5.2]
   DOWNTIME = false
 
   def up
-    # set report_type based on associated vulnerability_occurrences
+    # set report_type based on vulnerability_occurrences from which the vulnerabilities were promoted,
+    # that is, first vulnerability_occurrences among those having the same vulnerability_id
     execute <<~SQL
+    WITH first_findings_for_vulnerabilities AS (
+      SELECT MIN(id) AS id, vulnerability_id
+      FROM vulnerability_occurrences
+      WHERE vulnerability_id IS NOT NULL
+      GROUP BY vulnerability_id
+    )
     UPDATE vulnerabilities
     SET report_type = vulnerability_occurrences.report_type
-    FROM vulnerability_occurrences
-    WHERE vulnerabilities.id = vulnerability_occurrences.vulnerability_id
+    FROM vulnerability_occurrences, first_findings_for_vulnerabilities
+    WHERE vulnerability_occurrences.id = first_findings_for_vulnerabilities.id
+    AND vulnerabilities.id = vulnerability_occurrences.vulnerability_id
     SQL
 
     # set default report_type for orphan vulnerabilities (there should be none but...)