[FF] `ingest_malware_advisories` — gate the DB upsert into pm_malware_* tables

## Summary Roll out the **DB insert/upsert** for malware advisories — the `bulk_upsert!` into `pm_malware_advisories` and `pm_malware_affected_packages` — behind the `ingest_malware_advisories` feature flag, checked in the malware ingestion task immediately before the upsert. - DRI: @bala.kumar - Team Slack channel: `#g_security_infrastructure` <!-- confirm/adjust --> > [!note] > **Instance-wide flag (no actor).** The writes are cell-local, so this is checked with `Feature.enabled?(:ingest_malware_advisories)` (no actor argument) and rolled out with **boolean** enablement per environment — not an `--actors` percentage rollout. > [!note] > Pairs with [#604583](https://gitlab.com/gitlab-org/gitlab/-/work_items/604583) (`sync_malware_advisories`, which gates the worker and PDS calls). With **sync on + ingest off**, the worker fetches and parses from PDS but **writes nothing** — a dry-run of the connector/parsing path. Enable this flag once a clean dry-run cycle is confirmed. > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) Blocked by the ingestion task [#602431](https://gitlab.com/gitlab-org/gitlab/-/work_items/602431) (where the gate lives) and the sync worker [#602432](https://gitlab.com/gitlab-org/gitlab/-/work_items/602432) (needed to exercise it). ## What could go wrong? - **Scope:** controls the **write** step only. While off, the sync can run and fetch/parse but no rows are persisted to `pm_malware_*`. - **Resource risk:** enabling adds DB write load (validated `bulk_upsert!`) during each sync cycle. Watch PostgreSQL on [dashboards.gitlab.net](https://dashboards.gitlab.net). - **No data-loss risk:** global, non-customer reference data; disabling stops further writes immediately. ## Rollout Run production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post to the team channel. Instance-wide (no actors) → boolean enablement. **Non-production** ``` /chatops gitlab run feature set ingest_malware_advisories true --dev --pre --staging --staging-ref ``` **Production** — enable after a clean dry-run (`sync_malware_advisories` on, this flag off) is confirmed: ``` /chatops gitlab run feature set ingest_malware_advisories true ``` ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle). Remove the flag and its YAML definition, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete ingest_malware_advisories --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set ingest_malware_advisories false # production — stops writes, sync keeps running /chatops gitlab run feature set ingest_malware_advisories false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete ingest_malware_advisories --dev --pre --staging --staging-ref --production # remove entirely ```

issue