Add feature flag to highest role callback

Put the update highest role callback for Members behind a feature flag
because there needs to be an additional callback when a User does not
count as active anymore.

app/models/member.rb

@@ -468,6 +468,7 @@ class Member < ApplicationRecord
   # for a Member to be commited before attempting to update the highest role.
   # rubocop: disable CodeReuse/ServiceClass
   def update_highest_role
+    return unless Feature.enabled?(:highest_role_callback)
     return unless user_id.present?
     return unless previous_changes[:access_level].present?
 

spec/models/member_spec.rb

@@ -586,6 +586,7 @@ describe Member do
   end
 
   context 'when after_commit :update_highest_role' do
+    context 'with feature flag enabled' do
       where(:member_type, :source_type) do
         :project_member | :project
         :group_member   | :group
@@ -634,4 +635,51 @@ describe Member do
         end
       end
     end
+
+    context 'with feature flag disabled' do
+      before do
+        stub_feature_flags(highest_role_callback: false)
+      end
+
+      where(:member_type, :source_type) do
+        :project_member | :project
+        :group_member   | :group
+      end
+
+      with_them do
+        describe 'create member' do
+          it 'does not initialize a new Members::UpdateHighestRoleService object' do
+            source = create(source_type)
+            user = create(:user)
+
+            expect(Members::UpdateHighestRoleService).not_to receive(:new).with(user.id)
+
+            create(member_type, :guest, user: user, source_type => source)
+          end
+        end
+
+        context 'when member exists' do
+          let!(:member) { create(member_type) }
+
+          describe 'update member' do
+            context 'when access level was changed' do
+              it 'does not initialize a new Members::UpdateHighestRoleService object' do
+                expect(Members::UpdateHighestRoleService).not_to receive(:new).with(member.user_id)
+
+                member.update(access_level: Gitlab::Access::GUEST)
+              end
+            end
+          end
+
+          describe 'destroy member' do
+            it 'does not initialize a new Members::UpdateHighestRoleService object' do
+              expect(Members::UpdateHighestRoleService).not_to receive(:new).with(member.user_id)
+
+              member.destroy
+            end
+          end
+        end
+      end
+    end
+  end
 end