perf(db): add index on sbom_external_node(sbom_id, external_node_ref)

[mrrajan]

Eliminates sequential scan during external node resolution. Verified: Seq Scan → Index Scan on hosted environment.

Implements TC-4750

Assisted-by: Claude Code

Summary by Sourcery

Enhancements:

• Introduce a migration that adds a composite index on sbom_external_node(sbom_id, external_node_ref) to optimize query performance.

[sourcery-ai]

Reviewer's Guide

Adds a new SeaORM migration to create a composite index on sbom_external_node(sbom_id, external_node_ref) and wires it into the migrator so external node resolution can use an index scan instead of a sequential scan.

File-Level Changes

Change	Details	Files
Introduce a new SeaORM migration that creates/drops a composite index on sbom_external_node over (sbom_id, external_node_ref) and register it in the global migrator.	Register a new migration module m0002200_sbom_external_node_ref_index in the migration library and add it to the Migrator::build_migrations chain as a normal migration. Define the Migration::up implementation to create an if-not-exists index named IdxSbomExternalNodeRef on the SbomExternalNode table over SbomId and ExternalNodeRef using SeaORM’s Index builder. Define the Migration::down implementation to drop the index if it exists, mirroring the up migration. Introduce DeriveIden enums (Indexes and SbomExternalNode) to provide identifier names for the index and table/columns in a type-safe way.	migration/src/lib.rs migration/src/m0002200_sbom_external_node_ref_index.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.39%. Comparing base (5f31950) to head (f3daf1c).
⚠️ Report is 15 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2404      +/-   ##
==========================================
+ Coverage   71.37%   71.39%   +0.01%     
==========================================
  Files         441      442       +1     
  Lines       26747    26896     +149     
  Branches    26747    26896     +149     
==========================================
+ Hits        19092    19202     +110     
- Misses       6541     6565      +24     
- Partials     1114     1129      +15     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rh-jfuller]

@mrrajan considering current and ongoing work on 0.4.z (which will push to main) I think this PR can be closed ... do you agree ?

[rh-jfuller]

This index impacts latest analysis endpoints with an example query being at collector.rs:271-276:

sbom_external_node::Entity::find()
    .filter(sbom_external_node::Column::SbomId.eq(sbom_external_node.sbom_id))
    .filter(sbom_external_node::Column::ExternalNodeRef.eq(&sbom_external_node.node_id))
    .one(self.connection)

but testing (perf and sql) shows no appreciable difference between status quo and using new index:
before

EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT)
SELECT *
FROM sbom_external_node
WHERE sbom_id = '019661ca-0df3-7413-a43d-c45aab8e9200'
  AND external_node_ref = 'SPDXRef-A'
LIMIT 1;
+----------------------------------------------------------------------------------------------------------------------------------------------------+
| QUERY PLAN                                                                                                                                         |
|----------------------------------------------------------------------------------------------------------------------------------------------------|
| Limit  (cost=0.42..4.69 rows=1 width=319) (actual time=0.014..0.014 rows=0 loops=1)                                                                |
|   Buffers: shared hit=4                                                                                                                            |
|   ->  Index Scan using sbom_external_node_pkey on sbom_external_node  (cost=0.42..4.69 rows=1 width=319) (actual time=0.013..0.013 rows=0 loops=1) |
|         Index Cond: (sbom_id = '019661ca-0df3-7413-a43d-c45aab8e9200'::uuid)                                                                       |
|         Filter: ((external_node_ref)::text = 'SPDXRef-A'::text)                                                                                    |
|         Rows Removed by Filter: 10                                                                                                                 |
|         Buffers: shared hit=4                                                                                                                      |
| Planning:                                                                                                                                          |
|   Buffers: shared hit=41                                                                                                                           |
| Planning Time: 0.209 ms                                                                                                                            |
| Execution Time: 0.030 ms   

after

EXPLAIN (ANALYZE, BUFFERS, FORMAT TEXT)
SELECT *
FROM sbom_external_node
WHERE sbom_id = '019661ca-0df3-7413-a43d-c45aab8e9200'
  AND external_node_ref = 'SPDXRef-A'
LIMIT 1;
+-----------------------------------------------------------------------------------------------------------------------------------------------------------+
| QUERY PLAN                                                                                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Limit  (cost=0.42..2.64 rows=1 width=320) (actual time=0.014..0.015 rows=0 loops=1)                                                                       |
|   Buffers: shared hit=3                                                                                                                                   |
|   ->  Index Scan using tmp_idx_sbom_external_node_ref on sbom_external_node  (cost=0.42..2.64 rows=1 width=320) (actual time=0.013..0.014 rows=0 loops=1) |
|         Index Cond: ((sbom_id = '019661ca-0df3-7413-a43d-c45aab8e9200'::uuid) AND ((external_node_ref)::text = 'SPDXRef-A'::text))                        |
|         Buffers: shared hit=3                                                                                                                             |
| Planning Time: 0.110 ms                                                                                                                                   |
| Execution Time: 0.030 ms 

shows where the new tmp_idx_sbom_external_node_ref is used but basically equiv execution time to existing.

This index would help if an SBOM has a large number of external nodes per sbom_id (hundreds or thousands), where the PK scan + filter would touch many pages which is never the case for rh sboms (usually just a 1 to 1 type relationship).

I think this PR can be closed.