Bugfix: scope vulnerability occurrences by Time not Date

Fix flaky test that can occur when rounding by Date instead of Time.
This can result in scoping failures when run on a computer with non-UTC
timezone

ee/app/models/vulnerabilities/occurrence.rb

@@ -79,7 +79,7 @@ module Vulnerabilities
     def self.count_by_day_and_severity(period)
       joins(:occurrence_pipelines)
         .select('CAST(vulnerability_occurrence_pipelines.created_at AS DATE) AS day', :severity, 'COUNT(distinct vulnerability_occurrences.id) as count')
-        .where(['vulnerability_occurrence_pipelines.created_at >= ?', Date.today - period])
+        .where(['vulnerability_occurrence_pipelines.created_at >= ?', Time.zone.now.beginning_of_day - period])
         .group(:day, :severity)
         .order('day')
     end

ee/changelogs/unreleased/fix-scope-vulnerability-window-to-time-not-date.yml

+---
+title: Fix vulnerability occurrence scope to trailing 30 days
+merge_request: 9494
+author:
+type: fixed

ee/spec/models/vulnerabilities/occurrence_spec.rb

@@ -84,7 +84,7 @@ describe Vulnerabilities::Occurrence do
 
   describe '.count_by_day_and_severity' do
     let(:project) { create(:project) }
-    let(:date_1) { Time.zone.parse('2018-11-10') }
+    let(:date_1) { Time.zone.parse('2018-11-11') }
     let(:date_2) { Time.zone.parse('2018-11-12') }
 
     before do
@@ -111,12 +111,16 @@ describe Vulnerabilities::Occurrence do
 
     subject do
       travel_to(Time.zone.parse('2018-11-15')) do
-        described_class.count_by_day_and_severity(3.days)
+        described_class.count_by_day_and_severity(range)
       end
     end
 
-    it 'returns expected counts for occurrences within given period' do
+    context 'within 3-day period' do
+      let(:range) { 3.days }
+
+      it 'returns expected counts for occurrences' do
         first, second = subject
+
         expect(first.day).to eq(date_2)
         expect(first.severity).to eq('low')
         expect(first.count).to eq(3)
@@ -126,6 +130,25 @@ describe Vulnerabilities::Occurrence do
       end
     end
 
+    context 'within 4-day period' do
+      let(:range) { 4.days }
+
+      it 'returns expected counts for occurrences' do
+        first, second, third = subject
+
+        expect(first.day).to eq(date_1)
+        expect(first.severity).to eq('high')
+        expect(first.count).to eq(2)
+        expect(second.day).to eq(date_2)
+        expect(second.severity).to eq('low')
+        expect(second.count).to eq(3)
+        expect(third.day).to eq(date_2)
+        expect(third.severity).to eq('medium')
+        expect(third.count).to eq(1)
+      end
+    end
+  end
+
   describe '.by_report_types' do
     let!(:vulnerability_sast) { create(:vulnerabilities_occurrence, report_type: :sast) }
     let!(:vulnerability_dast) { create(:vulnerabilities_occurrence, report_type: :dast) }