Merge branch '343843-prevent-update' into 'master'

Does not update persisted feedback when dismissing existing vulnerability

See merge request gitlab-org/gitlab!73311

ee/app/services/vulnerability_feedback/create_service.rb

@@ -134,9 +134,11 @@ module VulnerabilityFeedback
                                               dismiss_findings: false).execute
         end
 
+        unless vulnerability_feedback.persisted?
           raise ActiveRecord::Rollback unless vulnerability_feedback.save
         end
       end
+    end
 
     def existing_vulnerability
       strong_memoize(:existing_vulnerability) { vulnerability_feedback.finding&.vulnerability }

ee/spec/services/vulnerability_feedback/create_service_spec.rb

@@ -146,6 +146,19 @@ RSpec.describe VulnerabilityFeedback::CreateService, '#execute' do
           end
         end
       end
+
+      context 'when we already have persisted feedback' do
+        let!(:feedback) do
+          create(:vulnerability_feedback, :dismissal,
+                 project: project,
+                 pipeline: pipeline,
+                 project_fingerprint: project_fingerprint)
+        end
+
+        it 'does not update the feedback' do
+          expect { result }.not_to change { feedback.reload.updated_at }
+        end
+      end
     end
 
     context 'when feedback_type is issue' do