Keep build artifacts referenced by the release evidence

These artifacts need to be preserved for audit purposes

app/models/ci/build.rb

@@ -801,6 +801,11 @@ module Ci
       has_expiring_artifacts? && job_artifacts_archive.present?
     end
 
+    def self.keep_artifacts!
+      update_all(artifacts_expire_at: nil)
+      Ci::JobArtifact.where(job: self.select(:id)).update_all(expire_at: nil)
+    end
+
     def keep_artifacts!
       self.update(artifacts_expire_at: nil)
       self.job_artifacts.update_all(expire_at: nil)

ee/app/services/ee/releases/create_evidence_service.rb

@@ -5,19 +5,27 @@ module EE
     module CreateEvidenceService
       extend ::Gitlab::Utils::Override
 
+      def execute
+        super
+
+        keep_report_artifacts
+      end
+
       override :evidence_options
       def evidence_options
-        options = super.dup
+        super.merge(
+          report_artifacts: report_artifacts
+        )
+      end
 
-        if release.project.feature_available?(:release_evidence_test_artifacts)
-          options[:report_artifacts] = report_artifacts
-        end
+      def report_artifacts
+        return ::Ci::Build.none unless release.project.feature_available?(:release_evidence_test_artifacts)
 
-        options
+        pipeline&.latest_report_builds || ::Ci::Build.none
       end
 
-      def report_artifacts
-        pipeline&.latest_report_builds || []
+      def keep_report_artifacts
+        report_artifacts.keep_artifacts!
       end
     end
   end

ee/changelogs/unreleased/32773-include-test-results-within-release-evidence-2.yml

+---
+title: Keep artifacts referenced by release evidence
+merge_request: 29350
+author:
+type: added

ee/spec/services/ee/releases/create_evidence_service_spec.rb

@@ -39,5 +39,29 @@ describe Releases::CreateEvidenceService do
       service.execute
       expect(Releases::Evidence.last.summary['release']).not_to have_key('report_artifacts')
     end
+
+    it 'keeps build report artifacts if feature is licenced' do
+      stub_licensed_features(release_evidence_test_artifacts: true)
+
+      Ci::Build.update_all(artifacts_expire_at: 1.month.from_now)
+
+      service.execute
+
+      expect(build_with_artifacts.reload.artifacts_expire_at).to be_present
+      expect(build_test_report.reload.artifacts_expire_at).to be_nil
+      expect(build_coverage_report.reload.artifacts_expire_at).to be_nil
+    end
+
+    it 'does not keep artifacts if feature is unlicenced' do
+      stub_licensed_features(release_evidence_test_artifacts: false)
+
+      Ci::Build.update_all(artifacts_expire_at: 1.month.from_now)
+
+      service.execute
+
+      expect(build_with_artifacts.reload.artifacts_expire_at).to be_present
+      expect(build_test_report.reload.artifacts_expire_at).to be_present
+      expect(build_coverage_report.reload.artifacts_expire_at).to be_present
+    end
   end
 end

spec/models/ci/build_spec.rb

@@ -1811,6 +1811,50 @@ describe Ci::Build do
     end
   end
 
+  describe '.keep_artifacts!' do
+    let!(:build) { create(:ci_build, artifacts_expire_at: Time.current + 7.days) }
+    let!(:builds_for_update) do
+      Ci::Build.where(id: create_list(:ci_build, 3, artifacts_expire_at: Time.current + 7.days).map(&:id))
+    end
+
+    it 'resets expire_at' do
+      builds_for_update.keep_artifacts!
+
+      builds_for_update.each do |build|
+        expect(build.reload.artifacts_expire_at).to be_nil
+      end
+    end
+
+    it 'does not reset expire_at for other builds' do
+      builds_for_update.keep_artifacts!
+
+      expect(build.reload.artifacts_expire_at).to be_present
+    end
+
+    context 'when having artifacts files' do
+      let!(:artifact) { create(:ci_job_artifact, job: build, expire_in: '7 days') }
+      let!(:artifacts_for_update) do
+        builds_for_update.map do |build|
+          create(:ci_job_artifact, job: build, expire_in: '7 days')
+        end
+      end
+
+      it 'resets dependent objects' do
+        builds_for_update.keep_artifacts!
+
+        artifacts_for_update.each do |artifact|
+          expect(artifact.reload.expire_at).to be_nil
+        end
+      end
+
+      it 'does not reset dependent object for other builds' do
+        builds_for_update.keep_artifacts!
+
+        expect(artifact.reload.expire_at).to be_present
+      end
+    end
+  end
+
   describe '#keep_artifacts!' do
     let(:build) { create(:ci_build, artifacts_expire_at: Time.current + 7.days) }