Merge branch 'fp-improve-build-finished-worker-idempotency' into 'master'

Run sync BuildFinishedWorker operations always before

See merge request gitlab-org/gitlab!67117

ee/app/workers/ee/ci/build_finished_worker.rb

@@ -4,6 +4,11 @@ module EE
   module Ci
     module BuildFinishedWorker
       def process_build(build)
+        # Always run `super` first since it contains sync operations.
+        # Failing to run sync operations would cause the worker to retry
+        # and enqueueing duplicate jobs.
+        super
+
         unless ::Feature.enabled?(:cancel_pipelines_prior_to_destroy, build.project, default_enabled: :yaml)
           ::Ci::Minutes::UpdateBuildMinutesService.new(build.project, nil).execute(build)
         end
@@ -15,8 +20,6 @@ module EE
         if ::Gitlab.com? && build.has_security_reports?
           ::Security::TrackSecureScansWorker.perform_async(build.id)
         end
-
-        super
       end
     end
   end

ee/spec/workers/ee/ci/build_finished_worker_spec.rb

@@ -56,6 +56,20 @@ RSpec.describe Ci::BuildFinishedWorker do
         subject
       end
 
+      context 'when exception is raised in `super`' do
+        before do
+          allow(::BuildHooksWorker)
+            .to receive(:perform_async)
+            .and_raise(ArgumentError)
+        end
+
+        it 'does not enqueue the worker in EE' do
+          expect { subject }.to raise_error(ArgumentError)
+
+          expect(::Security::TrackSecureScansWorker).not_to receive(:perform_async)
+        end
+      end
+
       context 'when build does not have a security report' do
         let(:build) { create(:ee_ci_build, :success, runner: ci_runner) }