Enqueuer query uses root namespace for imports

The container registry migration enqueuer is updated
to use the root namespace when checking the denylist
and plan.

app/models/container_repository.rb

@@ -66,7 +66,7 @@ class ContainerRepository < ApplicationRecord
     # feature flag since it is only accessed in this query.
     # https://gitlab.com/gitlab-org/gitlab/-/issues/350543 tracks the rollout and
     # removal of this feature flag.
-    joins(:project).where(
+    joins(project: [:namespace]).where(
       migration_state: [:default],
       created_at: ...ContainerRegistry::Migration.created_before
     ).with_target_import_tier
@@ -76,7 +76,7 @@ class ContainerRepository < ApplicationRecord
         FROM feature_gates
         WHERE feature_gates.feature_key = 'container_registry_phase_2_deny_list'
         AND feature_gates.key = 'actors'
-        AND feature_gates.value = concat('Group:', projects.namespace_id)
+        AND feature_gates.value = concat('Group:', namespaces.traversal_ids[1])
       )"
     )
   end

ee/app/models/ee/container_repository.rb

@@ -31,7 +31,12 @@ module EE
           joins(project: [:namespace]).where(namespaces: { path: GITLAB_ORG_NAMESPACE })
         else
           joins(
-            project: [namespace: [gitlab_subscription: [:hosted_plan]]]
+            %{
+              INNER JOIN "projects" on "projects"."id" = "container_repositories"."project_id"
+              INNER JOIN "namespaces" on "namespaces"."id" = "projects"."namespace_id"
+              INNER JOIN "gitlab_subscriptions" on "gitlab_subscriptions"."namespace_id" = "namespaces"."traversal_ids"[1]
+              INNER JOIN "plans" on "plans"."id" = "gitlab_subscriptions"."hosted_plan_id"
+            }
           ).where(plans: { id: ::ContainerRegistry::Migration.target_plan.id })
         end
       end

ee/spec/models/container_repository_spec.rb

@@ -4,7 +4,9 @@ require 'spec_helper'
 
 RSpec.describe ContainerRepository, :saas do
   describe '.with_target_import_tier' do
-    let_it_be(:project) { create(:project) }
+    let_it_be(:root_group) { create(:group) }
+    let_it_be(:group) { create(:group, parent_id: root_group.id) }
+    let_it_be(:project) { create(:project, namespace: group) }
     let_it_be(:valid_container_repository) { create(:container_repository, project: project) }
 
     let_it_be(:gitlab_namespace) { create(:namespace, path: 'gitlab-org') }
@@ -14,7 +16,7 @@ RSpec.describe ContainerRepository, :saas do
     let_it_be(:ultimate_project) { create(:project) }
     let_it_be(:ultimate_container_repository) { create(:container_repository, project: ultimate_project) }
 
-    let(:subscription) { create(:gitlab_subscription, :premium, namespace: project.namespace) }
+    let(:subscription) { create(:gitlab_subscription, :premium, namespace: root_group) }
     let(:ultimate_subscription) { create(:gitlab_subscription, :ultimate, namespace: ultimate_project.namespace) }
 
     subject { described_class.with_target_import_tier }
@@ -42,7 +44,7 @@ RSpec.describe ContainerRepository, :saas do
     let_it_be(:ultimate_project) { create(:project) }
     let_it_be(:ultimate_container_repository) { create(:container_repository, project: ultimate_project, created_at: 2.days.ago) }
 
-    let_it_be(:subscription) { create(:gitlab_subscription, :premium, namespace: project.namespace) }
+    let_it_be(:subscription) { create(:gitlab_subscription, :premium, namespace: root_group) }
     let_it_be(:denied_subscription) { create(:gitlab_subscription, :premium, namespace: denied_project.namespace) }
     let_it_be(:ultimate_subscription) { create(:gitlab_subscription, :ultimate, namespace: ultimate_project.namespace) }
 

spec/models/container_repository_spec.rb

@@ -1255,7 +1255,7 @@ RSpec.describe ContainerRepository, :aggregate_failures do
       subject { described_class.ready_for_import }
 
       before do
-        stub_application_setting(container_registry_import_target_plan: project.namespace.actual_plan_name)
+        stub_application_setting(container_registry_import_target_plan: root_group.actual_plan_name)
       end
 
       it 'works' do

spec/support/shared_contexts/container_repositories_shared_context.rb

 # frozen_string_literal: true
 
 RSpec.shared_context 'importable repositories' do
-  let_it_be(:project) { create(:project) }
+  let_it_be(:root_group) { create(:group) }
+  let_it_be(:group) { create(:group, parent_id: root_group.id) }
+  let_it_be(:project) { create(:project, namespace: group) }
   let_it_be(:valid_container_repository) { create(:container_repository, project: project, created_at: 2.days.ago) }
   let_it_be(:valid_container_repository2) { create(:container_repository, project: project, created_at: 1.year.ago) }
   let_it_be(:importing_container_repository) { create(:container_repository, :importing, project: project, created_at: 2.days.ago) }
   let_it_be(:new_container_repository) { create(:container_repository, project: project) }
 
-  let_it_be(:denied_group) { create(:group) }
+  let_it_be(:denied_root_group) { create(:group) }
+  let_it_be(:denied_group) { create(:group, parent_id: denied_root_group.id) }
   let_it_be(:denied_project) { create(:project, group: denied_group) }
   let_it_be(:denied_container_repository) { create(:container_repository, project: denied_project, created_at: 2.days.ago) }
 
@@ -21,7 +24,7 @@ RSpec.shared_context 'importable repositories' do
     Feature::FlipperGate.create!(
       feature_key: 'container_registry_phase_2_deny_list',
       key: 'actors',
-      value: "Group:#{denied_group.id}"
+      value: "Group:#{denied_root_group.id}"
     )
   end
 end