Merge branch 'fix_security_finding_comparison_method' into 'master'

Fix security finding comparison method

See merge request gitlab-org/gitlab!39871

ee/lib/gitlab/ci/reports/security/finding.rb

@@ -74,17 +74,23 @@ module Gitlab
           def eql?(other)
             report_type == other.report_type &&
               location.fingerprint == other.location.fingerprint &&
-              primary_identifier.fingerprint == other.primary_identifier.fingerprint
+              primary_fingerprint == other.primary_fingerprint
           end
 
           def hash
-            report_type.hash ^ location.fingerprint.hash ^ primary_identifier.fingerprint.hash
+            report_type.hash ^ location.fingerprint.hash ^ primary_fingerprint.hash
           end
 
           def valid?
             scanner.present? && primary_identifier.present? && location.present?
           end
 
+          protected
+
+          def primary_fingerprint
+            primary_identifier&.fingerprint
+          end
+
           private
 
           def generate_project_fingerprint

ee/spec/factories/ci/reports/security/findings.rb

@@ -2,7 +2,7 @@
 
 FactoryBot.define do
   factory :ci_reports_security_finding, class: '::Gitlab::Ci::Reports::Security::Finding' do
-    compare_key { "#{identifiers.first.external_type}:#{identifiers.first.external_id}:#{location.fingerprint}" }
+    compare_key { "#{identifiers.first&.external_type}:#{identifiers.first&.external_id}:#{location.fingerprint}" }
     confidence { :medium }
     identifiers { Array.new(1) { FactoryBot.build(:ci_reports_security_identifier) } }
     location factory: :ci_reports_security_locations_sast

ee/spec/lib/gitlab/ci/reports/security/finding_spec.rb

@@ -170,6 +170,14 @@ RSpec.describe Gitlab::Ci::Reports::Security::Finding do
 
     subject { finding.eql?(other_finding) }
 
+    context 'when the primary_identifier is nil' do
+      let(:identifier) { nil }
+
+      it 'does not raise an exception' do
+        expect { subject }.not_to raise_error
+      end
+    end
+
     context 'when the other finding has same `report_type`' do
       let(:report_type) { :sast }